"Unpaid Toll" and Fake USPS Texts: How to Check a Suspicious Message (2026)
How to recognize and independently verify suspicious toll and USPS texts, report smishing, and respond safely if you entered information.
An unexpected text says you owe a small toll balance. Another says a package cannot be delivered until you update your address or pay a fee. The message may use a real toll-agency or delivery-service name, a realistic logo, and a link that looks plausible.
The Federal Trade Commission (FTC) warns about unpaid-toll texts, and the FTC and U.S. Postal Inspection Service warn about fake USPS delivery texts. These campaigns try to move you from an unexpected message to a look-alike website that requests payment or personal information. Treat an unsolicited payment link as untrusted until you verify the issue through a website, app, or phone number you found independently.
Key takeaways
- An unexpected toll or delivery text can be a smishing message, even when you recently drove on a toll road or ordered a package.
- USPS says its text-tracking service requires a customer to request tracking for a specific package with a tracking number, and its warning says the resulting message will not contain a link.
- Toll agencies and delivery services may have different notification practices. Do not rely on a universal rule; verify through the official channel you locate yourself.
- Do not click, reply, or enter card, bank, password, Social Security, driver-license, or address information into a link from an unexpected text.
- Report unwanted texts through your messaging app or by forwarding them to 7726 (SPAM), then report fraud to the appropriate official channel.
What smishing messages are trying to do
"Smishing" is phishing delivered by text message. The message uses a familiar brand and a time-sensitive story to make a recipient act before checking the source. A toll message may show a small claimed balance and warn about a late fee or other consequence. A delivery message may claim that an address is incomplete, postage is due, or a package will be returned.
The link may lead to a page that imitates a legitimate service. The page can ask for a name, address, payment-card details, a password, or other identifying information. The FTC says that a fake toll page may seek bank or card information, while the Postal Inspection Service warns that fake USPS texts may seek personal or financial information.
Tired of dealing with data exposure?
Choose relevant provider workflows, review the generated drafts in your browser, and send or submit each request yourself. Matching, eligibility, and provider requirements still need checking.
The message does not have to be tailored to you. A sender can send a large campaign and rely on the fact that some recipients recently used a toll road or are waiting for a delivery. A coincidence between the message and a real trip or order is not proof that the text is genuine.
Warning signs
Look for several signals together rather than treating one feature as conclusive:
| Warning sign | Example from this guide |
|---|---|
| Unexpected payment or account problem | You did not request a tracking alert, open the toll agency's app, or expect a notice through text |
| Link demanding immediate action | The FTC recommends not clicking links in unexpected texts |
| Urgency or threat | The text says you must pay now, avoid a penalty, or prevent a delivery problem within a short period |
| More information than the situation requires | A small claimed balance should not require a full identity profile, a password, or a driver-license number through an unfamiliar page |
| Sender or website difficult to verify | Caller-ID labels, logos, shortened links, and familiar words in a domain name can be copied or spoofed |
| Mismatch with your real account | The message mentions a package, vehicle, state, or agency that does not match your records |
Do not assume that every text from a short code is genuine, or that every text from a long number is automatically fake. Sender identifiers can be spoofed and notification practices differ. Use independent verification instead.
How to check a toll message safely
If you might actually owe a toll:
- Do not use the message's link or phone number.
- Type the toll agency's known website into your browser, use an official app you already installed, or find the agency through a trusted government or transportation website.
- Use the agency's published customer-service number or account lookup. Ask whether the alleged balance is associated with your vehicle or account.
- If the agency confirms a balance, pay through the verified portal or another method it describes—not through the text.
The FTC's toll-scam guidance specifically recommends contacting the state tolling agency through a phone number or website known to be real. A recent trip does not make the text trustworthy, and no text-based threat should replace checking the agency's records.
How USPS text tracking works
The Postal Inspection Service says USPS text tracking is tied to a specific package and requires the customer to register online or initiate a text request with a tracking number. USPS describes the tracking service as customer-requested, while its current FAQ notes that standard message and data rates may apply. The Postal Inspection Service's smishing warning says that a USPS tracking message will not contain a link.
If you are expecting a package, open the retailer's order page or type `usps.com` into the browser yourself. Enter the tracking number on the official USPS site. Do not use a link in an unexpected message to update an address, pay a redelivery fee, or confirm card details.
The FTC's USPS scam guidance also recommends checking delivery information through the retailer or account where you placed the order. That keeps the verification step separate from the suspicious text.
What to do when you receive one
Use this short sequence:
- Stop. Do not click the link, reply, call the number, or follow instructions in the message.
- Capture evidence if useful. Keep a screenshot or note the sender and link without opening it. Avoid forwarding the message to people who may click it.
- Report it. Use your phone's report-junk feature, or forward the message to 7726 (SPAM). The FTC recommends this route so your mobile provider can review the unwanted text.
- Report impersonation. Use ReportFraud.ftc.gov. For a USPS impersonation, follow the current reporting instructions from the U.S. Postal Inspection Service.
- Delete and block. Blocking one sender will not stop every campaign, but it can reduce repeat messages from that identifier.
Reporting does not guarantee that a carrier will block every related number or that a campaign will stop immediately. It gives the provider and enforcement agencies information about the message and its infrastructure.
If you clicked or entered information
Act based on what you disclosed:
- If you entered card or bank details, contact the issuer using a number from a statement or the back of the card. Ask about unauthorized transactions, replacement credentials, and dispute procedures.
- If you entered a password, change it through the real service—not through the message—and change it anywhere else you reused it. Turn on multifactor authentication where available.
- If you entered a Social Security number, driver-license number, or a broad identity profile, review the FTC's identity-theft response guidance and consider the appropriate fraud alert or credit-freeze steps.
- If you downloaded an app or file, disconnect it from sensitive accounts and use your device's current security guidance. Do not call a recovery number supplied by the sender.
- Save the message, URLs, receipts, and account alerts. They may help the card issuer, carrier, FTC, USPS Inspection Service, or law enforcement understand what happened.
Do not pay a second person who promises to recover the money for an upfront fee. Recovery scams often target people who have already reported a loss.
Does removing your phone number from data brokers stop smishing?
You may choose to review public people-search and data-broker listings that expose your phone number. Removing a listing can reduce one publicly available source, but it does not make a number invisible, prove that a particular broker supplied it, or guarantee fewer scam texts. Breach data, account relationships, marketing lists, number recycling, and other sources may remain.
If you use OfflistMe, it creates browser-local, user-reviewed drafts for supported provider workflows. You submit each request to the provider yourself, and coverage varies. Treat broker review as one privacy measure alongside carrier reporting, account security, and independent verification.
Frequently asked questions
Does USPS ever send text messages?
Yes, USPS describes a text-tracking service that a customer initiates for a specific package with a tracking number. The Postal Inspection Service says the resulting USPS tracking message will not contain a link. An unsolicited USPS text with a link should be treated as suspicious.
Is every unpaid-toll text fake?
The FTC says the unpaid-toll texts it describes are phishing scams, but notification practices differ among toll agencies. Do not decide from the text alone. Check the agency's real website or customer-service channel independently.
Does forwarding a text to 7726 guarantee that it will stop?
No. Forwarding reports the message to your mobile provider for review. It may help identify or filter unwanted texts, but it is not a guarantee that every number or future campaign will be blocked.
Should I reply “STOP” to an unexpected scam text?
Do not reply to an unexpected message simply to test it. Use your phone's report-junk feature or the 7726 reporting route, then delete it. A legitimate subscription you knowingly joined may have different instructions, but an unsolicited toll or delivery demand should be verified first.
Sources and review note
This guide was checked against the FTC unpaid-toll alert, the FTC USPS-text alert, the USPS Text Tracking FAQ, the U.S. Postal Inspection Service smishing warning, and the FTC spam-text reporting guidance. These sources support the customer-requested USPS tracking distinction, the warning about unexpected links, independent verification, and 7726 reporting; they do not prove that every toll or delivery text is fraudulent or that reporting blocks every future message.
Fact-check review: August 26, 2026. Carrier, toll-agency, device, and account-recovery procedures can change; use the current official channel for the relevant service.
Related guides
Understand your privacy rights
Where a privacy right is relevant, these plain-English explainers show what each law covers and what to verify before making a request.
Take back your privacy today
Review provider-specific routes, prepare your requests locally, and send or submit each one yourself.
Review Provider RoutesFree to review provider routes · Optional one-time unlock from $9.00 · No subscription