The Illinois Tollway Invoice Scam is a smishing and phishing operation that impersonates the Illinois State Toll Highway Authority and the I-PASS transponder system. The Illinois Tollway operates a 294-mile network across northern Illinois — I-88, I-90, I-94, I-294, and I-355. Victims of the Illinois Tollway Invoice Scam receive a text or email claiming a small unpaid toll balance and a link to “pay now” — the link leads to a phishing site that harvests card details, names, and addresses.

The Illinois Tollway Invoice Scam is part of a much larger toll-smishing wave that has hit every major US toll authority since 2024. The same criminal infrastructure that runs the Illinois Tollway Invoice Scam also runs near-identical campaigns impersonating RiverLink in Kentucky and Indiana, BayAreaFasTrak in California, the Ohio Turnpike, NYTollServices, NC Quick Pass, and the Maryland DriveEzMD system. Only the branding changes — the playbook is identical.

What makes the Illinois Tollway Invoice Scam particularly effective is the small claimed amount combined with the genuine prevalence of I-PASS usage across Chicagoland. The fake unpaid-toll figure is almost always under $10 — sometimes as little as $2.95 — designed to feel trivial enough that the victim pays without examining the URL or the sender carefully. Many Chicago-area drivers do hold real I-PASS accounts, which makes the lure feel plausible at first glance.

The Illinois Tollway Invoice Scam targets victims by phone number and email rather than by actual toll usage. Lists of US mobile numbers are bought in bulk on dark-web markets, then bombarded with the Illinois Tollway Invoice Scam messages regardless of whether the recipient lives in Illinois, has ever driven the Tollway, or has ever held an I-PASS account. Many recipients of the Illinois Tollway Invoice Scam have never even visited the Midwest.

Despite the regional branding, the scam follows the same playbook as every other smishing fraud: a believable sender, a small urgent amount, a look-alike domain, and a payment form that captures card data. The same approach is documented in our phishing scam pillar, the Ohio Turnpike Text Scam sister guide, the RiverLink scam guide, and the traffic violation text scam broader category guide.

The Illinois Tollway Invoice Scam follows the same six-stage pattern used by every smishing campaign that has hit US toll authorities since 2024. Recognising the structure makes the individual warning signs easier to spot before any payment information is entered.

Step 1: The Phone Number and Email Harvest

The Illinois Tollway Invoice Scam begins with bulk contact lists. The criminals buy or obtain millions of US mobile numbers and email addresses from data brokers, leaked breach dumps, and dark-web marketplaces. The lists are not filtered by Illinois residency — anyone with a US mobile number or email is a potential target.

This is why people who have never driven the Illinois Tollway — or even visited Illinois — still receive the smishing message. The criminals do not know or care whether the recipient has any genuine reason to interact with the Illinois Tollway. The volume of messages sent means even a tiny conversion rate is profitable.

Step 2: The Smishing or Phishing Message

The Illinois Tollway Invoice Scam message arrives looking convincingly official. A typical text reads: “Illinois Tollway: You have an outstanding I-PASS toll balance of $4.25. To avoid late fees and registration holds, please pay immediately at il-tollway-pay.com/invoice/[random-string].” Sender names include “Illinois Tollway,” “I-PASS Services,” “IL-Toll Bureau,” “Illinois Tollway Invoice,” or numeric short codes.

The message deliberately mimics a real notification from the Illinois Tollway — short, urgent, low-dollar, and link-driven. The Illinois Tollway Invoice Scam also uses iMessage and email delivery where possible to add the apparent legitimacy of a blue-bubble message or branded HTML email rather than an SMS short code.

Step 3: The Look-Alike Domain

The link in the message never points to the real illinoistollway.com or getipass.com. Instead it points to a look-alike domain — il-tollway-pay.com, illtollway-invoice.com, ipass-toll-pay.com, illinoistollway.live, or hundreds of similar variations. These domains are registered in bulk, rotated every few days as they get blocked, and hosted on infrastructure designed to evade takedown.

The look-alike domain in the Illinois Tollway Invoice Scam is the single most reliable verification check. The genuine Illinois Tollway uses exactly illinoistollway.com and I-PASS uses getipass.com — anything else, including subdomains, hyphenated variations, or alternative TLDs, is fraudulent.

Step 4: The Phishing Form

When the victim clicks the link, the Illinois Tollway Invoice Scam landing page renders a near-perfect clone of the real Illinois Tollway or I-PASS payment portal. The logo, fonts, colours, and layout are copied. The victim is prompted to enter a name, address, phone number, and full card details — including the CVV — to pay the small claimed amount.

The form processes the payment for the trivial sum, then thanks the victim and closes. To the victim, the Illinois Tollway Invoice Scam appears resolved. In reality, the card details have been captured and the larger fraud is just beginning.

Step 5: Card Monetisation

Once the criminals have card details from the Illinois Tollway Invoice Scam, monetisation begins. The card is typically used for high-value online purchases routed through reshipping mules, or sold in bulk on dark-web markets to other criminals. The small “toll payment” was a tiny test charge to verify the card was live.

Victims of the Illinois Tollway Invoice Scam often see fraudulent charges appear within hours or days. The amounts vary from a few hundred dollars to thousands. Card issuers usually reverse the charges under zero-liability policies — but only if the victim reports promptly.

Step 6: Identity Layer-On

Beyond the immediate card fraud, the Illinois Tollway Invoice Scam often harvests enough personal data to feed downstream identity theft. Name, address, phone, and card number provide a foundation that criminals combine with data from other breaches to attempt new-account fraud, mobile carrier port-outs, and synthetic identity theft. This is why the Illinois Tollway Invoice Scam overlaps with our identity theft scams guide.

The Illinois Tollway Invoice Scam is one of many regional smishing campaigns that share the same underlying infrastructure and playbook. The criminal networks rotate the impersonated brand based on the state list they are targeting — but the warning signs are identical. These are the five sister variants of the fraud.

The Naperville Commuter and the $4.25 I-PASS Charge

A 39-year-old IT consultant from Naperville who uses I-PASS daily on I-88 received an Illinois Tollway Invoice Scam text claiming a $4.25 unpaid balance. Because she actually held an I-PASS account and had crossed multiple toll plazas that morning, the message seemed credible. She clicked the link, which led to a near-perfect Illinois Tollway clone at illtollway-invoice.com, and paid the $4.25 with her Chase Visa.

Three days later, her Chase card showed $3,876 in charges at electronics retailers in three different states. Her bank reversed the fraudulent charges and issued a new card — but the criminals had also harvested her name, address, and phone number, which began appearing on phishing lists for unrelated frauds over the following months.

The lesson: legitimate use of a service does not validate every message claiming to be from it. The Illinois Tollway does not send SMS payment requests under any circumstances. Verifying the balance directly at illinoistollway.com would have exposed the Illinois Tollway Invoice Scam in under thirty seconds.

The Arizona Resident Who Has Never Visited Illinois

A retired accountant in Phoenix, Arizona received six different Illinois Tollway Invoice Scam emails over five weeks. He has never driven in Illinois and has no idea what I-PASS is. The first five emails he ignored; the sixth looked official enough that he searched the sender address, found warnings about the Illinois Tollway Invoice Scam, and reported the emails to the FTC.

He had not been a victim — but his email address was clearly on a circulated criminal list. Over the same period he received variants impersonating RiverLink, BayAreaFasTrak, the Ohio Turnpike, and a fake “Arizona DOT Toll Bureau” message that mentioned Arizona roads. All from the same campaign infrastructure, rotated across the toll brands.

The lesson: this scam targets contact details, not actual drivers. Receiving the message proves nothing about your real toll history. If you have never used the Illinois Tollway, the messages are fraud; if you have used the Illinois Tollway, the messages are still fraud because the Illinois Tollway does not contact customers this way.

The Chicago Family of Identity Theft Victims

A family of three in Chicago clicked through an Illinois Tollway Invoice Scam email on a shared family laptop. The husband entered the requested card details and an Illinois driver licence number to “verify the registered vehicle owner.” Within eight days, two new credit cards were opened in his name and another in his wife’s name. The fraudsters then attempted a SIM swap on his mobile number using the harvested data.

Over five months the family recovered most of the financial losses through dispute and chargeback processes — but spent dozens of hours filing reports, placing fraud alerts, freezing credit at all three bureaus, and resetting accounts. Their credit files showed unauthorised inquiries that took twenty months to fully clear.

The lesson: the Illinois Tollway Invoice Scam is not just about the small card payment — it is the entry point to a broader identity-theft attack that exploits any extra data the victim provides. Driver licence number and SSN have no role in paying a toll. Their request in a payment form is the second-layer warning that this is not just a card-skimming operation.

US consumer protection bodies and the Illinois toll authority itself have all issued public warnings about the Illinois Tollway Invoice Scam and the broader toll-smishing wave it belongs to.

The FBI’s Internet Crime Complaint Center (IC3) issued a public service announcement specifically about US toll-smishing in 2024 and has updated it since. The IC3 confirms that the Illinois Tollway Invoice Scam and its sister variants are part of a coordinated criminal infrastructure that has expanded to nearly every US state with major tolled roads. Report at ic3.gov.

The Federal Trade Commission has published consumer alerts about toll-text scams including the Illinois Tollway Invoice Scam. The FTC stresses three core rules: real toll agencies do not text you about unpaid tolls, look-alike domains are the giveaway, and reporting at reportfraud.ftc.gov directly helps the takedown effort against the criminals running these campaigns.

The Illinois State Toll Highway Authority has issued multiple public warnings on the official site at illinoistollway.com and via press releases. The Authority confirms it never sends payment-due SMS messages and operates only the illinoistollway.com and getipass.com domains. Any Illinois Tollway-branded message demanding payment is the Illinois Tollway Invoice Scam by definition.

The Illinois Attorney General’s office and the Illinois Department of Transportation have warned Illinois drivers about the Illinois Tollway Invoice Scam through public-safety bulletins. These advisories note the criminal pattern is identical to the parking-fine and traffic-violation smishing operations the same networks run across other US states and abroad.

Mobile carriers including AT&T, T-Mobile, and Verizon have all set up the 7726 (SPAM) short code as a free reporting route. Forwarding the smishing text to 7726 helps carriers block the sender at the network level — an effective community-level mitigation against the campaign.

Treat Every Toll-SMS as Fraud by Default

The single most effective protection against the scam is to treat any text claiming to be from a toll authority as fraud, regardless of how authentic it looks. The Illinois Tollway, RiverLink, BayAreaFasTrak, the Ohio Turnpike, and every other US toll system have publicly confirmed they do not send payment-due SMS messages. The arrival of the text is itself the proof of the fraud.

This single rule defeats the overwhelming majority of toll-text fraud at first contact. The criminals depend on the small fraction of recipients who do not know the rule. Once you know it, the Illinois Tollway Invoice Scam cannot reach you regardless of how convincing the message appears.

Verify Balances Only via Official Channels

If you genuinely use the Illinois Tollway and want to confirm your toll balance, type illinoistollway.com directly into your browser. Do not click any link in any text or email. Do not search for “ipass login” and click the first result — sponsored search ads for the fraud look-alikes have been documented. Type the URL directly.

You can also call the Illinois Tollway customer service at 1-800-824-7277 — the number printed on official Illinois Tollway mail and on the genuine illinoistollway.com site. If the message wants you to call a different number, that number is part of the criminal infrastructure.

Forward Suspicious Texts to 7726

Every major US mobile carrier supports the 7726 (SPAM) reporting short code. Forward the smishing text to 7726 and the carrier’s spam-filtering system processes it — helping block similar messages to other customers and contributing data to the takedown effort.

Forwarding is free, takes seconds, and works regardless of carrier. After forwarding, delete the smishing text from your inbox so you do not accidentally tap the link later.

Block the Sender and Report on iMessage

On iPhone, long-press the Illinois Tollway Invoice Scam message and choose “Report Junk” — Apple’s built-in tool that reports the sender to Apple for blocking. On Android, use the “Report spam” option in your messaging app. For emails, use your provider’s “Report phishing” option in Gmail or Outlook.

Block the sender afterwards so future Illinois Tollway Invoice Scam variants from the same source do not reach your inbox. The criminals will rotate to new numbers and addresses, but blocking each one slows them down.

Never Enter Card Details After Clicking an SMS or Email Link

If you accidentally clicked an Illinois Tollway Invoice Scam link, close the tab immediately. Do not enter any details — name, email, card number, anything. Closing the tab before entering data means no information was captured beyond the click event itself, which by itself is not enough for the criminals to use against you.

If you did enter data, contact your card issuer through the number on the back of the card and request a fraud freeze. Then change passwords on any account that uses the same email address you entered.

Educate Family Members — Especially Elderly Drivers

The Illinois Tollway Invoice Scam disproportionately targets older drivers who are less likely to scrutinise URLs or recognise smishing patterns. Show this guide to elderly relatives who drive in Illinois. Explain that no US toll authority — the Illinois Tollway, RiverLink, BayAreaFasTrak, anyone — sends payment-due texts under any circumstances.

One conversation prevents the Illinois Tollway Invoice Scam from reaching the most-targeted demographic. Most prevention happens at this conversation, not at the bank’s fraud department after the fact.

Watch Card Activity for Weeks After Any Click

Even if you only clicked the Illinois Tollway Invoice Scam link without entering anything, the criminals now know your phone number or email actively engages with their messages. You will likely receive more smishing and phishing attempts. Watch card and bank activity for at least 30 days after any click, and consider enabling transaction alerts on every account so unauthorised charges surface immediately.

If you have already entered card details or personal information through an Illinois Tollway Invoice Scam link, act quickly. The steps below give you the best chance of limiting the damage and preventing the downstream identity-theft attacks that often follow.