Fake toll texts: how to spot them and protect your business

On October 14, 2026, Microsoft announced it had helped take down three services that sold criminals ready-made scam texts, emails, and fake websites. Those services were behind a lot of the “unpaid toll” and “package can’t be delivered” texts that land on everyone’s phone. The takedown helps, but these scams aren’t going away. Here’s what happened, how to tell a real toll notice from a fake one, and a short checklist for your team.

What Microsoft took down

According to Microsoft’s announcement (opens in a new tab), Microsoft and Health-ISAC, with an order from a U.S. federal court in Florida, seized domains behind three linked services called YAM Store, CoGUI, and Iron Man. Microsoft says that since January 2026 they enabled more than one billion malicious messages aimed at over 75,000 organizations in more than 150 countries.

The services worked like a store for scammers. YAM Store sold fraudulent Microsoft and Google accounts and other scam tools. CoGUI supplied ready-made fake websites and messages that impersonate companies, banks, and government agencies, built to steal passwords and payment details. Iron Man, its newer replacement, offered more than 2,300 templates impersonating banks, retailers, healthcare providers, transportation authorities, police departments, and parcel delivery services. Microsoft has disabled more than 20,000 accounts tied to YAM Store and blocked more than 100,000 domains used for impersonation and fraud.

Microsoft is also clear that these services are “only part” of a larger criminal network. Expect the texts to keep coming.

Why this matters to a small business

A fake toll text looks like a personal problem, but it often lands on a phone that also holds work email, the business’s card, or the login for your point-of-sale system. Owners and managers who drive company vehicles with E-ZPass are obvious targets. The same kits that build a fake toll payment page also build fake sign-in pages for Microsoft, Google, and other brands. One rushed tap between lunch and dinner service can hand over a card number or a work password.

How to tell a real E-ZPass New York text

The FTC (opens in a new tab) says an unexpected text about unpaid tolls is probably a scam. For E-ZPass New York specifically:

• Check the sender. According to MTA Bridges and Tunnels (opens in a new tab), real E-ZPass and Tolls by Mail texts come from the short code 39769, start with “EZPNY,” and never ask for personal information or make unsolicited payment demands.
• Watch for “NY Toll Services.” The Port Authority (opens in a new tab) warns of a widespread scam text using that name to collect “unpaid” tolls.
• Be wary of international numbers and “reply Y” requests. New York State has warned (opens in a new tab) that the fake texts often come from international numbers and ask you to reply “Y” to get a link.
• Only use the official sites. E-ZPass New York’s own guidance (opens in a new tab) says official messages only refer you to E-ZPassNY.com and TollsByMailNY.com, and that it will never ask for your date of birth or Social Security number. Tolls NY is the only official app.

Same trick, different logo

The pattern is the same whether the message claims to be from a toll agency, a delivery company, your bank, or your POS provider: something is urgent, and the fix is a link. Restaurants should know that Toast says it will never contact you (opens in a new tab) to ask for passwords or one-time passcodes, and that unsolicited calls about Toast hardware updates are likely fraudulent. Treat any “urgent POS update” email or call the same way you’d treat a toll text.

A 10-minute checklist for your team

1. Set one rule. Nobody pays a toll, fine, fee, or invoice from a text or email link. Go to the official site or app by typing it in yourself.
2. Check, don’t click. If a message might be real, sign in to the account the usual way or call the number on the back of your card, not the one in the message.
3. Report and delete. Use your phone’s “report junk” option or forward the text to 7726 (SPAM), as the FTC recommends. You can also report fraud at ReportFraud.ftc.gov.
4. Turn on multi-factor sign-in for your Microsoft 365 or Google accounts and your POS account. Toast recommends it for both your email and your Toast account.
5. Plan for the slip. If someone entered card details, call the card issuer right away. If someone entered a work password, change it and tell whoever manages your IT the same day.

Where Overwatch One fits

Scam texts are a people problem as much as a tech problem. With IT as a Service, businesses across New York City and Bergen County, NJ get monitoring, updates, and unlimited remote support for one monthly plan, so there’s always someone to ask when a message looks off. Our cybersecurity work adds endpoint protection and helps your staff spot phishing before it costs you. If you’d like us to look at your setup, get in touch or Ask Scott, our AI assistant.

Sources

1. Microsoft On the Issues: Disrupting the service economy behind transnational cybercrime operations, Oct 14, 2026 (opens in a new tab)
2. MTA Bridges and Tunnels: E-ZPass text message scam (opens in a new tab)
3. Port Authority of NY & NJ: E-ZPass scam warning (opens in a new tab)
4. New York State: Governor Hochul Warns Consumers of E-ZPass Text Message Scam (opens in a new tab)
5. E-ZPass New York: How to Protect Yourself (PDF) (opens in a new tab)
6. FTC Consumer Advice: Got a text about unpaid tolls? It’s probably a scam (opens in a new tab)
7. Toast Central: Protect Your Toast Account From Scammers (opens in a new tab)

Details are from the linked sources as checked on October 20, 2026 and may change. This guide is independent and isn’t sponsored or reviewed by Microsoft, E-ZPass, the MTA, the Port Authority, or Toast. Product and agency names belong to their owners.