Toll Road QR Code Scam: How It Works and What to Do

Real toll agencies do not send QR codes by text

This is the key fact to remember: legitimate toll authorities — E-ZPass, SunPass, FasTrak, TxTag, and state-run systems — notify drivers of unpaid balances through physical mail sent to the address on file with the DMV. They do not send unsolicited text messages containing QR codes demanding payment within hours.

When scammers send these texts, they often don't even know which toll system operates in your state. The message may reference a generic "toll authority" rather than the real agency name, or it may cite a toll system that doesn't exist where you live. That alone is a giveaway — but the urgency in the message is designed to prevent you from stopping to notice.

How the toll road QR code scam works

The scam is a form of smishing — phishing via SMS — and is one of the fastest-growing fraud types reported to the FTC and FBI.

A text message arrives on your phone. It claims your vehicle has an unpaid toll balance, usually a small and plausible amount — $4.35, $6.90 — to avoid triggering suspicion. The message warns that failure to pay within 24 hours will result in additional fees or a suspension of your vehicle registration. To pay, you are directed to scan a QR code embedded in the text.

The QR code opens a convincing lookalike of a real toll agency payment page. The URL is slightly wrong — perhaps "e-zpass-payment.com" instead of a state .gov address — but the page looks polished, complete with official logos and a payment form. You enter your credit or debit card number, billing address, and sometimes your vehicle plate number. That information goes directly to the scammer.

Scammers use QR codes in these texts for the same reason they appear in quishing attacks generally: QR codes bypass the URL-preview function in most text messaging apps, making it harder to spot a suspicious address before you're already on the fake page.

Red flags in a toll text scam

• Sent from a regular phone number, not an official short code or a verified sender ID associated with a toll agency.
• Urgent deadline language — "pay within 24 hours," "avoid suspension," "final notice." Real toll agencies do not send ultimatums by text.
• A QR code or shortened link in the body of the text. Legitimate toll agencies never direct you to scan a QR code from an SMS. They direct you to your account through their official website or app.
• The toll agency name doesn't match your state or the highway you used. Scammers send these in bulk — they don't know where you drive.
• The payment page URL is not a .gov domain or the verified official domain of a known toll system.

What to do if you entered your card details

If you only scanned without entering anything: close the page and report the number. Your risk is low.

If you entered payment or personal information, act immediately:

1. Call your bank or card issuer right away. Report the transaction as fraud and request a reversal and a new card number. Speed is critical — card issuers can block additional charges if you act quickly.
2. Forward the text to 7726 (SPAM). This reports the sending number to your carrier for blocking.
3. File a complaint with the FTC at reportfraud.ftc.gov. Describe the text, the QR code, and what information you entered.
4. Report to the FBI's IC3 at ic3.gov, especially if money was lost.
5. Check your actual toll balance through official channels. Log into the toll agency's official website or call the number on your E-ZPass transponder or previous paper notice to confirm whether you actually owe anything.
6. Monitor your credit. If you also entered personal details like your name, address, or license plate, place a fraud alert with all three major credit bureaus.

This same smishing pattern is used in package tracking QR code scams and IRS QR code scams. In every case the formula is the same: a credible-sounding authority, a small urgent amount, a QR code, and a fake payment page.

Frequently asked questions