Smishing (toll and delivery texts): how it works, warning signs and what to do

Social engineering · médio

The text says there is an unpaid toll (in the US, imitating E-ZPass, SunPass or the DMV; in Brazil, free-flow tolls or Detran), a package held for an incomplete address or import fee (USPS, UPS, Correios) or a fine about to expire. It includes a link and a short deadline.

The link opens a page identical to the official one asking for a small card payment. In practice the goal is to capture the card number, expiry, security code and sometimes the bank's verification code, which lets criminals add the card to digital wallets.

According to 2025 FTC data, text messages are the most common contact method in reported scams.

Sinais / Signs

A short deadline and threat of a fine, suspension or return
A link with an odd, shortened or unusual domain
A message from an unknown or international number, or an email address via iMessage
Card details requested for a very small amount
Instructions to reply "Y" or reopen the message to activate the link

Prevenção / Prevention

Do not click: check tolls, fines and tracking by typing the official site or using the app
Turn on unknown-sender filtering on your phone
Never share verification codes received by text
Use a virtual or limited card for online purchases
Report and delete the message (in the US, forward it to 7726)

O que fazer / What to do

If you entered card details, call the bank, block it and request a new one
Check whether the card was added to a digital wallet and dispute charges
Change passwords if you logged in on the fake page
Report to the FTC (US) or CERT.br and your bank (Brazil)

FAQ

It was only a few dollars. What is the harm?

The small amount is bait. What scammers want is your full card details for bigger purchases.

How do they know I drive or expect a package?

Usually they do not: they send the same text to millions of numbers and count on coincidence.

FTC - ReportFraud · PYMNTS - FTC consumer fraud losses · APWG Year in Review · CERT.br