The Unpaid Toll Text

The simulator

1. Step 1 of 5 First contact

   Your phone buzzes. It’s a text from a number you don’t know.

   ?

   +44 7700 900148Text message

   This sender is not in your contacts.

   1. They wrote: STATE TOLL SERVICES: We’ve noticed an outstanding toll of $6.99 on your record. To avoid a late fee of $50.00 and a hold on your driver’s license, pay by 11:59 pm today: statetoll-services.com-pay.info9:14 am

   Read this aloud

   What do you do?

   Not sure? Show a hint

   Look at who sent it and how they want you to pay. Would a toll company text you from an overseas mobile number?

   1. Tap the link and pay the $6.99. It’s only a few dollars, and I don’t want a $50 fine.

      Risky choice

      This is exactly what the scammers are hoping for. The small amount makes it feel harmless, and the $50 late fee adds pressure. The link doesn’t lead to a toll company. It leads to a copy of one, built to collect your card details.

   2. Reply STOP so they don’t text me again.

      Risky choice

      It feels sensible, but replying tells the scammers your number is real and someone reads their texts. That makes your number more valuable, and you’ll often get more scam texts, not fewer. Don’t reply at all.

   3. Don’t tap anything. Check my toll account by opening the toll company’s own app, or by typing its website address myself.

      Safe choice

      That’s the safe move. If you really owe a toll, it will show in your real account or arrive by post. Checking through an app or website you find yourself means the scammer’s link never gets a chance.

   Red flags at this step

   • A text you weren’t expecting, about money you supposedly owe
   • An overseas mobile number instead of a company name
   • A deadline today and a threat (a late fee and a hold on your license)
   • A strange web address: the real part is “com-pay.info”, not a toll company

   What's really going on

   These texts are sent to millions of phones at once. Scammers don’t know whether you drive or use toll roads; they rely on enough people half-remembering a trip. A web address is read from the right: everything before “com-pay.info” is decoration, so this one belongs to whoever owns com-pay.info.

2. Step 2 of 5 The hook

   Many people do tap the link. On some phones nothing happens, because the phone has switched off links from unknown senders. So a second text arrives.

   ?

   +44 7700 900148Text message

   This sender is not in your contacts.

   1. They wrote: STATE TOLL SERVICES: We’ve noticed an outstanding toll of $6.99 on your record. To avoid a late fee of $50.00 and a hold on your driver’s license, pay by 11:59 pm today: statetoll-services.com-pay.info9:14 am
   2. They wrote: Please reply Y, then exit the text message and open it again to activate the link, or copy the link into your web browser.9:15 am

   Read this aloud

   The link won't open. What now?

   Not sure? Show a hint

   Why would a real company need you to reply before its link works?

   1. Reply Y, then open the message again so the link works.

      Risky choice

      Replying Y switches the link back on, and it proves to the scammers that a real person is reading. Your phone blocked that link to protect you; the scammer is asking you to undo the protection.

   2. Copy the link and paste it into my web browser.

      Risky choice

      Copying the link gets around your phone’s protection in the same way. The page it opens is still the scammer’s.

   3. Stop here. Report it as junk and delete it. (In the US, UK, Canada and New Zealand you can also forward it to 7726.)

      Safe choice

      Well done. Reporting helps phone companies block the sender for everyone. Then delete it. You’ve lost nothing.

   Red flags at this step

   • Being asked to reply so that a link will work
   • Being told to copy a link into your browser

   What's really going on

   Phones such as the iPhone switch off links in texts from unknown senders until you reply. Scammers know this, so they add a line asking you to reply “Y”. A real company has no reason to ask you to do this.

3. Step 3 of 5 Winning your trust

   Suppose you do open the link. A web page appears. It has a road picture, a smart logo and your $6.99 balance, ready to pay.

   Web address: statetoll-services.com-pay.info/pay

   State Toll Services: Pay Your Balance

   Outstanding balance: $6.99

   Pay now to avoid a $50.00 late fee and a hold on your driver’s license.

   Please confirm your details to complete payment.

   Full name

   Home address

   Phone number

   Card number

   Expiry date

   Security code (CVV)

   Pay $6.99

   Read this aloud

   The page looks official. What do you do?

   Not sure? Show a hint

   Look at the address bar at the top. Whose website is this?

   1. Fill in my name, address and card details and press Pay. The page looks just like the real one.

      Risky choice

      Criminals now use ready-made kits that copy the look of hundreds of real companies in minutes. Looking official proves nothing. Everything you type here goes straight to the scammer: your name, address, phone number and full card details.

   2. Check the web address first. It ends in “com-pay.info”, not the toll company’s own website, so I close the page without typing anything.

      Safe choice

      Exactly right. Reading the address bar is one of the best habits you can have. Closing the page before typing anything means you’ve given nothing away.

   Red flags at this step

   • A payment page you reached from a text link
   • The web address doesn’t belong to the company it claims to be
   • Asking for your full card details and home address to pay a few dollars

   What's really going on

   The page is a copy. Google has taken legal action against the people behind one of these kits, alleging it was used to steal card details from more than a million people in 120 countries. The kits offer ready-made fake pages for hundreds of brands: toll roads, post offices, parking fines and banks.

4. Step 4 of 5 The ask

   If someone does press Pay, the page asks for one more thing. At the same moment, a real text arrives from their bank.

   Y

   Your BankText message

   1. They wrote: Your Bank: 482913 is your code to add your card ending 4417 to a mobile wallet. Never share this code with anyone, including us.9:21 am

   The toll page says: “For your security, enter the verification code we just sent to your phone.”

   Read this aloud

   The toll page wants the code. What do you do?

   Not sure? Show a hint

   Read the bank’s text slowly. What is the code for?

   1. Type the code into the toll page. It says it’s for my security.

      Risky choice

      This is the moment the scam pays off. The code isn’t for a toll payment. It lets the criminals add your card to a phone wallet (like Apple Pay or Google Wallet) on their phone. They can then tap to pay in shops anywhere, sometimes for weeks.

   2. Stop. The bank’s text says the code is to add my card to a mobile wallet, which I’m not doing. I close the page and call my bank on the number on the back of my card.

      Safe choice

      Perfect. Reading what the code is actually for is what gives this away. Calling your bank means they can cancel the card before it’s used.

   Red flags at this step

   • A code arrives that you didn’t ask for
   • The code is for something different from what you’re doing (a mobile wallet, a new device, a new payee)
   • A website asking you to type in a code from your bank

   What's really going on

   One-time codes are like the key to a new lock. Your bank sends one whenever something important happens, such as adding your card to a new phone. The scam kit starts that process on the criminal’s phone while you’re on the fake page, so the code you receive is real, and it goes to them if you type it in.

5. Step 5 of 5 Afterwards

   The next day, someone who typed in their card details gets a phone call. The caller ID shows their bank’s name.

   Incoming call

   Caller ID: Your Bank

   1. Caller: “Good morning, this is Daniel from the fraud team at your bank. We’ve spotted some unusual payments on your card ending 4417, in another state.”
   2. Caller: “I can stop them right now. I’m sending you a code. Please read it back to me so I can confirm it’s you and block the card.”

   Read this aloud

   What do you do?

   Not sure? Show a hint

   Can a caller ID be faked? What would your real bank never ask for?

   1. Read the code back. They know my card number and they’re trying to help.

      Risky choice

      This is a second scam from the same criminals, or people who bought your details from them. They know your card number because you typed it into their fake page. The code lets them take even more, perhaps your online banking.

   2. Say “I’ll call you back”, hang up, and call the number on the back of my card, from a different phone if I can.

      Safe choice

      That’s the golden rule. Caller ID can be faked to show any name or number. A call you make yourself, to a number you already trust, is the only way to know you’re really talking to your bank.

   Red flags at this step

   • A call about fraud soon after you’ve paid or clicked something
   • Caller ID showing your bank (this can be faked)
   • Being asked to read out a code

   What's really going on

   Criminals often sell or reuse stolen card details, and a follow-up call pretending to be the bank is common. Your bank will never ask you to read out a code it sent you. If you’re worried, hang up and call the number on your card.