That 'Unpaid Toll' Text Is a Scam: The Smishing Wave Hitting US and UK Phones
Fake 'unpaid toll' texts from the China-based Smishing Triad are flooding US and UK phones, with text-scam losses at 470 million dollars. How to spot them.
You get a text saying you owe a small unpaid toll, with a threat that your licence will be suspended and a link to pay right now. Millions of people are getting the same message. Almost none of them actually owe a toll. It is one of the largest text-message scams ever run, and it is sweeping the United States and United Kingdom.
Who is behind it
Researchers have traced much of the activity to a China-based cybercriminal group known as the Smishing Triad, which sends deceptive SMS and iMessage texts to defraud people in the US and UK, with signs the activity is spreading further. The messages impersonate real tolling agencies such as FasTrak, E-ZPass and I-Pass, often using spoofed sender IDs so they look authentic. Tap the link and you land on a convincing fake website built to harvest your personal and card details.
How big it is
The numbers are enormous. The US Federal Trade Commission says consumers reported losing 470 million dollars to text-message scams in 2024, five times the figure from 2020. The FBI's Internet Crime Complaint Center logged 59,271 complaints about toll scams in 2024 alone. Security researchers at Unit 42 found more than 10,000 registered domains impersonating toll and package-delivery services, most of them hosted on networks owned by Chinese firms.
The tell-tale signs
- A small "past due" amount, often under 25 dollars, that feels too trivial to question.
- A threat of immediate consequences: a suspended licence, cancelled registration, or extra penalties.
- Pressure to act now, paired with a link to a payment page.
What to do
- Do not tap the link. Toll agencies do not collect payments through links texted out of the blue.
- Check directly. If you are unsure, log in to your real toll account or call the agency's official customer-service number to see if you actually owe anything.
- Report and delete. In the US, forward the text to 7726 (SPAM) and report it at IdentityTheft.gov. Then delete it.
- Never enter card details on a page you reached from a text message.
The scam works because the amount is small and the threat is loud, a combination designed to make you pay before you think. A few seconds of doubt is all it takes to beat it.