The toll you never drove

The story below is a composite, built from FBI and FTC warnings and a 2025 lawsuit, cited throughout. No real person is described.

The text came in while she was making dinner. She had an unpaid toll of $12.51. If she didn't pay soon, a $50 late fee would be added. There was a link.

She had driven to see her sister last month. There might have been a toll road. She wasn't sure, and $12.51 wasn't worth a fight. Paying it seemed like the responsible thing to do.

The page looked like a real toll website. She typed in her card number. Then a text arrived from her real bank with a code, and the page asked her to enter it to confirm the payment. So she did.

Nothing happened for a week. Then the charges started.

That code wasn't confirming a toll. Her bank had sent it to approve adding her card to a phone's digital wallet. The phone belonged to someone else.

The pattern

This is a delivery or toll text, and it's a volume play. It doesn't need to fool you. It needs to fool a few people out of a very large number.

So it picks problems almost anyone could have. A package on hold. A toll from a trip. A small fee. The FTC says fake package delivery was the most commonly reported text scam of 2024, and unpaid tolls made the list too. Many people reported paying a small "redelivery fee" that turned out to be a way to get their card number or even their Social Security number.

The toll texts borrow real names like E-ZPass, SunPass, FasTrak and TxTag, and threaten late fees or a suspended vehicle registration.

In 2024 the FBI got more than 2,000 complaints about toll texts in about a month, from at least three states. The example it shared asked for $12.51 and warned of a $50 late fee. That's where the numbers in our story come from.

The kit behind the texts

These texts aren't written one at a time. In November 2025, Google sued the people behind a phishing kit called Lighthouse, which Google says powered texts pretending to be E-ZPass and USPS.

Google calls it phishing as a service: a ready-made kit other criminals use. As Krebs on Security reported, it offered over 600 fake website templates for more than 400 companies and agencies. When someone typed in a card number, the kit tried to add that card to an Apple or Google wallet. If the person also typed in the code their bank sent, the card was theirs to use.

Within days of the suit, Google said the operation had been shut down. Researchers were more careful. They still saw many sites running on the same code, and the same group has other kits. The texts haven't stopped.

Where it was visible

It came to you. She never asked anyone to text her about a toll. USPS says the same about packages: it won't text you unless you asked for tracking on a specific package, and even then the text won't have a link.

The amount was small. That's the design. Nobody calls their toll agency over $12.51, and the scammers are counting on that.

There was a late fee. A deadline turns "I'll check later" into "I'll just pay it."

The fix was a link. A real bill can be paid without the link in a text.

It asked for a code. A code from your bank is there to keep strangers out. A page that asks for it is trying to get in.

And the one that's genuinely hard to see: she really had driven on a toll road. Many people have. The text didn't need to know that. It only needed to be sent to enough people that some of them would think, "That could be mine."

What actually stops it

Don't tap the link. Not to check, not to look.

Go find the company yourself. The FTC says to contact the tolling agency using a phone number or website you know is real, not the one in the text. For a package, type the carrier's address yourself and enter your tracking number.

Never type a bank code into a page you reached from a text. Not to confirm, not to verify, not to cancel.

Report it, then delete it. Forward the text to 7726, which spells SPAM. It's free, and it helps phone companies block the sender. Our page on these texts has more on the package and recall versions.

The five signs, in this case

The five signs don't all show up here, and the gaps explain why this scam works.

It came to you. A text about a bill you never asked about.

It moved you fast. A late fee, and a small sum that's easier to pay than to question.

It wants a transfer. A card number, and then the code that makes the card usable.

It asks you to keep it quiet doesn't fit. It doesn't have to. A $12 toll isn't something most people mention to anyone.

It keeps you on the line doesn't fit either. Nobody is on the line. The fake page does all the work, which is how one group can send millions of these.

So with only three signs, lean on the first two steps: break the contact, then look up the number yourself. And if you're unsure, wait a day. Checking your account on your own takes a few minutes.

How common is it

In 2024, people told the FTC they lost $470 million to scams that started with a text. That's five times the 2020 amount, even though fewer people reported them. The FTC's text figures cover every kind of text scam and all ages.

In 2025, reports of government impostors were up 40 percent, which the FTC says was partly because of fake toll texts.

One honest caution. Google's lawsuit says the Lighthouse scheme stole between 12.7 million and 115 million US cards. That range is so wide it tells you size, not a count. It's also a claim in a lawsuit, not a finding by a court.

Tell one person

Send this to someone who drives or gets packages, and ask what they'd do with a text about a $12 toll.

Most people say they'd ignore it. The useful part is saying out loud what they'd do if they weren't sure.

The sentence worth remembering: never pay a bill through the link that told you about it.

The code trick is the same one behind the call from your bank's own number. For texts that claim to be your bank, see is this text from my bank real? And if a stranger later offers to get your money back for a fee, that's the recovery scam.

If this happened to you, or to someone you love

You're not the first and you did nothing stupid. These texts go out by the million, and they're built to look like the ordinary bills you pay every month.

Call your bank or card company now, on the number on the back of your card. Say the word "fraud," ask them to cancel the card, and ask whether it was added to a digital wallet on a phone.
Report it to the FTC at reportfraud.ftc.gov.
Report it to the FBI at ic3.gov. The FBI asks you to include the phone number the text came from and the link it sent.
If you entered anything that identifies you beyond the card, such as a licence or a government number, get a recovery plan from IdentityTheft.gov, or call 877-438-4338.
Call the National Elder Fraud Hotline, 833-372-8311, Monday to Friday, 10 a.m. to 6 p.m. Eastern.
Tell one person you trust.

If anyone contacts you offering to get your money back for a fee, that's a second scam.

Verify first.

Sources last checked: 4 October 2026.