Is this unpaid toll text a scam?

Essentially always. The FTC identified these messages as a major driver of the 40% rise in government impersonation reports in 2025. Toll authorities send notices by post to the vehicle's registered address; they do not text a payment link and do not threaten registration suspension over a few dollars.

Why do delivery text scams work so well?

Because almost everyone is expecting a parcel, so the message is plausible without knowing anything about you. The fee is tiny, which means you clear it as an annoyance rather than assessing it as a transaction — and the object was never the fee, it was the card details you entered to pay it.

What happens if I clicked the link but did not pay?

Very likely nothing. Loading a page does not hand anything over. Close it, and do not enter details if you return. If you did enter card details, call your bank on the number on the card. If you entered a password you use elsewhere, change it there and everywhere you reused it.

How do I check whether the link is genuine?

Press and hold the link rather than tapping, and read the preview. The real domain is the part immediately before the first single slash — in ezpass.toll-pay.co/pay the domain is toll-pay.co, and "ezpass" is a subdomain the attacker chose. Better still, do not use the link at all.

How do I report a scam text?

Forward it to 7726 in both the UK and the US — the number spells SPAM and the service is free. Also use your phone's Report Junk option, and report at ReportFraud.ftc.gov or to Action Fraud in the UK. Then delete it so you do not tap it later by accident.

Online Scams

Got an unpaid toll text? How to tell if it's real

A text demanding a few dollars for an unpaid toll, with a threat of late fees attached, is one of the highest-volume scams in circulation. Here is how to tell it's fake in seconds, and what to do if you already tapped the link.

Subash PoudelSeptember 9, 20264 min read

The short answer

The tell: a real toll authority sends notices by post to the vehicle's registered address. It does not text a payment link or threaten registration suspension over a few dollars.
Fake unpaid-toll texts drove a 40% rise in reports of government impersonation scams to the FTC in 2025.
The messages spoof real programmes including E-ZPass, SunPass, FasTrak and TxTag to borrow their credibility.
The amount demanded is tiny on purpose - a small charge is cleared rather than evaluated, and the real target is your card details.
No toll authority or delivery company collects payment through a link in an unexpected text - go to the official app or site instead.

E-ZPass: You have an unpaid toll of $6.35. Late fees of $75.00 will be added and your vehicle registration may be suspended. Pay now: ezpass-tollservices.us

A real toll authority writes to the vehicle's registered address by post; it does not text you a payment link, and it does not threaten registration suspension over a few dollars. Any text that does both is fake — do not tap the link. Press and hold it instead to preview the real domain if you want to check, then delete the message. The same applies to delivery-fee texts: a genuine carrier collects a charge through its own app or website, never through a link in an unexpected text.

This is currently one of the highest-volume scams in circulation, and the FTC identified it specifically: reports of government impersonation scams rose 40% in 2025, "thanks in part to messages about overdue tolls".

The messages spoof real programmes — E-ZPass, SunPass, FasTrak, TxTag — to borrow credibility they have not earned.

Why such a small amount

$6.35 is not a mistake. It is the most carefully chosen element in the message.

A demand for $600 gets scrutinised. A demand for $6.35 gets cleared. You are not evaluating a transaction; you are removing a small irritation from your day, and the effort of verifying feels disproportionate to the sum.

The disproportionate threat does the rest. $75 in late fees and a possible registration suspension convert a trivial charge into something with consequences, which is enough to prompt action without prompting thought.

Why it is plausible

Toll systems are genuinely confusing. Many are automatic number-plate systems with no barrier and no receipt. If you drive anywhere with tolls, you cannot be certain you have not missed one — and the scam only needs that uncertainty.

The delivery variant works the same way. Almost everyone is expecting a parcel, so the message needs to know nothing about you to be credible.

The delivery version

Royal Mail: Your parcel is on hold. The address is incomplete. Please confirm your details and pay the £1.99 shipping fee to reschedule delivery.

Identical structure, smaller amount, same objective. The rule that resolves it: no delivery company collects a fee through a link in an unexpected text. If a genuine customs charge exists, it is collected through the carrier's own app or website, which you can open yourself.

What real agencies do

Toll authorities write to the registered keeper. The vehicle is registered to an address; notices go there. There is a letter, a reference number, and time to respond.

Real penalties are proportionate and appealable. Registration is not suspended over a few dollars without a lengthy documented process.

Real charges are payable through the official site or app, which you can open without any link.

Real agencies do not create thirty-minute deadlines.

Toll texts are the compressed version of a much larger category. Government impersonation scams covers the phone-call versions — the safe account, the courier, the suspended number — and how to read a .gov address properly.

Checking a link on a phone

Press and hold instead of tapping. A preview shows the real destination.

Read the part immediately before the first single slash:

https://ezpass.toll-payments-secure.co/pay
               ^^^^^^^^^^^^^^^^^^^^^^^^^^
               the actual domain

ezpass here is a subdomain, chosen freely by whoever registered toll-payments-secure.co. It means nothing at all.

Genuine US toll agencies use .gov or their own long-established domains. Genuine UK services use gov.uk. A .us, .co, .info or .top domain imitating an agency is fraudulent.

Do not reply

Not even "STOP". That obligation applies to legitimate marketing; a scammer is not bound by it, and any reply confirms your number is live, monitored, and belongs to someone who engages — a signal that gets sold.

Reporting

Forward to 7726 (spells SPAM, free in both the UK and the US)
Use your phone's Report Junk option
ReportFraud.ftc.gov in the US; Action Fraud in the UK
Then delete it, so you do not tap it absent-mindedly later

If you already paid

Call your bank on the number on your card, now. Card payments have real protections and issuers deal with this pattern constantly.

Block the card and ask for a replacement.

Watch for small test transactions, which frequently precede larger ones.

Expect a follow-up call. Someone will ring claiming to be your bank's fraud team, already knowing your card details and the transaction — because they collected both. That knowledge is not proof of anything. Hang up and call the number on your card.

Sort real texts from fake ones

Our drill puts genuine and fraudulent toll, delivery and bank messages in one inbox and asks you to clear it.

Try it free

Frequently asked questions

Is this unpaid toll text a scam?: Essentially always. The FTC identified these messages as a major driver of the 40% rise in government impersonation reports in 2025. Toll authorities send notices by post to the vehicle's registered address; they do not text a payment link and do not threaten registration suspension over a few dollars.
Why do delivery text scams work so well?: Because almost everyone is expecting a parcel, so the message is plausible without knowing anything about you. The fee is tiny, which means you clear it as an annoyance rather than assessing it as a transaction — and the object was never the fee, it was the card details you entered to pay it.
What happens if I clicked the link but did not pay?: Very likely nothing. Loading a page does not hand anything over. Close it, and do not enter details if you return. If you did enter card details, call your bank on the number on the card. If you entered a password you use elsewhere, change it there and everywhere you reused it.
How do I check whether the link is genuine?: Press and hold the link rather than tapping, and read the preview. The real domain is the part immediately before the first single slash — in ezpass.toll-pay.co/pay the domain is toll-pay.co, and "ezpass" is a subdomain the attacker chose. Better still, do not use the link at all.
How do I report a scam text?: Forward it to 7726 in both the UK and the US — the number spells SPAM and the service is free. Also use your phone's Report Junk option, and report at ReportFraud.ftc.gov or to Action Fraud in the UK. Then delete it so you do not tap it later by accident.

Sources

New trends in reports of imposter scams — Federal Trade Commission, 2026
FTC Data Show People Reported Losing $3.5 Billion to Imposter Scams in 2025 — Federal Trade Commission, 2026

About the author

Subash Poudel

Cybersecurity & Digital Literacy

Subash Poudel builds SafeSurf IQ, a digital literacy platform that teaches people to recognise scams by putting them in front of real ones. He writes the online-safety reference material here, working from primary reporting — FBI IC3, the FTC, Verizon's DBIR, NCSC and Ofcom — rather than secondhand summaries.

Founder and engineer, SafeSurf IQ
Writes and reviews the platform's phishing, scam and privacy curriculum
Works from primary incident and fraud reporting, cited on every article

Last reviewed September 9, 2026. Figures are checked against the primary sources listed above at each review.