Blog

"You owe a toll": why fake toll and delivery texts keep coming, and how to spot them

26 October 2026 · 2 min read

If you have a phone, you have probably had one: *"Your package could not be delivered, update your address"* or *"You have an outstanding toll balance, pay now to avoid a late fee."* These messages are not new, but they are not slowing down either.

The Federal Trade Commission reported in April 2025 that people lost $470 million to text-message scams in 2024, more than five times the 2020 figure. The two most reported types in its top five were fake package-delivery problems and bogus unpaid toll notices.

How the toll scam works

In April 2024 the FBI warned about a wave of texts claiming the recipient owed a small toll amount (one example was a little over $12) and would be charged a late fee unless they paid through a link. The link led to a site made to look like the state's toll service. Within weeks the FBI had received more than 2,000 complaints, and the messages were spreading from state to state.

The amount is small on purpose. People pay $12.51 without thinking. The real goal is the card number, and sometimes Social Security number, typed into the fake page.

How the delivery scam works

A text "from the postal service" says a parcel is stuck and asks for a small redelivery fee or an address confirmation. The link goes to a convincing copy of the real site. Again: tiny fee, big theft.

The other three on the FTC's list

• Fake fraud alerts asking you to reply YES or NO about a large purchase, then "helping" you move money somewhere "safe".
• Phony job offers that turn into paying to unlock earnings.
• "Wrong number" texts that grow into a friendship and then a fake investment.

The one rule

Don't use the link or number in an unexpected message. If you think you might really owe a toll or have a parcel waiting, open the official app or type the official website yourself. Everything else follows from that.

Also:

• forward scam texts to 7726 (SPAM) so carriers can block them;
• if you entered card details, call your bank on the number on the back of the card and dispute the charge;
• report it at ReportFraud.ftc.gov or ic3.gov.

At work

The same lures arrive by email, often with the company logo copied perfectly. KnoxDefender checks whether a "postal service" or "toll authority" email really comes from that organization (SPF, DKIM, DMARC), re-checks links when they are clicked (with link protection on), and lets staff report a suspicious message in one click. Our "Recognizing phishing" and "Suspicious links" courses use fictional delivery-notice examples your team can practice on.

Sources

• FTC Data Spotlight: Top text scams of 2024 (14 April 2025)
• FBI IC3 PSA I-041224-PSA: Smishing Scam Regarding Debt for Road Toll Services (12 April 2024)

← All stories · Questions? Contact us.