A text claiming you owe a small unpaid toll — from "E-ZPass", "FasTrak", "The Toll Roads" or your state toll authority — with a link to pay right now is one of the most widespread smishing scams today. The goal is your card details. Real toll agencies don't collect debts through a link in a text.
Common variants, always with a link: "Final notice: You have an outstanding toll of $6.99. Pay now to avoid a late fee: [link]" "E-ZPass: your account has an unpaid balance. Settle here to avoid penalties: [link]" "Toll Services: your vehicle has an unpaid toll. Pay within 24 hours: [link]" The link leads to a page that looks like the toll agency and asks for your address and full card details.
• The link isn't the official toll site but a shortened or look-alike domain (.xyz, .top, .icu) • A small, oddly specific amount ($ few dollars) to make you pay without thinking • Urgency: "within 24 hours", "final notice", "avoid a late fee" • Asks for full card details through a link • You may not even use that toll road or account • Comes from an ordinary mobile or international number
Real toll charges appear in your official account (on the app or website you set up) or by mailed invoice — paid after logging in, never through an anonymous SMS link with a tiny amount. Unsure? Open the toll agency's official site yourself (type it manually) and check your balance.
1. Don't tap the link. 2. Paste the message into the free Phishy check on this page — it follows the link to its true destination and tells you in seconds if it's a scam. 3. Already entered your card? Freeze the card immediately (number on the back) and review transactions. 4. Report it: forward to 7726 (SPAM) and to reportfraud.ftc.gov.
No. Real charges are paid inside your official account after logging in, or by mailed invoice — never through a text link with a tiny amount.
The opposite — the small amount is the bait. The goal is your card data, not the few dollars.
Scammers blast these texts to random numbers. If you don't recognize it, it's a scam.
Paste it into the Phishy check on this page — an answer in seconds, no signup.