The text arrives looking something like this:

E-ZPass Notice: You have an outstanding toll balance of $4.35. Failure to pay within 48 hours may result in a $50 fine. Pay now: [link]

The amount is small. The deadline creates urgency. The name looks familiar. And the link, at a glance, looks like it could be legitimate.

Most people either pay immediately or delete it and move on. Both reactions are understandable. Neither is quite right.

If you received a message like this, here's what's actually happening.

This attack has a name in the security world: smishing. It's phishing conducted via text message rather than email. The toll violation variant has become one of the most widespread smishing campaigns in the United States over the past two years, with the Federal Bureau of Investigation (FBI) and the Federal Trade Commission (FTC) both issuing warnings about it.

The reason it works so well comes down to four things working together.

The amount is designed to feel not worth questioning. Four dollars and thirty-five cents isn't an amount most people will spend time investigating. It's cheaper than a coffee. Paying it feels like the path of least resistance, and that calculation is entirely intentional. Fraudsters have learned that small amounts generate far less scrutiny than large ones, and that a victim who pays a small amount has also just handed over their payment card details, which are worth far more than the stated charge.

The brand is familiar. E-ZPass, SunPass, FasTrak, TxTag, and other toll operators are names people recognize. Seeing a familiar brand in a message creates an immediate assumption of legitimacy. The fraudsters aren't guessing which toll system you use. They're sending the same message to millions of people and relying on the fact that a meaningful percentage of recipients either use that system or have driven through a toll at some point.

The urgency is calibrated. Forty-eight hours is long enough to feel like a real administrative deadline and short enough to discourage you from taking time to verify. It's not so extreme that it triggers immediate skepticism, but it's tight enough to push you toward acting before thinking.

The link looks plausible. The fraudsters register domains that are close to the real thing. Something like ezpass-payments.com or tollservices-us.com rather than the actual e-zpass.com. On a phone screen, where the full URL is often truncated, the difference is easy to miss.

If you tap the link, you land on a page that's a convincing copy of a real toll payment portal. It asks for your name, your license plate number, and your payment card details.

The name and plate number feel like routine verification. They're not. They're additional pieces of your identity being collected. The payment card details are the primary target.

Once you submit, one of two things typically happens. Either the page returns an error and asks you to try again (collecting your details twice), or it shows a confirmation screen and disappears. Either way, your card information is now in the hands of people who will use it, sell it, or both.

Some variants of this attack also install malware on your device if you tap the link, even before you enter anything. This is less common but worth knowing.

Legitimate toll operators in the United States don't primarily communicate via text message for violation notices. When they do send texts, they don't include payment links. They direct you to log in to your account through the official app or website, which you navigate to yourself.

Here's a reliable way to check any message like this:

Don't tap the link. Open a browser and go directly to the toll operator's official website by typing the address yourself or searching for it. Log in to your account. If there's a genuine outstanding balance, it'll be there. If there's nothing there, the text was fraudulent.

That's the entire process. It takes about ninety seconds and removes all ambiguity.

If you're not sure which toll system covers the road you drove on, a quick search for the state and toll road name will tell you. Every legitimate toll operator has an official website where you can check your account status without relying on any link someone sent you.

If you tapped the link but didn't enter any information, the risk is lower but not zero. Run a security scan on your device if you have one available, and monitor your accounts for unusual activity over the next few weeks.

If you entered your payment card details, act quickly.

Contact your card issuer immediately and report the card as compromised. Ask them to issue a new card with a new number. Review your recent transactions and dispute anything you don't recognize. If you used a debit card rather than a credit card, the process is the same but the protections are somewhat weaker, so move faster.

If you entered your Social Security number or other identity documents, contact one of the three major credit bureaus (Equifax, Experian, or TransUnion) and place a fraud alert on your credit file. This makes it harder for someone to open new accounts in your name. A credit freeze is stronger and is worth considering if you believe your information has been compromised.

Report the message to the FTC at reportfraud.ftc.gov and forward the text to 7726 (SPAM), which is the reporting shortcode used by most major carriers.

The toll violation scam is one version of a much larger category of attack. The same structure — a small urgent amount, a familiar brand, a tight deadline, a link to a convincing fake page — is used for package delivery notifications, parking violations, utility bills, and court summons notices.

The details change. The mechanics don't.

Any unsolicited message that asks you to click a link and enter payment or identity information should be treated with the same skepticism, regardless of what it claims to be about. The right response is always the same: don't use the link they gave you. Find the official contact yourself and verify from there.

The link in the message isn't a shortcut. It's the trap.