How to Find Who’s Behind a Fake Toll Text

The fake unpaid-toll text is a form of smishing, which is simply phishing delivered by SMS, iMessage, or RCS instead of email. The message impersonates a toll authority, usually one that operates where you live, such as E-ZPass in the Northeast, SunPass in Florida, FasTrak in California, EZDriveMA in Massachusetts, or a vague placeholder like “Toll Services” or “State Toll Roads.” It claims you have a tiny outstanding balance, often only a few dollars, and warns that late fees, a registration hold, collections, or even license suspension are coming unless you pay immediately through the link. Every part of that message is built to make you act before you think.

The small dollar figure is deliberate. It is low enough that paying feels easier than disputing, and low enough that you might not scrutinize the page before typing in your card. But the payment page is not a toll site at all. It is a counterfeit built to look like the real agency, hosted on a throwaway domain, and wired to capture whatever you enter: your card number, expiration, security code, billing address, and sometimes a full account login. The “toll” is a pretext. The real product is your financial data, which is either charged immediately, resold, or used to enroll your card in a digital wallet the criminals control. The same lawful research we use to identify a scammer by phone number applies here, because the spoofed sender is one of the first threads to pull.

Whether you only received the text or you already entered your card, the early moves are similar: capture the evidence, cut off the scammer’s access, and report it through channels that feed real investigations. File the federal complaint at the FBI Internet Crime Complaint Center, which logged 59,271 toll-scam complaints in 2024 and tracks these campaigns as a coordinated threat. Do the reporting and the card protection in parallel, not one after the other.

The technical trail. The spoofed sender and the phishing domain are where most write-ups stop, but they are where an investigation begins. The web address on the fake page resolves to real registration and hosting records, and analysts compare the registrar, the creation date, the name servers, the page template, and the back-end code against known smishing kits to cluster related sites. The originating sender, gateway, and message metadata add to that picture. None of this is doxxing; it is the lawful examination of the infrastructure the scam runs on, the same documentation that strengthens a complaint and gives investigators a usable starting point rather than a dead end.

The human trail. This is the lane almost no consumer advice works, and it is where People Locator Skip Tracing fits. Behind the throwaway domain and the spoofed number are real people with real footprints: the registrant or the U.S. contact tied to a domain, the operator of the merchant account or payment rail that received card charges, the money mule whose bank account collected funds, and the individual behind a phone number, email, or handle used in the campaign. Those identifiers, even when one layer is fake, can be researched lawfully through public records and skip-tracing techniques to surface a real name, address, and associates. That is the same work behind our guides on finding someone who scammed you and locating the person who scammed me. A named, located individual changes everything: it strengthens your IC3 report, gives a prosecutor or an attorney something concrete, and can support a civil claim that a screenshot alone never could.

Toll-text smishing runs on the same rails as other phishing fraud, so the people behind it surface through the same lawful research that powers our full-spectrum skip tracing. Send us what you have, even if it feels like nothing: the sender number or address, the screenshots, the exact web address of the fake page, any name or business that appeared on a charge, or the account a payment landed in. We work strictly for lawful, permissible purposes, we never promise a recovery we cannot control, and we tell you honestly what the records can and cannot show. For a legitimate matter, an initial locate typically comes back within 24 hours.