Guide · Phishing & scams

Got a text saying you owe a toll? Don’t tap the link

By Christopher Smith, MS Cyber Security, penetration tester·Published October 22, 2026·Updated October 22, 2026·5 min read

The text looks routine: a toll agency says you owe a few dollars and will get hit with a late fee unless you pay today through a link. It can show up whether or not you’ve driven on a toll road. The link leads to a fake payment page built to collect your card number and personal details.

The FBI’s Internet Crime Complaint Center (IC3) warned about these toll “smishing” texts in April 2024, and the FTC followed with its own alert. In April 2026 Consumer Reports asked toll agencies across the U.S. whether they text payment links and found none that do. This guide is the companion to our Spot It First Short on the toll text.

Quick verdict

• Don’t tap the link and don’t reply, not even with “Y” or “STOP.”
• Check your toll account yourself by typing the agency’s website into your browser or calling the number on your statement or transponder account.
• Report it, then delete it: use your phone’s “report junk” option or forward the text to 7726 (SPAM), and file a complaint at ic3.gov.

The tells

These signs come from the FCC’s toll scam guidance, the IC3 alert, and the Consumer Reports review. One is enough to stop and check.

What to do instead

1. Leave the text alone. Don’t tap the link, don’t reply, and don’t call any number in the message.
2. Check the real account. Type your toll agency’s website address yourself, open its official app, or call the customer service number on your statement or account. If you owe nothing there, you owe nothing.
3. Report it. Use your messaging app’s “report junk” option or forward the text to 7726. The IC3 also asks for a complaint at ic3.gov that includes the sender’s number and the website in the text.
4. Delete it once you’ve reported it.

If you already tapped or paid

• Call your bank or card issuer using the number on the back of your card. Ask them to block the card and dispute the charge.
• Watch your accounts for charges you don’t recognize, and dispute them quickly. The IC3 recommends securing your personal information and financial accounts.
• If you entered personal details like your driver’s license or Social Security number, get a recovery plan at IdentityTheft.gov and consider a fraud alert or credit freeze.
• If you only tapped the link, close the page, don’t enter anything, and keep your phone’s software up to date.

Business owners face extra exposure here because the same person often pays both personal and company bills. See identity theft protection for owners for what to lock down first.

If you run a team

• Make one rule: nobody pays a toll, fine, or invoice from a text link. Company tolls are paid only through the toll account portal you already use.
• Name an owner for every toll or transponder account on company vehicles, so staff know who to ask instead of paying.
• Tell people where suspicious texts go: report as junk, then send a screenshot to that owner. It takes ten seconds and tells you who is being targeted.
• Share this page with anyone who drives for work or carries a company phone.

Bottom line

A text that demands toll money through a link is a scam. Don’t tap, don’t reply, and check your account the way you normally would. Report the text and delete it, and make “nobody pays from a link” a rule for your whole team.

Free next step: Get the Small Business Cybersecurity Checklist — download it now, or sign up there to get it by email and hear about new guides.