Skip to content

Practical security for real people & small teams

"Unpaid toll" and fake delivery texts: how to spot them and what to do

By , ICT engineer Published

Guide type
Incident response
Risk
Medium · High if you paid
Time
5–30 min
Cost
Free
Works on
iPhone & Android
Last verified
2026-10-05

The short answer

  • Just received it? Don't tap the link and don't reply, not even "STOP" or "Y". Report it as junk, then delete it.
  • Not sure if you owe something? Open the toll agency's or carrier's website yourself, by typing the address you know. Never use the link in the text.
  • Already paid or typed card details? Call your bank now using the number on your card and ask them to block it.

Since 2024, US police, the FBI and the Federal Trade Commission have warned about a wave of text messages that claim you owe a small toll, a traffic fine or a parcel redelivery fee. The same scripts now reach people in Canada, the UK and Australia, often sent to people who do not even own a car. The amount is small on purpose: it feels easier to pay $6.99 than to check.

What these texts look like

The FBI published this real example in its public warning about toll scams:

"(State Toll Service Name): We've noticed an outstanding toll amount of $12.51 on your record. To avoid a late fee of $50.00, visit https://myturnpiketollservices.com to settle your balance."

The wording changes every few weeks, but the same patterns repeat:

Pretends to beTypical claimWhat it really wants
Toll agency (E-ZPass, SunPass, FasTrak, a state turnpike)Unpaid toll, late fee "today", threat to your license or registrationCard number and billing details
DMV or "traffic court"Unpaid ticket, license suspension, "final notice"Card details, sometimes your driver's license number
USPS, UPS, FedEx, DHLParcel held because of an "incomplete address" or a small redelivery feeCard details and your home address
UK: Royal Mail, Evri, DVLA, HMRCRedelivery fee, vehicle tax problem or tax refundCard details and bank login

Anatomy of a fake toll text

Here is a typical message, rebuilt from the patterns above, with the giveaways marked:

  1. The sender. A foreign number, a random 10-digit number or an email address. Agencies that send texts use short codes you can confirm on their website.
  2. A small, odd amount. Low enough that paying feels easier than checking.
  3. A big threat. Large fees, license suspension, legal action. Toll agencies and courts send notices by mail with an account, invoice or citation number you can look up.
  4. A look-alike address. Brand names stuffed into a domain that the agency does not own, often ending in .top, .xin, .info or similar. The real address of your toll agency is on the back of your transponder statement or on your state's transportation department website.
  5. "Reply Y to activate the link." iPhones disable links in texts from unknown senders. Replying tells your phone you trust the sender, which turns the link on, and it tells the scammer your number is active.

What to do now

Find the row that matches what happened, then follow the steps.

What you didRiskGo to
Only received or read the textLowSteps 1–2
Tapped the link, typed nothingLowSteps 1–2, update your phone
Replied (Y, STOP, anything)Low–medium: expect more scam textsSteps 1–2
Typed card details or paidHighSteps 3–5
Typed your name, address, license or Social Security numberHighSteps 4–6

  1. Report the text as junk

    • iPhone: in Messages, open the text and tap Report Junk under it, or swipe left on it in the list, then choose Delete and Report Junk. Apple notes that once you reply to a message, the report option disappears.
    • Android (Google Messages): touch and hold the conversation, tap Block, tick Report spam and tap OK. Samsung Messages has a similar Block and report spam option.
    • Any phone, US and UK: forward the text to 7726 (it spells SPAM). Your carrier uses it to block the sender.

  2. Tell the authorities, then delete it

    Reports are how these sites get taken down. In the US, report at ReportFraud.ftc.gov and, for toll texts, at IC3.gov, including the sender's number and the link. Fake USPS texts can also be reported to the US Postal Inspection Service. In the UK, forwarding to 7726 is the main route. Take a screenshot first if you lost money, then delete the message.

  3. If you paid or typed card details: call your bank now

    Use the number printed on your card or in your banking app. Ask them to block the card, issue a new one and dispute the charge. Do this even if the payment "failed": the scammers usually wanted the card number, not the $6.99.

  4. Watch for the follow-up call

    A common second stage is a call from "your bank's fraud team" a few hours later, asking you to confirm a code or move money to a "safe account". Your bank will never ask for a one-time code or ask you to move money. Hang up and call the number on your card.

  5. Secure any account you logged in to

    If the fake page asked you to sign in to anything, such as your bank or an email account, follow our guide on what to do after clicking a phishing link: change the password from another device, sign out all sessions and turn on two-step verification. If it was your Gmail and you can no longer get in, see how to recover a hacked Gmail account.

  6. If you gave identity details, protect your credit

    In the US, a credit freeze with Equifax, Experian and TransUnion is free and blocks new accounts in your name. IdentityTheft.gov builds a personal recovery plan if someone has already used your details.

How to check whether you really owe a toll or a parcel fee

The FTC's advice is simple: check with the tolling agency directly, using a phone number or website you know is real.

  • Tolls: sign in to your toll account by typing the address yourself, or search your state's transportation department website for its official toll site. If you do not have a toll account and did not drive on a toll road, you do not owe anything.
  • Parcels: paste the tracking number from your order confirmation email into the carrier's own website or app. Carriers do not charge a redelivery fee by text.
  • Fines: real tickets come with a citation number and a mailed notice. Look up the court or DMV yourself.

Stop most of them before you see them

  • iPhone: in Messages, tap Filter (or the menu at the top of the conversation list), then Manage Filtering, and turn on Screen Unknown Senders (called Filter Unknown Senders in older versions). Texts from numbers not in your contacts go to a separate list without notifications.
  • Android: in Google Messages, tap your profile picture, then Messages settings › Protection & safety › Spam protection, and make sure Enable spam protection is on. It is on by default.
  • Ask older relatives to set this up too. These texts target everyone, and they work best on people who are not expecting them.

Don't

  • Don't reply, not even to say "STOP" or "wrong number". Any reply confirms your number is active.
  • Don't call the number in the message.
  • Don't pay a "recovery service" that offers to get your money back. That is a second scam.
  • Don't trust a text because it knows your name. Names and numbers are bought in bulk from data leaks.

The same playbook is moving to voice: scammers now clone the voices of relatives to ask for urgent money. Our guide to AI voice clone scams explains the family safe-word plan that stops it. If you run a business, add these texts to the staff briefing in our small business cybersecurity checklist.

How we checked this

Written by Ariel, ICT engineer. On 2026-10-05 we compared every step with the FBI's public service announcement on toll smishing, the FTC's consumer alert and its guidance on scam texts, the US Postal Inspection Service, Apple's iPhone User Guide (iOS 27) and Google's Messages help pages. The example message in the "anatomy" section is an illustration we built from published examples; the link in it is not real. Menu names in Samsung Messages and other Android texting apps were not checked and vary by version. This page contains no affiliate links.

Sources