The fdot text scam phenomenon has exploded across Florida in recent years, catching thousands of unsuspecting drivers off guard with convincing fake messages that appear to come from the Florida Department of Transportation. These fraudulent SMS messages typically claim that you have unpaid tolls, outstanding fines, or urgent account issues that require immediate payment or personal information submission.

If you have received a suspicious text referencing FDOT, SunPass, or E-ZPass with a link you do not recognize, there is a very strong chance you are being targeted by a smishing — SMS phishing — campaign designed to steal your financial credentials and personal data.

Understanding how these scams operate is the first and most critical step toward protecting yourself and your family. Cybercriminals invest significant resources into making their fake messages look authentic, mimicking the official language, logos, and even domain name styles used by legitimate Florida transportation agencies.

The messages create a manufactured sense of urgency, warning that your vehicle registration may be suspended, that a debt is accruing interest daily, or that failure to respond within 24 hours will result in additional penalties. This high-pressure framing is intentional — it is designed to override your critical thinking and push you into clicking a malicious link before you have a chance to verify the message's authenticity.

Florida is one of the most heavily targeted states in the nation for transportation-related smishing attacks, partly because of its extensive toll network. The state operates hundreds of miles of toll roads managed through systems like SunPass, E-ZPass Florida, and the Turnpike Enterprise, creating a large pool of potential victims who plausibly could have unpaid tolls. Scammers exploit this familiarity, knowing that a significant percentage of any large text blast will reach drivers who regularly use these roads and might genuinely worry about an outstanding balance.

The Federal Trade Commission (FTC) and the FBI's Internet Crime Complaint Center (IC3) have both issued formal warnings about the surge in toll-related smishing campaigns affecting states including Florida, Texas, California, and New York. In early 2024, IC3 reported receiving over 2,000 complaints in a single week related to fake toll collection texts alone. Florida's own Department of Highway Safety and Motor Vehicles (DHSMV) and FDOT have published official statements confirming that neither agency sends unsolicited text messages demanding immediate payment through third-party links.

Beyond financial loss, falling victim to one of these scams can have long-lasting consequences for your credit score, banking security, and personal identity. Once fraudsters obtain your credit card number, bank account details, or Social Security number through a fake payment portal, they can make unauthorized purchases, open new lines of credit in your name, and sell your data on dark web marketplaces. Victims frequently report spending dozens of hours — and sometimes hundreds of dollars in legal and banking fees — attempting to recover from identity theft triggered by a single moment of inattention.

This comprehensive guide walks you through everything you need to know about the FDOT text scam landscape in 2026: how to spot a fake message instantly, what the real FDOT communication channels look like, what steps to take if you have already clicked a suspicious link, and how to formally report fraudulent activity to maximize the chance that authorities can act on your complaint. Whether you are a daily commuter, a transportation industry professional, or simply a Florida resident who wants to stay safe, the information in this article can help you navigate this growing threat with confidence and clarity.

We will also address some nuanced situations that trip up even cautious individuals, such as messages that contain your real license plate number (obtained through data breaches), URLs that closely mimic legitimate FDOT or SunPass web addresses, and fake customer service phone numbers that lead to live scam operators. Armed with the detailed knowledge in this guide, you will be well-equipped to protect yourself and to educate the people around you about one of Florida's most pervasive digital threats.

Spotting a fake FDOT text message is much easier once you know the precise red flags to look for, and developing this recognition skill can save you from enormous financial and personal harm. The single most reliable indicator of a scam text is the URL embedded in the message. Legitimate FDOT and SunPass communications will always direct users to domains ending in .gov (such as fdot.gov) or the official sunpass.com domain. Fraudulent links, by contrast, typically use domains with subtle misspellings — fdot-pay.com, sunpass-tolldue.net, florida-tolls-payment.com — or use legitimate-looking subdomains like fdot.payment-secure.xyz to disguise the true destination.

The second major red flag is the tone and structure of the message itself. Official government agencies are legally required to follow specific communication protocols that include formal language, reference numbers, and established contact channels. Scam texts, even well-crafted ones, tend to rely heavily on emotional pressure language: phrases like "FINAL NOTICE," "IMMEDIATE ACTION REQUIRED," "YOUR VEHICLE REGISTRATION IS AT RISK," or "AVOID ADDITIONAL FEES TODAY" are hallmarks of social engineering, not government correspondence. Real FDOT notices about toll violations arrive by postal mail, not text message, and include specific case numbers and a formal administrative process.

Another telling sign is the sender's phone number. Scam texts often come from standard 10-digit phone numbers or short codes that are not associated with any official Florida government service. FDOT and Florida's toll agencies do not communicate via personal cell phone numbers. If you receive a toll-related text from what appears to be a regular cell phone number rather than a verified government short code or clearly identified organizational number, treat it as fraudulent until proven otherwise. You can cross-reference official FDOT contact numbers at the official fdot.gov website.

Grammar and formatting inconsistencies, while less common in newer, more sophisticated scam campaigns, still appear frequently enough to be a useful detection tool. Watch for awkward sentence construction, inconsistent capitalization, missing articles, or odd punctuation that would not appear in professionally drafted government communications. Some smishing messages also contain generic salutations — "Dear Customer" or "Dear Driver" — rather than your name, because the scammers are operating a mass blast without personalized data (though more advanced attacks may include your name from breached databases).

The dollar amount requested is often deliberately small and plausible — typically between $2.50 and $25 — precisely because a small sum does not trigger the same psychological alarm bells as a large demand. Scammers have found that victims are far more likely to pay a small "toll debt" without question than a large fine. However, the real goal is not the small payment itself; it is capturing your full credit card number, expiration date, CVV code, and billing address, which can then be used for much larger fraudulent transactions or sold in bulk.

Pay close attention to any request for information that goes beyond what a simple toll payment would require. Legitimate toll agencies only need a license plate number or SunPass account number and a payment method to resolve an outstanding balance. If a form asks for your Social Security number, driver's license number, date of birth, email password, or banking login credentials, it is unequivocally a scam. No toll collection process in Florida — or anywhere in the United States — requires your SSN or government ID number to process a routine payment.

Finally, trust your instincts. If you feel rushed, confused, or uncertain about a message you have received, that discomfort is a valuable signal. Take the time to independently verify by going directly to fdot.gov or calling the official SunPass customer service line at 1-888-865-5352. A few extra minutes of verification is a far better investment than the weeks or months of recovery that follow a successful phishing attack. Remember that FDOT and Florida's toll agencies will never penalize you for taking the time to verify a communication's authenticity through official channels before responding.

Reporting an FDOT text scam effectively requires knowing exactly which agencies handle different aspects of the complaint, and submitting thorough reports to multiple organizations simultaneously maximizes the chance that meaningful action will be taken. The Federal Trade Commission is the primary federal body responsible for collecting and acting on consumer fraud reports.

You can file a report at reportfraud.ftc.gov in approximately five minutes, and providing the scammer's phone number, the full text of the message, any URLs included, and the date and time received all significantly increases the report's investigative value. The FTC uses aggregated complaint data to identify patterns, obtain injunctions, and coordinate with law enforcement on prosecutions.

The FBI's Internet Crime Complaint Center, known as IC3 and accessible at ic3.gov, is the appropriate venue for reporting internet-enabled fraud with financial losses. If you lost money or provided financial account information to a scam portal, filing with IC3 is particularly important, as the center coordinates with federal agents who can pursue criminal cases against smishing operations. When filing, include screenshots of the text message, the fake website, any confirmation emails received, and your bank or credit card statements showing unauthorized transactions if applicable.

At the state level, Florida residents can file complaints with the Florida Attorney General's Office through its online consumer protection portal at myfloridalegal.com. The AG's office has jurisdiction over fraudulent business practices targeting Florida residents and has historically been aggressive in pursuing scam operations. Additionally, reporting to the Florida Department of Law Enforcement (FDLE) is appropriate when the fraud involves identity theft, as FDLE coordinates with local law enforcement to investigate identity crimes that cross jurisdictional boundaries.

Forwarding the scam text to 7726 — which spells SPAM on a standard phone keypad — is one of the simplest and most impactful steps you can take. This free service is operated collaboratively by the major US wireless carriers, including AT&T, Verizon, T-Mobile, and US Cellular.

When you forward a spam text to 7726, your carrier receives the sender's number and message content, investigates, and typically blocks the number from sending further messages to their network customers. While this will not stop the fraudsters from switching numbers, it disrupts active campaigns and protects other Florida residents from receiving the same message.

The Anti-Phishing Working Group (APWG) accepts reports of phishing URLs at reportphishing@apwg.org, and submitting the fake FDOT payment portal link to this organization triggers a process where the URL may be added to browser blocklists maintained by Google Safe Browsing, Microsoft SmartScreen, and other security services. This means your report can directly prevent the fake website from loading for other potential victims who receive the same smishing text, effectively turning your individual report into broad community protection.

Google and Apple both maintain their own abuse reporting channels for apps and web content that engage in phishing. If you encountered the scam through a Google-indexed link, you can submit it to Google's Safe Browsing reporting tool at safebrowsing.google.com/safebrowsing/report_phish. For iPhone users, Apple's iOS 16 and later versions include a "Report Junk" option directly in the Messages app for texts from unknown senders, which feeds into Apple's spam detection systems and helps protect the broader iOS user community across the country.

Documentation is crucial for all of these reports. Before deleting the scam text, take a screenshot that captures the sender's number, the full message content, and the timestamp. If you visited the fake website, use your browser's screenshot function to capture the URL bar and the page content. If you received any follow-up communications — calls, emails, or additional texts — document those as well. Comprehensive documentation not only strengthens your individual reports but also provides evidence that investigators can use in building cases against the criminal networks operating these campaigns at scale.

Long-term protection against FDOT text scams and smishing attacks in general requires building a set of habits and technical safeguards that operate continuously in the background of your digital life, not just in moments of immediate threat. The most fundamental protection is establishing a firm personal policy of never clicking links in unsolicited text messages, regardless of how official or urgent they appear.

This single rule, applied consistently, eliminates the vast majority of your smishing risk without requiring any technical knowledge or special tools. If a message claims to be urgent, verify it through official channels — a brief delay never causes the legal or financial consequences that scam texts warn about.

Enable your mobile carrier's built-in spam filtering and call-blocking features, which have become substantially more sophisticated over the past few years. T-Mobile's Scam Shield, Verizon's Call Filter, and AT&T's ActiveArmor all provide layered smishing detection that can flag or block suspected fraudulent texts before they even reach your inbox. While these tools are not perfect and will not catch every sophisticated smishing attempt, they significantly reduce the volume of fraudulent messages you receive and provide an important first line of automated defense that requires no ongoing effort on your part after initial setup.

Consider installing a dedicated mobile security application from a reputable vendor such as Malwarebytes, Norton Mobile Security, or Bitdefender Mobile Security. These apps provide real-time scanning of URLs, detection of malicious apps, and sometimes SMS filtering capabilities that go beyond what carrier-level tools offer. They are particularly valuable if you use your phone for business purposes or frequently access sensitive accounts on mobile, as these use patterns increase both your exposure to phishing attempts and the potential damage from a successful attack.

Managing your digital footprint proactively reduces the likelihood that your phone number ends up in the purchased data lists that power mass smishing campaigns. Opt out of data broker databases using services like DeleteMe or Privacy Bee, which automate the tedious process of submitting removal requests to the dozens of companies that aggregate and sell consumer personal data. While complete removal from all data broker databases is not feasible, significantly reducing your presence in these databases lowers the odds that your number appears on a smishing campaign's targeting list.

Set up account alerts on all your financial accounts — checking, savings, credit cards, and investment accounts — to send real-time notifications for any transaction above a threshold you define. Many banks allow you to set this as low as $1, meaning you will be immediately alerted to any fraudulent charge regardless of its size. This does not prevent the initial theft, but it dramatically reduces the window during which unauthorized transactions can accumulate undetected, which in turn reduces the total financial damage and simplifies the dispute process with your financial institution.

Educate family members, particularly older relatives who may be less familiar with digital fraud tactics, about the specific patterns used in FDOT text scams. Older adults are disproportionately targeted by smishing campaigns because they are statistically more likely to trust official-looking communications and less likely to question the authenticity of a message that uses authoritative language. A brief conversation explaining that no government agency sends payment demands by text message can be genuinely protective for vulnerable family members who might otherwise fall victim to these campaigns.

Finally, stay informed about evolving scam tactics by following official communications from the FTC (consumer.ftc.gov), the Florida AG's office, and FDOT itself. Scam methodologies evolve continuously as fraudsters adapt to public awareness and technical countermeasures. By maintaining awareness of current tactics, you ensure that your protective instincts remain calibrated to the actual threat landscape rather than outdated patterns. Subscribing to the FTC's consumer alert email list provides free, timely updates whenever new scam patterns emerge that may affect Florida residents.

For transportation industry professionals who work with FDOT or who are preparing for FDOT certification exams, awareness of the FDOT text scam landscape carries an additional professional dimension. Workers in the field who receive suspicious texts purportedly from FDOT about certifications, contractor payments, or compliance deadlines should apply the same skeptical analysis as any member of the public and verify through official project channels before responding. Fraudulent messages targeting contractors can impersonate FDOT project managers or administrative staff to harvest banking information for fraudulent wire transfers — a form of business email compromise adapted to the SMS channel.

FDOT contractors and subcontractors should establish internal protocols for verifying any payment-related communications received by text or email, including secondary verification through known-good phone numbers for FDOT project personnel. Requiring verbal confirmation for any change to payment routing information is a standard best practice recommended by the Association of Certified Fraud Examiners (ACFE) and is particularly relevant in the construction and infrastructure sectors where FDOT fraud has been documented. These internal controls protect businesses from social engineering attacks that can result in significant financial losses.

Transportation professionals studying for FDOT-related certifications should note that examination communications from FDOT-approved training providers will always come through your registered student portal or via email to the address you provided during enrollment — not via unsolicited SMS. If you receive a text claiming that your certification exam has been rescheduled, that additional fees are due, or that your certification is at risk due to non-compliance, contact your certification program directly through their official website to verify before taking any action.

Florida's construction industry has seen a notable increase in targeted smishing campaigns that specifically reference FDOT project numbers, CPAM portal access, and Materials Testing certification requirements to lend messages false specificity and credibility. These more targeted attacks are typically executed by actors who have scraped FDOT's public project databases or obtained contractor lists through open records requests, combining publicly available business information with personal phone numbers acquired through data brokers. The combination creates messages that feel highly specific and therefore more legitimate to professionals in the field.

If your company or organization receives multiple reports of FDOT-related smishing targeting employees, consider reporting the campaign to FDOT's fraud hotline and to your company's cybersecurity team simultaneously. Coordinated reporting from multiple recipients within the same organization or industry sector can help investigators identify that a targeted campaign is underway and accelerate their response. FDOT maintains a public corruption and fraud hotline at 800-342-5869 where industry professionals can report fraud attempts that implicate FDOT processes, personnel, or contractor relationships.

Resources for transportation professionals include FDOT's official Inspector General office, which handles reports of fraud, waste, and abuse involving FDOT programs and funding. The IG can be contacted directly through FDOT's website at fdot.gov/agencyresources/inspectorgeneral. Filing a report with the IG is appropriate when smishing content suggests potential insider knowledge of FDOT operations, references specific internal project details, or when a coordinated campaign appears to be targeting multiple FDOT contractors or employees. This reporting channel connects your complaint to investigators with specific authority and expertise in FDOT-related fraud.

Remaining vigilant as a professional also means periodically reviewing your company's online presence to minimize the personal contact information that appears in publicly accessible FDOT contractor databases, bid submissions, and professional licensing records. While full removal is often not possible for regulated industries, limiting the specificity of publicly listed contact details — using a general company number rather than a direct mobile number, for example — reduces the precision with which smishing campaigns can target you with personalized messages that reference your specific professional context and credentials.