How to spot and avoid the SunPass toll scam

Phishing scams impersonating SunPass have been widely reported since 2024, amid a broader rise in toll-related fraud across the U.S. By early 2025, the FBI had logged tens of thousands of complaints related to toll payment scams involving services such as E-ZPass, SunPass, and other regional toll agencies.

In these scams, attackers send messages claiming there’s an unpaid toll, violation, or payment issue. The alerts are designed to look like legitimate SunPass communications and aim to trick people driving on Florida roads into sharing personal information, login credentials, or payment details. Similar campaigns have also been reported in states including California, Colorado, and Washington.

This guide explains how to recognize the warning signs of a SunPass scam and outlines practical steps you can take to avoid falling victim and protect your personal data.

What is the SunPass toll scam?

The SunPass scam is a type of phishing attack that targets Florida drivers who use the local electronic toll collection system. Scammers send fake SunPass notifications to trick people into clicking links, sharing account information, or making payments. The goal is to steal personal details, login credentials, or credit card information.

Knowing what the scam looks like is the first step to keeping your SunPass account and personal information safe.

Common types of SunPass scam messages

Scammers use various tactics to trick drivers into giving up personal information or money. Common message types include:

• Overdue toll notices: Text messages claim you have unpaid tolls and demand immediate payment. The amount is usually small, under $20, to appear plausible. Links lead to fake payment sites that harvest credit card details.
• Account suspension warnings: These messages pressure you to act fast with phrases like "immediate action required" or "your account will be deactivated within 24 hours."
• Security breach alerts: Messages suggest your SunPass account has been compromised, pushing you to click malicious links to "secure" or "verify" your account. Clicking these links is what actually puts your information at risk.

These emails or texts include links that mimic the official SunPass site to steal login credentials. Fake sites use URLs that look similar to sunpass.com but contain misspelled or extra words, such as "sunpas.com" or "sunpass-pay.com." Authorities regularly shut down fake domains, but scammers keep registering new ones.

It’s worth noting that SunPass doesn’t send text messages about unpaid tolls. Legitimate toll notifications arrive as Toll Enforcement Invoices by mail to the vehicle's owner. If SunPass does contact customers via text, it comes from the shortcode 786727, not a random phone number, and won't demand immediate payment.

Why the SunPass toll scam is convincing

Many people fall for the SunPass toll scam despite warnings from authorities. Here are the key reasons.

Urgency, authority, and familiarity

Scammers use psychological tactics to make you act without thinking:

• Fear of consequences: People generally strive to avoid fines, account suspension, or legal action.
• Time pressure: Messages often say you must pay or respond immediately. Urgency makes it harder to think clearly.
• Familiarity: Scammers design emails or texts to look like official SunPass communications so they seem trustworthy.

Since these tactics exploit natural human responses, even careful people sometimes fall for them.

Timing and context

Another reason these scams work is because they're plausible. People who regularly use toll roads are used to receiving payment reminders, so a message about an unpaid toll doesn't seem unusual.

The amounts are also deliberately low. A $6.99 toll fee doesn't trigger the same skepticism as a $200 charge, so people are more likely to pay without verifying.

It’s worth noting that criminals send large volumes of messages automatically, so even people who’ve never driven Florida roads may receive these notifications.

The goal is volume: send enough messages and eventually someone will have just used a toll road and won't think twice before clicking. If even a small percentage of recipients happen to have driven through a toll recently, the scam pays off.

Who is most at risk?

Certain user groups are more likely to fall victim:

• Senior drivers who may be less familiar with smishing scams. Scammers often pressure them by exploiting concerns about legal or financial consequences.
• Regular commuters. Because their tolls are paid automatically, they may not remember every individual transaction, so a message claiming a recent payment failed sounds plausible.
• Tourists who use Florida toll roads. They may not understand how SunPass works, so scammers exploit this confusion, often sending fake toll violation notifications after the trip ends.
• People who recently changed vehicles or license plates. They may be uncertain whether their transponder is properly linked to their new car.

Real-world statistics on toll scams

Toll scams affect thousands of drivers each year. Florida is particularly exposed. The state has more than 700 miles of toll roads, used regularly by 22 million residents and roughly 130 million visitors each year. Florida authorities and consumer protection agencies have reported thousands of complaints linked to SunPass and similar phishing scams since early 2024.

That said, the scam is not limited to Florida. According to the FBI, cyber fraud complaints topped 330,000 nationwide in 2024, with toll scams ranking as the most reported category, accounting for 59,271 complaints.

In addition to SunPass scams, authorities have also reported similar schemes targeting other toll systems, including Georgia’s Peach Pass, Texas Tag, and E-ZPass, which is widely used across the East Coast. Anyone who uses toll roads, regardless of location, may be a potential target.

What to do if you receive a scam message

Follow these steps if you received a suspicious SunPass message that you couldn't verify through official channels.

1. Immediate actions to take: Don’t click links, open attachments, or share personal information. Keep the sender information and message content to report a scam. Once you’ve reported it, delete the message to prevent further interaction with the scam content.
2. Report locally: Contact SunPass customer service through the official website or by phone. Provide the suspicious message so they can flag fraudulent activity and help secure your account.
3. Report federally: Submit complaints online at reportfraud.ftc.gov. Include the message content, sender details, and links. The Federal Trade Commission (FTC) collects scam reports nationwide to identify patterns, take legal action against fraudsters, and issue public warnings.
4. Report to Attorney General (AG): If you’re a Florida resident, you can report scams through the Florida Department of Legal Affairs online portal. While the FTC handles complaints at the federal level, the Attorney General's office focuses on scams affecting Florida residents specifically.

What should I do if I clicked the scam link?

If you clicked a scam link, do the following:

• Don’t enter any information: If the link took you to a page requesting login details, credit card information, or personal data, close it immediately. Don’t interact with any buttons or prompts.
• Check for unwanted downloads: Review your browser’s download history and your device’s download folder. Delete any files you didn’t intentionally download. Don’t open them.
• Disconnect from the internet: If you clicked an attachment or a file download started automatically, turn off Wi-Fi or mobile data immediately. This stops malware from communicating with attackers or spreading further.
• Run an antivirus scan: Use a trusted security tool to scan your device for malware. Follow the provider’s recommended steps to remove detected threats.
• Change your SunPass password: If you entered login details, update your password immediately. If you use the same credentials on other platforms and services, update them, too.
• Contact your bank: If you entered payment details, call your bank immediately. Ask them to monitor for unusual activity and consider replacing your card to prevent unauthorized charges.

How to protect yourself from future toll scams

• Treat unexpected toll messages with suspicion: Legitimate toll agencies rarely contact drivers by text to demand immediate payment. Be especially cautious if a message claims you owe fees, threatens penalties, or urges you to act quickly.
• Never click toll payment links in texts: If you receive a toll notice, open the official toll service website or app directly instead of tapping links in messages.
• Check the sender carefully: Official toll agencies typically use consistent domains, sender IDs, and communication channels. SunPass emails come from customerservice@sunpass.com and noreply@sunpass.com, and official text messages use the short code 786727.
• Enable spam and SMS filtering: Most smartphones can automatically filter or silence suspected spam messages. Turning this on reduces exposure to scam texts before you ever see them.
• Use strong, unique passwords: Create a unique password for your toll account and avoid reusing it on other services. This limits damage if one account is compromised.
• Turn on two-factor authentication (2FA): If your toll provider supports it, enable 2FA. Even if scammers obtain your password, this extra step can block unauthorized access.
• Keep your device secure: Install system updates promptly and use reputable security software. Many toll scams rely on malware delivered through malicious links or downloads.