Colorado, along with other states and the federal government, is taking steps to alert citizens of a growing phishing scam where targets receive text messages claiming they have an unpaid toll fine. The image above was made by the Federal Trade Commission to spread awareness of this grift. (Federal Trade Commission)

Colorado Warns Citizens about Fake Toll Texts

ExpressToll smishing is the latest grift to catch fire–here’s how to protect yourself

Melinda Yim, Staff Writer • April 12, 2025 • 8 Views

Drivers on Colorado E-470 might have seen an unusual road message over spring break: “NATIONAL ALERT: TEXT & EMAIL SCAM WARNING.” Since January 29, this message has been appearing on road displays all over the state as part of the Colorado Department of Transportation’s effort to curb a recently popular financial scam: toll smishing.

“Smishing” is a combination of SMS (as in text messages) and phishing (the act of tricking others into exposing personal information online). Toll smishing revolves around, well, road tolls. A target will get a text message that is supposedly from ExpressToll, the highway toll collecting system used in most western US states including Colorado, or its eastern equivalent EZPass.

The text message demands that the receiver immediately satisfy their unpaid toll balance. These text messages will also include a link to a website that mimics a legitimate toll agency’s site, logos and all. The site asks the target to pay their fine by entering their name, address, driver’s license number, and credit card details. Those that fall for the scam then see that information used for identity theft and financial fraud.

Here’s an example of a toll fee scam texts off my personal phone. The text accuses me (a high school freshman with no license) of having an unpaid EZPass toll, a toll company that operates all along the East Coast and Great Lake states but not where I live in Colorado. While this scam was easy for me to see through, the phishers behind this stole millions of dollars from Americans last year. (Melinda Yim)

An unpaid toll bill can happen–in Colorado alone, there are multiple expressways managed by ExpressToll, like E-470, Northwest Parkway, and the I-25 Express Lanes. However, neither ExpressToll nor EZPass will call or send an email about unpaid tolls. Actual toll fees will come in the mail and will require two-step verification for those trying to pay online.

The texts pressure their targets with language that creates a sense of urgency, threatening fines or suspended driving privileges (which do not happen as a result of unpaid tolls). Many texts intimate that there will be legal consequences if the fines don’t get paid in a couple of days or even a few hours.

If you get one of these messages:

Do not reply to the message!
Never click on the links! If you think a text message may be legitimate, log onto the company’s website on a different device and see if the same request is in your official account.
As far as toll smishings, you can contact the toll agency directly to verify its authenticity. Don’t call the number that texted you but the business line listed on Google.
Document everything related to the scam, including screenshots of messages and reports filed.
Reporting the phone number and scam text content to the Internet Crime Complaint Center (IC3) and the Federal Trade Commission (FTC) at ReportFraud.ftc.gov.
Finally, delete the message and block the number.

…And if you’ve already fallen for this or another phishing scam:

Take the same steps as above.
Next, change the passwords for any online account that could be effective immediately. This could include your email, bank account, credit card account, and ExpressToll account.
Call your bank or credit card company and report the fraud. Depending on the situation, you may have to get new credit or debit cards or freeze your financial account. Yes, phone calls are a pain, but they are the best method of verification for financial matters.
Call one of the three major credit bureaus: Experian (1-888-397-3742), Equifax (1-888-378-4329), or TransUnion (1-800-916-8800). Tell the credit bureau to put a fraud alert on your credit account so scammers can’t make new financial accounts in your name. Don’t worry about contacting all three: whichever bureau you talk to will alert the others.
Monitor your accounts closely for unauthorized transactions and report any suspicious activity immediately.

About the Contributor