Scam help

I clicked a link in an unpaid toll text

Texts claiming you owe a small unpaid toll, with a link to pay, have been sent to drivers across the US. The FBI has warned about them since April 2024. If you tapped the link, here’s what to do.

How to tell it was a scam

  • A small “outstanding toll” with a late fee if you don’t pay now.
  • A link that imitates your state’s toll service but isn’t its real website.
  • A text even though you didn’t drive on a toll road, or you live in a state without toll roads.
  • A sender number that looks like a long personal number or an email address.

See where the link really went

Copy the link from the message (long-press it, then Copy) and paste it here. We open it from our server, not your device.

I only opened the page

On an up-to-date phone or computer, just opening a scam page rarely does damage by itself. The danger is what the page asks you to do next.

  1. 1Close the tab and don’t go back to it.
  2. 2Delete the message, and report it first if you can (see below).
  3. 3Install any pending system and browser updates.
  4. 4If the page asked to “Allow notifications” and you tapped Allow, remove it: on Android open Chrome › Settings › Notifications, on iPhone go to Settings › Notifications, on a computer check your browser’s site settings.

I typed a password or sign-in details

Assume the scammer has that password and act now.

  1. 1Change the password on the real site or app, and anywhere else you use the same password.
  2. 2Turn on two-step verification for that account.
  3. 3Sign out other sessions (look for “Where you’re logged in” or “Devices” in the account’s security settings).
  4. 4Check the account’s recovery email and phone number haven’t been changed.

I entered card or bank details

Call your bank or card issuer straight away, using the number on the back of your card.

  1. 1Ask them to block the card and send a new one.
  2. 2Go through recent transactions with them and dispute any you don’t recognise.
  3. 3Watch for follow-up calls or texts “from your bank”: scammers often call next, pretending to help.

I gave personal details (address, date of birth, ID or Social Security number)

This can be used for identity theft, so lock things down.

  1. 1In the US, go to IdentityTheft.gov for a recovery plan.
  2. 2Consider a free credit freeze with Equifax, Experian and TransUnion.
  3. 3Be suspicious of any call, text or email that knows those details.

I gave someone a one-time code

A code sent to your phone lets someone sign in as you or approve a payment. Treat it like a password.

  1. 1Change the account’s password and sign out all other sessions.
  2. 2If it was a bank or payment code, call your bank now.
  3. 3Nobody genuine will ever ask you to read a code back to them.

I downloaded or installed something

This is the most serious case, because the app may keep running.

  1. 1Delete the app or file. On Android, check Settings › Apps for anything new or unfamiliar.
  2. 2On iPhone, check Settings › General › VPN & Device Management and remove any profile you don’t recognise.
  3. 3Run your device’s built-in protection: Google Play Protect on Android, or your security app on a computer.
  4. 4If you installed a remote-access app because someone told you to, disconnect from the internet and contact your bank.

Report it

File a complaint at ic3.gov

The FBI asks for the phone number the text came from and the website in the text.

Check your real account

Use your toll service’s official website or customer service number, never the link in the text.

Forward the text to 7726 (SPAM)

This reports the sender to your mobile carrier in the US and many other countries.

Report it to the FTC

At ReportFraud.ftc.gov (US).

Block the sender

And delete the message after reporting it.

Common questions

Can my phone be hacked just by tapping a scam link?

On an up-to-date iPhone or Android phone, simply opening a scam page rarely does harm by itself. The damage usually comes from what you do next: entering a password, card details or a code, allowing notifications, or installing something.

Should I reset my phone after clicking a scam link?

Usually not. If you only opened the page, closing it and updating your phone is enough. If you installed something, remove it first; a reset is a last resort.

How do I check where a scam link went?

Paste it into the checker on this page. We open it from our server, so you can see every redirect and the final page without opening it again on your device.

Help for specific scams

Any scam link USPS text Amazon scam message Facebook or Messenger scam link Check a QR code