Toll Text Scam and USPS Text Scams: How Smishing Works and How to Stop It

A text saying you owe an unpaid toll or that USPS can’t deliver your package is almost always a scam. Toll agencies and the Postal Service don’t send surprise texts with payment links, and the FTC and FBI have both warned that these messages lead to fake sites built to steal your card details. The toll text scam is a form of smishing (SMS phishing): don’t click, don’t reply, report it to 7726, and check any real balance by typing your toll agency’s website address yourself.

Below you’ll find how these messages are built, why they’re so convincing, how to block and report them on iPhone and Android, and a step-by-step plan if you already clicked the link or entered your card.

What the toll text scam looks like

The wording changes every few weeks, but the structure stays the same. A typical message reads something like this (example with the link removed):

“[State toll service]: Your vehicle has an outstanding toll balance of $6.99. To avoid a late fee of $50 and suspension of your registration, pay by [date]: [link]”

The USPS version swaps the toll for a parcel:

“USPS: Your package could not be delivered due to an incomplete address. Please update your details within 24 hours: [link]”

Common traits:

• A small amount. $3–$12 feels too minor to question, which is the point. The real goal is your full card number, expiry and security code.
• A deadline and a threat. Late fees, fines, license or registration suspension, or the package being “returned to sender”.
• A strange sender. An international phone number, a random email address (iMessage can deliver texts from email addresses), or a number that doesn’t match any toll agency.
• A look-alike link. Domains that include words like “toll”, “ezpass”, “usps” or a state name plus extra letters or hyphens, often on unusual domain endings rather than the agency’s real address. Many sites show a fake CAPTCHA first to look legitimate.
• Wrong state. You get a toll demand for a state you’ve never driven in. Scammers text millions of numbers at once without knowing where you live.

How smishing works behind the scenes

These texts aren’t the work of one scammer. Security researchers have traced most US toll and USPS smishing to Chinese-speaking phishing-as-a-service groups, usually called the Smishing Triad, that sell ready-made phishing kits to criminals worldwide.

Phishing kits and disposable domains

According to Cisco Talos and Silent Push research summarized by The Hacker News in April 2025, a kit called Lighthouse offered hundreds of templates impersonating toll agencies, postal services and banks, sold for tens of dollars. Palo Alto Networks’ Unit 42 reported in October 2025 that it had linked more than 194,000 malicious domains to the operation since 1 January 2024. Toll services were the largest category with nearly 90,000 phishing domains, and USPS was the single most impersonated brand with 28,045 domains. About 29% of the domains were active for two days or less, so blocklists struggle to keep up.

On 12 November 2025 Google sued 25 unnamed people it says run Lighthouse, filing in the Southern District of New York. Google alleged the platform had harmed more than a million victims in 120 countries, as reported by KrebsOnSecurity.

The mobile-wallet trick

The stolen card isn’t just sold. Researchers and Google’s lawsuit describe kits that immediately try to add your card to an Apple Pay or Google Wallet on the scammer’s phone. The fake site then asks you for the “verification code” your bank texts you — and that code is what approves the wallet. Once your card is in their wallet, they can spend with it in stores and online until you cancel it.

The “reply Y to enable links” trick

iMessage disables links in messages from unknown senders who aren’t in your contacts. Scammers work around this by adding a line such as “Please reply Y, then exit and reopen the message to activate the link.” In January 2025 BleepingComputer reported that replying makes the link clickable, and it also tells the scammer your number is active and that you follow instructions. Never reply to unlock a link.

Is the toll text real? How to check safely

Assume it isn’t, and verify through a channel you control.

1. Don’t use the link or number in the text. Type your toll agency’s address into your browser yourself, or use its official app, and sign in to your account.
2. Check the agency’s own warnings. Most toll agencies, including E-ZPass member agencies, post scam alerts on their home pages confirming what they do and don’t send.
3. Call the number on your statement or transponder account, not one from the text.
4. For USPS, track packages at usps.com by typing the tracking number from your order. The US Postal Inspection Service says USPS won’t text or email you without you first requesting it with a tracking number — and those messages won’t contain a link.

The E-ZPass text scam deserves a special mention because E-ZPass covers many states. A real E-ZPass balance problem shows up in your online account or as a mailed toll bill, not as a random text with a link.

What the FBI, FTC and CISA say

The warnings go back more than two years, and they all say the same thing.

How to report spam texts (7726 and beyond)

Reporting takes less than a minute and helps carriers and law enforcement block the next wave.

• Forward to 7726 (SPAM). All major US carriers accept this. Your carrier will usually reply asking for the sender’s number. On iPhone, press and hold the message, tap More, then the forward arrow. On Android, long-press the message and choose Forward or Share.
• Use your app’s report button. In Apple Messages, tap “Report Junk” under a message from an unknown sender. In Google Messages, long-press the conversation, tap Block, and keep “Report spam” checked.
• File with the FTC at reportfraud.ftc.gov — especially if you lost money.
• File with the FBI at ic3.gov, including the sender’s number and the website address (write it out as text, don’t visit it).
• USPS-themed texts can also go to spam@uspis.gov with a screenshot showing the sender and time.

Readers outside the US should use their own national reporting channel. In the UK, for example, the forwarding number is also 7726.

What happens if you reply STOP?

To a legitimate business you signed up with, replying STOP unsubscribes you. To a scammer, any reply — STOP, Y, or an angry message — confirms that a real person reads texts on that number, which can lead to more messages. With iMessage, replying can also make the links in that thread clickable. Don’t reply to unknown senders at all; report and delete instead.

Block spam texts on iPhone

Apple has steadily improved spam filtering in Messages.

1. Screen Unknown Senders (iOS 26 and later). In Messages, tap Filters › Manage Filtering and turn on Screen Unknown Senders, or go to Settings › Apps › Messages › Unknown Senders. Messages from numbers that aren’t in your contacts go to a separate Unknown Senders list, and you choose which kinds of notifications still come through (such as time-sensitive codes or transactions). Apple notes that replying to an unknown sender does not mark them as known — use “Mark as Known” instead.
2. Older iOS versions: turn on Filter Unknown Senders in Settings › Messages.
3. Text Message Filter. Under Manage Filtering you can also enable an SMS filtering extension from a trusted app, such as one provided by your carrier.
4. Block the sender. Open the conversation, tap the sender at the top, and choose Block Caller. Expect limited results — scammers rotate numbers constantly.

Filter unknown senders on Android

Google Messages, the default texting app on Pixel and many other Android phones, has spam protection on by default.

1. Open Google Messages, tap your profile picture › Messages settings › Protection & Safety › Spam protection, and make sure Enable spam protection is on.
2. Google Messages uses on-device AI to spot package delivery and job scams and move them to the Spam & blocked folder, or show a warning. Google announced this scam detection in October 2024.
3. Long-press a suspicious conversation and choose Block › Report spam.
4. If you use Samsung Messages or another texting app, look in its settings for block and spam options, or switch to Google Messages.
5. If you are at high risk, Android Advanced Protection keeps scam detection and link warnings permanently on.

What to do if you clicked a scam link

Clicking alone usually isn’t a disaster — what matters is what you did on the page. Work through the steps that apply to you.

You only opened the link

• Close the page. Don’t enter anything and don’t install anything it offers.
• Update your phone’s operating system and browser so known browser flaws are patched.
• Report and delete the message, then watch for follow-up texts or calls pretending to be your bank.

You entered card details or paid

1. Call your card issuer immediately using the number on the back of your card. Say your card was entered on a phishing site, ask them to cancel it and issue a new number, and dispute any charges.
2. Check for new digital wallets. Ask the bank whether your card was added to Apple Pay, Google Pay or Samsung Wallet on a device you don’t own and have that token removed — canceling the plastic card may not be enough with every bank.
3. Review statements for small test charges over the next few weeks.
4. Report it to reportfraud.ftc.gov and ic3.gov. Keep screenshots of the text and any receipts.

You entered personal details or a password

• If you shared your Social Security number or driver’s license, go to IdentityTheft.gov for a recovery plan and consider a free credit freeze with Equifax, Experian and TransUnion.
• If you typed a password, change it wherever you use it, and turn on two-factor authentication. Our guide to securing your Apple ID and Google account walks through it.
• Ask your carrier for a port-out PIN or SIM lock. Scammers who have your name, address and phone number sometimes try a SIM swap next to steal your text-message codes.

Other scam texts that use the same playbook

The same kits pump out fake bank fraud alerts, “wrong number” chats that turn into investment pitches, job offers that pay you to “like” videos, and buyer or seller messages on marketplaces. If you’re selling a phone, watch out for texts asking you to “confirm” a payment through a link or to send a verification code — see our guide to used phone scams. When buying, never pay a stranger before checking the device; a GSMA blacklist check and an All-in-one Basic Info report take seconds and don’t require a link from the seller.

The bottom line

Toll agencies, USPS and other legitimate services don’t text you out of the blue with a payment link. Treat every unpaid toll or package delivery scam text as fake until you’ve checked your account through the official website. Don’t click, don’t reply — not even STOP — forward it to 7726, report it to the FTC or FBI, and switch on your phone’s unknown-sender filter. If you already paid, call your bank today.