Got an E-ZPass “unpaid toll” text? How to tell if it's fake in 5 seconds

If you live anywhere in the five boroughs or on Long Island, you've probably gotten one: “E-ZPass: You have an unpaid toll of $4.15. Pay now to avoid a $50 late fee.” With a link. It's almost always a scam — and it's one of the most common texts we get asked about.

The 5-second check

In February 2025, Governor Hochul and the Thruway Authority put out the clearest rule we've seen: real E-ZPass New York texts come only from the short code 39769, and they start with “EZPNY.” (Governor's office)

So:

Came from a regular 10-digit number, an international number, or an email address? Fake.
Asks you to reply “Y” to activate the link? Fake. That trick is designed to get around your phone's link protection.
The link isn't e-zpassny.com or tollsbymailny.com? Fake. Those are the only official sites.

If you're ever unsure, don't tap anything in the text. Open your browser, type e-zpassny.com yourself, and log in. If you really owe a toll, it'll be there.

“But I don't even have a car”

That's the tell. Scammers blast these to every number they can find. After congestion pricing started on January 5, 2025, fake “Congestion Relief Zone” toll texts went out to people who don't own a car at all (amNY). The FTC has warned about the same national wave (FTC).

Why it works

The amount is small ($3–$12), so it feels low-risk. The late fee creates urgency. And the fake page looks exactly like the real one. The goal isn't the $4 — it's your card number, your name and address, and sometimes the one-time code your bank texts you. That's enough to drain an account or open new ones.

Already tapped it? Do this now

If you entered a card number: call the number on the back of your card and tell them it was compromised. Ask for a new card number.
If you entered a password: change it from a different device, and change it anywhere else you used the same one.
If you entered a one-time code: call your bank immediately — that code may have let someone in.
If you downloaded anything: don't open it. Have a technician check the device.
Turn on multi-factor authentication for your email and bank if it isn't on already.

We wrote a full checklist here: I clicked a link in a scam text — now what?

Report it (takes 10 seconds)

Forward the text to 7726 (spells SPAM). Your carrier uses it to block the sender.
Report to the FBI at ic3.gov if you lost money.
Then delete it.

When to call a tech

If you tapped the link on a computer, entered a password, or just aren't sure what happened, it's worth a quick check. We can review the device remotely, lock down the accounts, and set up filtering so fewer of these reach you. Send us a screenshot first — if it's a scam, we'll tell you in a minute.