"Unpaid Toll" and Fake USPS Texts: The Scam Flooding Your Phone (2026)

Your phone buzzes with a text message: *"SunPass Driver Alert: You have an unpaid toll balance of $5.45. To avoid a $50 late fee and license suspension, pay immediately at: sunpass-tolls-pay-online.com."*

Or perhaps you receive this message: *"USPS Tracking Update: Your package has arrived at our warehouse but cannot be delivered due to an incomplete address. Update your details within 12 hours at: usps-post-redelivery.info/claim."*

These messages look official, urgent, and specific to your local area.

They are 100% fake.

Known in cybersecurity as Smishing (SMS Phishing), these automated text messaging campaigns have become the fastest-growing form of mobile fraud in North America and Europe. Criminal syndicates use automated SIM banks and text-spoofing platforms to send millions of messages per day, stealing credit card numbers and personal identity files from unsuspecting consumers.

This comprehensive 2026 guide breaks down how unpaid toll and fake package delivery scams operate, how scammers obtain your phone number, federal warnings from the FTC, FCC, and USPS, key indicators of smishing messages, and the exact steps to report and block SMS fraud.

Key Takeaways

• Unpaid toll and package delivery texts are top smishing vectors: Fake texts impersonating state toll authorities (E-ZPass, FasTrak, SunPass, I-PASS, TxTag) and delivery services (USPS, FedEx, UPS) dominate mobile spam logs.
• USPS never includes links in tracking text alerts: Official USPS text notifications only contain tracking numbers and status text—never clickable URLs.
• Toll agencies never send SMS collection notices with external links: State transportation departments communicate billing via physical mail or official account portals, not urgent text links.
• The FTC flagged toll smishing as the fastest-growing government imposter fraud: Millions of consumers receive spoofed toll texts designed to capture credit card details under threat of immediate license suspension.
• Forwarding spam to 7726 (SPAM) helps carriers block scam networks: Forwarding suspicious text messages to the shortcode 7726 alerts mobile carrier spam filters to block the originating sender across network towers.

How Unpaid Toll & Package Delivery Smishing Works

Smishing campaigns rely on high-volume automated text generators, domain spoofing, and malicious credit card harvesting pages.

┌─────────────────────────────────────────────────────────────────────────┐
│                     1. AUTOMATED SMS BROADCAST                          │
│   • Scammers send millions of texts via SIM Banks & VoIP SMS Gateways. │
│   • Messages target specific area codes to match state toll agencies.   │
└─────────────────────────────────────────────────────────────────────────┘
                                    │
                                    ▼ (Phishing Link Clicked)
┌─────────────────────────────────────────────────────────────────────────┐
│                     2. CLONED PHISHING LANDING PAGE                     │
│   • Looks identical to official E-ZPass, SunPass, or USPS portals.      │
│   • Asks for Name, Home Address, Date of Birth, & Credit Card.          │
└─────────────────────────────────────────────────────────────────────────┘
                                    │
                                    ▼ (Data Theft Execution)
┌─────────────────────────────────────────────────────────────────────────┐
│                     3. CREDIT CARD & IDENTITY HARVESTING                │
│   • $5.45 "Toll Fee" charged, PLUS recurring unauthorized charges.     │
│   • Identity details exported to Data Broker & Dark Web Markets.        │
└─────────────────────────────────────────────────────────────────────────┘

The 2 Main Smishing Campaign Blueprints

How Scammers Got Your Phone Number

Consumers often ask: *"How did the scammer know I drove on a toll road or ordered a package?"*

In 95% of cases, the scammer does not know. They are executing high-volume bulk blasts:

1. Sequential Area Code Blasts: Scammers buy phone number blocks matching specific state area codes (e.g., 305 area codes in Florida get SunPass texts; 212 area codes in New York get E-ZPass texts).
2. Data Broker & Breach Leaks: Phone numbers scraped from public people-search sites (Whitepages, Spokeo) or dark-web breach dumps feed automated SMS dialers.
3. Statistical Probability: In modern society, almost everyone orders packages online or drives on highways, creating a high probability that an unexpected text coincides with an actual pending order or trip.

5 Red Flags That Expose Fake Texts Instantly

┌─────────────────────────────────────────────────────────────────────────┐
│                    5 SMISHING RED FLAGS TO WATCH FOR                    │
├─────────────────────────────────────────────────────────────────────────┤
│ 1. Non-Government / Strange URLs (.info, .top, .site, misspelled domains│
│ 2. Urgency & Penalties ("Pay in 12 hours or license will be suspended") │
│ 3. International Country Codes (Sender numbers starting with +44, +63) │
│ 4. Generic Greetings ("Dear Valued Driver" instead of your legal name) │
│ 5. Shortcode Absence (Sent from 10-digit mobile numbers, not 5-digit)   │
└─────────────────────────────────────────────────────────────────────────┘

1. Suspicious Domain Names: Look closely at the link address. Official US government and state toll sites end in .gov or specific official domains (e.g., `sunpass.com`, `ezpassny.com`, `usps.com`). Fake links use cheap top-level domains like `.info`, `.top`, `.site`, or hyphenated misspellings (`usps-post-help.com`).
2. Threats of Immediate Administrative Penalties: State agencies cannot suspend your driver's license via an unverified text message. Due process requires official mailed notifications.
3. Messages Originating from 10-Digit Mobile Numbers or Foreign Country Codes: Official carrier notifications are sent via registered 5- or 6-digit SMS shortcodes (e.g., USPS uses `28777`). Texts originating from random 10-digit phone numbers or international codes (such as +44 or +63) are fraudulent.
4. Links in Package Tracking Texts: USPS policy explicitly states that official tracking notifications never contain embedded web links.
5. Requests for Credit Card Details for Minor Fees: If a site asks for your credit card number, expiration date, and CVV code to pay a $2.00 fee, it is harvesting card details for unauthorized recurring charges.

Step-by-Step Defense & Reporting Protocol (2026)

If you receive a suspicious text message, follow this protocol:

[ Step 1: Do NOT Click the Link or Reply ]
                         │
                         ▼
[ Step 2: Forward Text to 7726 (SPAM) ]
                         │
                         ▼
[ Step 3: Report to FTC (ReportFraud.ftc.gov) & FCC ]
                         │
                         ▼
[ Step 4: Delete & Block the Sender Number ]

Step 1: Forward the Message to 7726 (SPAM)

Every major mobile carrier (AT&T, T-Mobile, Verizon) supports the universal anti-spam shortcode 7726:

1. Long-press the suspicious text message on your phone.
2. Select Forward.
3. Type 7726 into the recipient box and press send.
4. Your carrier will reply asking for the sender's phone number. Reply with the phone number.
5. This alerts carrier network filters to block the sender across all mobile towers.

Step 2: File Federal Fraud Reports

• FTC Smishing Report: Submit details at ReportFraud.FTC.gov.
• FCC Consumer Complaint: File an informal complaint regarding illegal SMS telemarketing at consumercomplaints.fcc.gov.
• USPS Inspection Service (For USPS Scams): Email details or screenshots of fake package texts to spam@uspis.gov or visit uspis.gov/report.

Step 3: What to Do If You Clicked the Link or Paid

If you entered credit card or personal details on a phishing site:

1. Cancel the Credit Card Immediately: Call your bank's fraud line printed on the back of your card. Report the card compromised and request a replacement card with a new number.
2. Monitor Financial Accounts: Check your online banking statement for unauthorized micro-charges.
3. Freeze Your Credit Files: If you provided your Social Security Number or full identity details, freeze your credit at Equifax, Experian, TransUnion, and Innovis.

Frequently Asked Questions

Does USPS ever send text messages with links?

No. Official USPS text alerts never contain clickable web links. Official USPS tracking updates only contain status text and your 22-digit tracking number. Any text claiming to be from USPS that includes a URL is a scam.

How can I safely check if I actually owe a toll?

Never click the link in the text message. Open a web browser independently, search for your state's official toll agency (e.g., `ezpassny.com` or `sunpass.com`), log into your official account portal, or search your license plate number directly on the official .gov website.

Can state toll agencies suspend my license over a text message?

No. Driver's license suspensions require statutory due process. Toll agencies send written violation notices via physical postal mail to your registered vehicle address before taking administrative action.

Smishing Protection Checklist

• [ ] Remember: USPS and toll agencies never text clickable links.
• [ ] Never click links in unexpected text messages.
• [ ] Forward suspicious text messages to 7726 (SPAM).
• [ ] Report smishing attempts to ReportFraud.FTC.gov and spam@uspis.gov.
• [ ] Remove your phone number from data brokers to stop SMS spam lists.

Related Scam Watch & Consumer Protection Guides

• How to Remove Your Data from Data Brokers (Pillar Guide): Comprehensive step-by-step framework for deleting your personal data from commercial data brokers.
• AI Voice Clone Family Emergency Scam: How deepfake voice cloning is used in urgent phone scams.
• Fake Debt Collector Scams: Spotting illegal collection threats under FDCPA consumer protection laws.
• Gift Card Payment Scams: Why legitimate organizations never demand payment via gift cards.
• Remove Phone Number from Data Brokers: How to purge your cell phone number from spam call databases.
• Explore more consumer alerts in the Scam Watch Category Hub or use the OfflistMe Opt-Out Directory.

Related Guides

• What is a Data Broker? (Complete Guide): Comprehensive foundational guide on data broker networks and legal opt-out mechanisms.
• OfflistMe Data Removal Plans & Pricing: Learn how OfflistMe generates instant privacy opt-out requests across major data brokers.

How Smishing Infrastructure Works: The Technical Anatomy

Understanding the technical infrastructure behind smishing campaigns helps explain why they are so difficult to stop and why phone number removal from data brokers is a meaningful defense:

Stage 1: Target Acquisition

Smishing operators acquire phone number lists from:

• Data broker bulk purchases: Lists of phone numbers sorted by age, geography, credit tier, or vehicle ownership. A list of "U.S. drivers aged 35–65" is a prime target for toll scams because it matches the demographic most likely to have E-ZPass, SunPass, or FasTrak accounts.
• Data breach compilations: Phone numbers from large breach compilations (AT&T, National Public Data) are traded on dark web forums and used for smishing campaigns targeting breach victims.
• Phone-verified email lists: Marketers sell "phone-verified" email lists where the associated mobile number is confirmed active.

Stage 2: Message Infrastructure

Smishing campaigns use sophisticated technical infrastructure to evade carrier spam filters:

• SIM farm networks: Hundreds of physical SIM cards installed in rack-mounted devices send messages from unique local phone numbers, bypassing carrier sender reputation systems.
• Offshore VoIP gateways: Messages routed through overseas VoIP carriers (Hong Kong, Philippines) using leased numbers appear as local area code messages to U.S. recipients.
• URL rotation: Each SMS batch uses a unique shortened URL (via bit.ly alternatives) to prevent URL-based spam blacklisting.
• A/B message testing: Operators test multiple message variants to optimize click-through rates before scaling to millions of sends.

Stage 3: Credential Harvesting

The phishing landing page is designed to mimic the real state toll authority's website:

• Copied CSS, images, and payment forms from the legitimate site
• SSL certificate (HTTPS padlock) obtained via Let's Encrypt (free) to appear legitimate
• Real-time card validation against Stripe's API to confirm stolen card numbers are live
• Captured card data exfiltrated to the operator's command-and-control server in real time

State-by-State Toll Authority Scam Alert Tracker

The following U.S. toll authorities have issued official public scam advisories regarding fraudulent text messages impersonating their brands:

Key Rule: All real toll authorities will mail you a physical invoice to your registered vehicle address — they never demand immediate payment via text message links. Real USPS package notifications come via email confirmation with a tracking number you initiated, not unsolicited SMS.

How to Report Toll and USPS Smishing Attacks

If you receive a toll or USPS smishing text, report it to maximize disruption to the scam operation:

Step 1: Report to CISA (Cybersecurity & Infrastructure Security Agency)

Forward suspicious toll or government impersonation texts to 7726 (SPAM). This submits the message to your carrier's anti-spam database for network-level blocking.

Step 2: File with the FTC

Report at `ReportFraud.FTC.gov` → "Scams and Rip-Offs" → "Impersonator Scams." Include the sending phone number, message text, and URL.

Step 3: Report to the FBI IC3

File at `ic3.gov` if you lost money to a smishing scam. The FBI IC3 specifically tracks toll impersonation scams, and aggregated reports enable federal law enforcement actions.

Step 4: Alert Your State AG

Most state attorneys general offices accept consumer fraud complaints for smishing. This is particularly effective for state-specific toll authority scams where state AG offices can coordinate with the real toll authority.

Step 5: Report to USPS Postal Inspection Service (USPS Scams)

For USPS-branded smishing: Email `spam@uspis.gov` or file at `postalinspectors.uspis.gov/investigations/mailfraud/`.

Why Removing Your Phone from Data Brokers Reduces Smishing Targeting

Smishing operators specifically target their campaigns geographically (to make toll scams relevant) and demographically (to target vehicle owners). The targeting data comes from commercial data broker databases.

Removing your mobile phone number from commercial data brokers removes it from the bulk "U.S. mobile numbers by state and vehicle ownership" lists that smishing operators purchase. This does not make your number invisible to everyone, but it eliminates your number from the high-volume commercial targeting pipelines that feed automated smishing campaigns.

See our guide on How to Remove Your Phone Number from the Internet for a complete step-by-step phone number opt-out protocol.