Briefing 03 · Toll smishing

“You have an unpaid toll.” You don’t.

A text arrives: “Final notice — you owe $6.99 in unpaid tolls. Pay now to avoid a $50 late fee and license suspension,” with a link. It looks official, the amount is small enough to just pay, and the deadline makes you rush. It’s one of the largest scam waves in the world right now — and the toll authority never sent it.

How it runs

Small amount, big theft.

1. The bait

Mass texts impersonate a toll service (E-ZPass, SunPass, FasTrak, or a generic “toll authority”). The tiny balance is deliberate — small enough that paying feels easier than checking.

2. The page

The link opens a convincing copy of the toll site asking for card details “to clear the balance.” What you’re really doing is handing your full card number, and often your address and login, straight to the attacker.

3. The real payload

The goal usually isn’t $6.99 — it’s your card on file, resold or charged later, and any passwords you reused on that fake page.

Why it beats careful people

It mimics a real, boring admin task. Nothing feels dramatic — which is exactly why people tap without their guard up.

The tells

Three things the fake can’t survive.

Never do this:

Never enter card details on a page you reached by tapping a texted link, and never “pay a small fee to avoid a big one” under a countdown. If you’re unsure you owe a toll, check the official site directly — never through the message.

The defense

One rule: the link is never the way to pay.

Decide it once and tell your family: we never pay a bill from a link that arrived by text. If a toll (or any bill) might be real, we open the official app or type the real address ourselves. That single rule kills toll texts, delivery texts, and fake bank alerts all at once.