The Scale of the Problem Is Hard to Ignore
The numbers here are not small. The FBI’s Internet Crime Complaint Center received 59,271 complaints related to toll scams in 2024 alone. That’s a federal agency counting just the people who bothered to formally report the fraud.
In 2024, people reported $470 million in losses to text scams, more than five times the 2020 number, and since the vast majority of frauds are never reported, this number likely reflects only a fraction of the actual harm. The toll text variant was specifically identified as one of the top categories feeding that total.
Who Is Actually Sending These Texts?
A wave of fake toll road texts hitting the U.S. has been linked to Chinese hackers, according to cybersecurity experts. The operation is not a scattered group of individual scammers. It is an organized cybercrime network with infrastructure, staffing, and product lines.
Cisco Talos noted that multiple threat actors are operating the toll road smishing campaigns by likely making use of a phishing kit developed by Wang Duo Yu, and that it has observed similar smishing kits being used by another Chinese organized cybercrime group known as the Smishing Triad. The Smishing Triad has been active since at least 2023 and has dramatically scaled up since then.
What the Smishing Triad Actually Is
Researchers discovered a smishing campaign attributed to the Smishing Triad that has been circulating since April 2024. A China-based threat actor has been impersonating a variety of international services within critical infrastructure, including banking, cryptocurrency, e-commerce, healthcare, law enforcement, and social media.
Between January 1, 2024, and June 2025, Unit42 researchers identified 136,933 root domains registered by the Smishing Triad, or 194,345 if you count each fully qualified domain name. That is an almost incomprehensible volume of fake infrastructure built specifically to deceive ordinary people.
These campaigns have targeted at least 121 countries with up to 100,000 texts daily. The United States, however, has been its primary focus since 2024.
How the Scam Text Is Designed to Fool You
The texts claim the recipient owes money for unpaid tolls and contain almost identical language, such as: “We’ve noticed an outstanding toll amount of $12.51 on your record. To avoid a late fee of $50.00, visit [link] to settle your balance.” The dollar amounts are small and specific by design. Small enough to feel plausible, specific enough to seem real.
Scammers purport to be with tollway services like Illinois’ I-Pass, Florida’s SunPass, Virginia’s E-ZPass and Massachusetts’ EZDriveMA. The text mimics official communication from these toll agencies, sometimes including a link that looks like it is from the state’s toll service.
While Apple iMessage automatically disables links in messages received from unknown senders, the smishing texts urge recipients to respond with “Y” in order to activate the link, a tactic observed in multiple phishing kits. It’s a clever workaround that millions of users simply don’t know about.
What Happens When You Click
Should the victim click on the link and visit the domain, they are prompted to solve a fake image-based CAPTCHA challenge, after which they are redirected to a fake E-ZPass page where they are asked to enter their name and ZIP code to access the bill. Targets are then asked to proceed further to make a payment, at which point all the entered personal and financial information is siphoned to the threat actors.
Clicking the link can lead to a phishing attack where the scammer tries to take your personal information, like your driver’s license number, and even steal your identity. Once you fill out the form at the link, scammers can harvest your information, including your payment card number, bank account information, and personal data, which can be used for identity theft, fraudulent charges, or sold through criminal networks.
The Business Model Behind the Fraud
Platforms like Lucid and Darcula provide phishing kits that include web hosting, SMS delivery systems, and fake landing pages, enabling even low-skilled criminals to launch large-scale campaigns. Sending 1,000 smishing messages to consumers costs approximately $8.00. The math on that return is staggering.
According to Google’s November 2025 lawsuit against the operation, the toll scam alone generated an estimated $1 billion over three years. Smishing toolkits are advertised and distributed in encrypted Telegram groups, enabling low-skill actors to launch SMS phishing campaigns. This has effectively democratized large-scale financial fraud.
Why Text Messages Are So Effective for Scammers
Click-through rates for SMS phishing range from 19% to 36%, compared to just 2% to 4% for email. That nine-to-one effectiveness gap has made text messages the fastest-growing attack vector in social engineering, with smishing volume up 328% since 2020.
Text message open rates are estimated to be as high as 98%, and response rates as high as 45%, as compared to email open and response rates of 20% and 6% respectively. More than half of consumers text daily, making texting more common than any other communication method, including voice or email. Scammers know exactly where your attention already is.
How Toll Agencies Are Responding
Tollway companies across the United States are raising awareness about the resurgence of this text message phishing scam. Most agencies have published public alerts clarifying that they do not initiate payment requests over unsolicited text messages.
Legitimate toll agencies don’t send unsolicited payment links by text. The FCC is explicit about this: if a text demands immediate payment through an embedded link, that alone is enough to treat it as a scam, regardless of how official it looks. Some state agencies have gone further, pushing video explainers and direct consumer alerts through local media.
The Scam Is Getting More Sophisticated, Not Less
The Smishing Triad hit its peak in 2025, thanks to a variety of new phishing-as-a-service kits that use preloaded brand impersonation templates and even some embedded artificial intelligence features to make creating and distributing new malicious SMS campaigns easier.
Since December 2025, Bitdefender Labs researchers have been tracking smishing campaigns targeting drivers on a global scale. The FCC has received complaints about messages impersonating toll services such as E-ZPass, FasTrak, and I-PASS, while the FBI recorded 59,271 toll scam complaints in 2024 alone. The campaigns were still active as of early 2026.
To keep one step ahead of anyone trying to take them down, the Smishing Triad preemptively recycles its own infrastructure, usually within days of setting it up. That makes takedowns a constant game of catch-up for law enforcement.
What You Should Do If You Get One of These Texts
Don’t click the link. Go directly to your state’s toll agency to check your balance. Find the official phone number or website through an independent search, not through anything in the text. That single step stops the attack cold.
The FTC advises consumers to forward suspicious texts to 7726 (SPAM), report them through Apple or Google messaging apps, and file reports through the FTC’s Fraud Report site at ReportFraud.ftc.gov. If you’ve already clicked and entered information, contact your bank or card issuer immediately to report potential fraud and request a new card, and place a fraud alert with all three credit bureaus – Equifax, Experian, and TransUnion – to block new accounts from being opened in your name.
The Bigger Picture Worth Knowing
Fake toll texts aren’t a new scheme, but they are accelerating. The FTC has identified them as a primary driver behind a 40% rise in government imposter fraud reports, part of a broader imposter scam problem that cost Americans $3.5 billion in 2025. The toll text is one piece of a much larger pattern of government impersonation fraud.
Until recently, the Smishing Triad mainly impersonated toll road operators and shipping companies. Experts say these groups are now directly targeting customers of international financial institutions, while dramatically expanding their cybercrime infrastructure and support staff. The toll text was, in retrospect, a gateway product.
The broader lesson is simple but easy to forget in the moment: urgency in a text message is almost always manufactured. A real toll agency mails notices. It doesn’t send a link and a countdown clock to your phone. Pausing for ten seconds before clicking anything is, at this point, one of the more valuable habits a phone user can have.
AI Disclaimer: This article was created with the assistance of AI tools and reviewed by a human editor.