What is the Sunpass toll scam?
The SunPass toll scam is a type of smishing (short for “SMS phishing”) attack that uses fake text messages from SunPass to trick victims into divulging their credit card details or other personal information. The message claims the recipient owes unpaid tolls and directs them to a fake website resembling the official SunPass portal. The criminals use the data collected from these pages to fraudulently charge people or even carry out identity theft.
The dramatic rise in phishing attempts involving the SunPass toll system follows the latest scamming trends, where text scams have overtaken phone call scams in recent years. To combat the problem, SunPass and the Florida Department of Transportation (FDOT) have repeatedly warned users that they will never request payment or sensitive information through unsolicited messages.
How the SunPass toll scam works
The SunPass toll scam works by exploiting people’s trust in the SunPass toll system. The scammers send a text message to the victim, usually involving unpaid toll fees. The amount specified is typically low (under $20.00) to appear plausible and avoid raising suspicion.
The scammers often create a sense of urgency to push victims into acting without thinking — for example, by warning that additional fees will be applied if the debt is not paid quickly. The message includes a link that directs the victim to a website designed to look like the official SunPass site. To convince the visitor that the site is genuine, scammers go so far as to copy logos, layouts, and color schemes.
Once on the fake site, the victim is prompted to enter payment information and other sensitive details, such as their billing addresses and security codes. This data is immediately sent to the scammers, who are free to use it for unauthorized purchases or identity theft.
Examples of SunPass toll scams
The following examples have been taken verbatim from real SunPass scam messages, including any grammatical errors. The victims’ names and malicious links have been redacted for safety.
- Hi, Please Respond. Hello [redacted], Sunpass Toll Services : We’ve noticed an outstanding toll amount of $19.51 on your record. to avoid a late fee of $50.00, visit: [redacted] to settle your balance.
- Summary Bill Notification. Sunpass Toll Services : We’ve noticed an outstanding toll amount of $19.51 on your record. To avoid a late fee of $50.00, Visit: [redacted] to settle your account.
- Summary E-Toll Bill Statement to: [redacted]. Sunpass Toll Services : We have noticed an outstanding toll amount of $19.51 on your record. To avoid a late fee of $50.00, Visit: [redacted] to settle your balance.
Clicking on the links included in the above messages would take you to a malicious website masquerading as the SunPass toll payment system. In most cases, the domain name is a slight variation of https://sunpass.com/, the official SunPass website. Here are some known SunPass toll scam domains that have been taken down by the Office of the Attorney General in Florida:
- sunpass-service.com
- sunpass-help.com
- sunpass-online.com
- sunpass-florida.com
- sunpass-toll.com
- sunpass-tolls.com
- sunpass-express.com
- service-sunpass.com
- tolls-sunpass.com
- web-sunpass.com
- sunpasstollfees.com
How to protect yourself from SunPass toll scams
While Florida’s Cyber Fraud Enforcement Unit continues to work diligently to keep residents safe, there are measures you can take to protect yourself from SunPass toll scams.
Be vigilant against scam attempts
You can foil many phishing scams simply by exercising proper caution. Learn to spot the telltale signs of scam messages, such as grammatical errors and a sense of extreme urgency. Keep a cool head and:
- Always verify the source. SunPass will never send unsolicited text messages demanding immediate payment. Any legitimate communication from SunPass will come from an official email address (like “customerservice@sunpass.com”) or be sent from the number 786727. If you receive a suspicious message, always check the official SunPass website or contact SunPass’s customer service.
- Never click on suspicious links. Avoid clicking on links in unsolicited messages. Keep in mind that cybercriminals can use URL shorteners and other deceptive techniques to obscure the link’s destination — if you’re unsure, use NordVPN’s link checker to see if the link is safe. For maximum cybersecurity, manually type out “https://sunpass.com/” in your browser or use the SunPass mobile app.
Use NordVPN’s Threat Protection Pro™
Threat Protection Pro™ is designed to help you avoid phishing messages and websites — just like the ones used in the SunPass toll scam. In fact, NordVPN was the first VPN service provider to be approved by AV-Comparatives for anti-phishing protection.
As you browse, Threat Protection Pro™ provides real-time scam and fraud alerts to prevent you from visiting malicious websites and unwittingly entering any sensitive information. To identify which URLs could harm you, NordVPN refers to an extensive database of known malicious websites, checks website certificates, and uses sophisticated machine learning models.
Conclusion
Florida SunPass and other scams are a growing problem, but users can stay safe with proper awareness and the right tools. You can protect yourself from financial and personal data theft by understanding the tactics that scammers use (like fake unpaid toll alerts and phishing websites) and by taking advantage of anti-phishing features — like NordVPN’s own Threat Protection Pro™.
Online security starts with a click.
Stay safe with the world’s leading VPN
