Unpaid toll and traffic ticket text scams

A text that says you owe a small unpaid toll or an overdue traffic ticket, with a link to "pay now," is almost always a phishing message sent by criminals, not a notice from a toll agency or court. The link leads to a lookalike payment page whose real purpose is to collect your card number, your address and sometimes your driver's license number. If you have not already tapped it, do not; look up the agency yourself and check your account there. If you did tap it or type anything in, the first hour matters, and the steps are below.

The pattern behind the texts

Security people call this smishing: phishing by SMS. The messages have been circulating for years, but they became a national story in 2024. The FBI's Internet Crime Complaint Center (IC3) published a public service announcement dated April 12, 2024 saying it had received more than 2,000 complaints about road-toll texts since early March of that year, from at least three states. It described the messages as nearly identical from one state to the next, with only the sending phone numbers changing. A typical text claimed an outstanding toll balance, gave a short deadline and warned of a late fee, then pointed to a website imitating the name of a state toll service.

The Federal Trade Commission described the same scheme in a consumer alert dated January 17, 2025. Its summary: scammers pose as tolling agencies across the country, the text shows a dollar amount and a link, and the page behind the link asks for bank or card details. The FTC also warned that clicking can hand over personal details such as a driver's license number, which can then be used for identity theft.

Three features repeat in nearly every version:

• A small, plausible amount. The balance is low enough that you might pay it just to make the problem go away, and low enough that you won't scrutinize it.
• A deadline and a penalty. A late fee, a suspended registration or a referral to the DMV creates urgency so you act before you think.
• A link instead of an account. Real billing relationships point you to an account you already have, or to a mailed invoice that identifies your vehicle. The scam text points to a payment form.

The same template is easy to reskin. Swap the toll agency for "the DMV," "the traffic court" or "the county clerk," change the story to an unpaid ticket, and the rest of the machinery is identical. Because the texts are generic, scammers do not need to know whether you drive on toll roads at all. Massachusetts' toll program states that the targeted phone numbers seem to be chosen at random and are not tied to an account or use of toll roads. That is why people who have never driven through a toll plaza receive them.

Why toll agencies, DMVs and courts make good lures

A lure works when it is something the target already half-expects and cannot easily dismiss. Government payment demands fit for four reasons.

Almost every driver has a plausible link to them. Anyone who has used a toll road, parked on a street, or been stopped for a speeding ticket has a mental file for "money I might owe the government." A text that touches that file feels possible.

Consequences are real, so the threat lands. Unpaid tolls can turn into fines in the real world, and a suspended license or registration is a real consequence of unresolved tickets in many states. Scammers borrow the credibility of those consequences. The message does not have to be true; it only has to resemble something that could be.

People do not know the official channels. Few drivers could say how their toll agency actually contacts customers. Not knowing makes any official-looking sender plausible.

The amounts are small, so people don't report. A victim who loses $9.50 may never notice or complain. The criminal's real take is the card number and the identity details, which can be used or sold long after the original charge, and the small first charge may be a test of whether the card is live.

The safest approach follows from that: treat any unsolicited message demanding payment as unverified until you check it through a channel you chose yourself.

How genuine toll notices and court notices actually reach you

You cannot tell a real notice by its look. Logos are easy to copy. You can tell it by how it reaches you and what it asks you to do. Because every agency's process differs, the general pattern below is a starting point, and the agency's own website is the final word.

Toll agencies. If you have a transponder account, the agency has your contact details and sends statements or alerts you signed up for, and its website lets you log in and see your balance. If you drive through an electronic toll lane with no account, many agencies bill the registered owner of the plate, often by mailed invoice with an account or invoice number and a way to pay on the agency's own site. Massachusetts' program, for example, offers a license-plate-based invoice option for customers without a transponder account, as the EZDriveMA site describes. Some agencies do send text alerts, but only to customers who enrolled for them. EZDriveMA's smishing alert says it will never request payment by text and that every legitimate link includes its own domain, EZDriveMA.com. That standard, a payment demand by text never being legitimate, is worth adopting as a rule even where your own agency has not published one.

DMVs. The Virginia DMV says on its site that it is aware of fraudulent text and email messages about fines and suspensions and that it will never send texts or emails about your fines or suspensions or ask you to share financial details by text or email (as of the page viewed in November 2026, on its financial responsibility certifications page). The California DMV's scam alert page says the DMV will never ask for personal or financial information by text, and warns about fake websites that look like the DMV's and charge unnecessary fees. If your state has a similar page, it is the best evidence you can get about what your own DMV does.

Courts. Traffic citations originate with an officer, and the citation itself tells you which court handles it, how to respond and by what date. Courts that want to reach you by mail or in person typically do so using the address on file with the DMV. An out-of-the-blue text from a number you do not recognize, about a ticket you cannot remember, is not how the court process begins. If you really do wonder whether you have an open ticket, look up the court's own website from a search you run yourself, or call the court clerk at a number you find independently. The citation number is the key; no legitimate case lookup depends on a stranger's link.

Real notice or scam text: a side-by-side check

If a message fits the right-hand column on even two rows, treat it as a scam until you have confirmed it elsewhere.

A worked example of how the fraud pays off

The numbers below are invented for illustration only.

Say you get a text: "Final notice: you have an unpaid toll balance of $8.40. Pay within 12 hours to avoid a $35 late fee," followed by a link that begins with the agency's name but ends in an unfamiliar domain. You are in a hurry, so you tap the link and see a clean, official-looking page. You enter your name, mailing address, phone number and card details, and the page says "payment received."

What the criminals now hold: your card number with its expiration date and security code, your full name, your address and your phone number. They may have asked for a driver's license number "to verify your identity." The $8.40 may or may not be charged. In many cases it is not the point.

From there the data can be used in several ways:

1. Card fraud. The card may be used immediately for online purchases, or sold in bulk with thousands of others.
2. Digital wallets. The scammer may try to add your card to a mobile wallet on their own phone, then use a verification code that the bank texts to you. The scam site or a follow-up call may ask you to read that code back.
3. Identity packaging. Name, address, phone, and license number together are the raw material for opening accounts or applying for services in your name.
4. Follow-up scams. Your number is now confirmed as live and reactive. Expect further messages, now more tailored.

None of these steps required the criminal to know anything about your driving history. That is what makes the first mistake so cheap for them and so expensive for you.

What to do in the first hour if you clicked or entered details

Speed matters more than perfect order. These steps follow the FBI's and FTC's published guidance for people who clicked or paid.

1. Stop interacting. Close the page. Do not reply to the text, call a number it contains, or "verify" on a follow-up screen.
2. Call your card issuer right away. Use the number on the back of the card. The FTC's guide on what to do if you were scammed says to report it to the card issuer immediately and ask for a refund, and it notes that federal law protects you from unauthorized use of a credit or debit card. Ask the issuer to cancel and replace the card rather than only watching the account.
3. Remove the card from digital wallets and any stored payment profiles at merchants, so a stolen number cannot be quietly reused.
4. Change passwords if you typed any. If the page asked for an account login, change that password now and anywhere else you used it, and turn on two-factor authentication. The FTC gives this advice for anyone who gave a scammer a username and password.
5. Run a security scan on your phone if you tapped a link or opened a file, and update your phone's software.
6. Report it. File a complaint with the FBI at ic3.gov, including the number that sent the text and the website listed in it, as the FBI asks. Report the text at ReportFraud.ftc.gov and forward it to 7726 (SPAM) or use your phone's "report junk" option, as the FTC advises. Tell the toll agency or DMV whose name was used; many post a page about the scam and want the evidence.
7. If you gave your driver's license number or Social Security number, go to IdentityTheft.gov for a recovery plan tailored to what you disclosed, which is the FTC's recommendation.
8. Dispute any unfamiliar charge in writing as well as by phone, and keep a note of the date, the person you spoke to and what they said.

Then delete the text. Keep a screenshot first if you plan to report it, because the evidence will be useful to investigators and your bank.

How stolen card and identity data feeds insurance account takeover

A scam about a toll can end in an insurance problem months later, and the connection is worth understanding because that is where the damage becomes hard to trace.

Your auto insurer's online account is protected by a login. Criminals who hold your name, address, phone number and email, plus the password you reused somewhere, can try that combination at insurer websites. If they get in, they can see the policy, vehicles, drivers, and sometimes a downloadable ID card or declarations page, and they can make requests: add a driver, change the mailing address, swap the bank account used for payments, or start a claim that pays out to an account they control. A changed address is a common first step because it redirects notices and checks away from you.

Even without getting into your account, the data is useful. A name, address and license number are the inputs an insurance application asks for, so someone holding them can try to buy a policy in your name or request quotes that return details about you. Our article on insurance identity theft: policies and claims in your name covers what that looks like and how to find fraudulent policies and claims through your motor vehicle report and your CLUE report. The pattern also overlaps with ghost broking, where a fake seller uses your details to buy a real policy and passes along inflated or false paperwork.

The practical defense is the same as for any phishing: a strong, unique password for the insurance account, two-factor authentication, and an email alert for any change to the policy. If your insurer was itself breached rather than just impersonated, see after an insurer data breach: what drivers should do.

What to ask when you are not sure the notice is real

If a letter or text is plausible and you want to check it, do not use any phone number or link in it. Look up the contact details from your own records or the agency's website, and use a script like this.

• "I received a notice about [toll, ticket, citation] number [the number printed on it]. Can you tell me whether you have a record under that number for my license plate?"
• "Does your agency ever contact customers by text? If so, what domain would a legitimate link use?"
• "If I owe a balance, can I pay through my account or by mailed check instead of the link?"
• "How do I dispute a charge if the vehicle was not mine, or if the plate was misread?"
• "Can you tell me whether this notice was sent by you, and where I can report it if it was not?"

Real agencies answer those questions without hesitation. If the person on the line deflects, pressures you to pay on the call, or asks for a gift card or payment app, you are talking to a scammer who found a way into your callback.

Common questions

I clicked the link but did not enter anything. Am I in trouble?

Probably not, but treat it with caution. Close the page, run a security scan, and make sure your phone and browser are up to date. Watch your accounts for unfamiliar activity over the next several weeks. The bigger risk comes from entering a card number, a password or an identity detail.

Can a real toll agency add my unpaid tolls to my registration or insurance?

Some states have processes that link unpaid tolls to registration renewals or collections, and the rules vary by state and agency. Insurers do not collect tolls, and a toll balance is not an insurance matter. Check your state's toll agency or DMV for its actual process. A text that threatens a suspended registration within hours is a sign of a scam, not of that process.

Does reporting actually do anything?

A single report rarely produces a response for you personally, but reports are how agencies see volume and patterns. The FBI's April 2024 announcement was triggered by complaints it was receiving, and the FTC says reports help it build cases and spot trends. A report also gives your bank something to point to if it later asks about a dispute.

Will my car insurance rates go up because of a scam?

A phishing text does not appear on your driving record or claims history, so it has no direct effect on rates. Indirect effects are possible if someone uses your identity to buy a policy or file a claim; that is why checking your records after a data exposure is worthwhile.

Is there a way to stop these texts?

Not entirely. Reporting the text to 7726 and using your phone's junk-reporting and spam-filter settings is the step the FTC recommends. The FBI notes that the sending numbers change between states, so expect some to slip through. The reliable defense is the habit of never paying through a link you did not ask for.

Key takeaways

• A text demanding payment for an unpaid toll or ticket is a phishing attempt. Agencies publish that they will not demand payment by text, and the FBI and FTC both have warnings on file.
• Check any claimed balance by going to the agency's own website or phone number, never through the message.
• If you gave card details, call the issuer immediately, replace the card, remove it from digital wallets and report the scam to the FBI and FTC.
• Stolen identity details can lead to insurance account takeover or a policy bought in your name, so protect your insurer login and review your records.
• Reports to ic3.gov, ReportFraud.ftc.gov and 7726 are how agencies see the scale of these campaigns.