The NC Toll Invoice Scam is a smishing and phishing operation that impersonates the North Carolina Turnpike Authority (NCTA) and the NC Quick Pass transponder system. The NCTA operates the Triangle Expressway near Raleigh, the Monroe Expressway near Charlotte, and the in-development Mid-Currituck Bridge. Victims of the NC Toll Invoice Scam receive a text or email claiming a small unpaid toll balance and a link to “pay now” — the link leads to a phishing site that harvests card details, names, and addresses.

The NC Toll Invoice Scam is part of a much larger toll-smishing wave that has hit every major US toll authority since 2024. The same criminal infrastructure that runs the NC Toll Invoice Scam also runs near-identical campaigns impersonating RiverLink in Kentucky and Indiana, BayAreaFasTrak in California, the Ohio Turnpike, the Illinois Tollway, NYTollServices, and the Maryland DriveEzMD system. Only the branding changes — the playbook is identical.

What makes the NC Toll Invoice Scam particularly effective is the small claimed amount combined with the legitimate-looking NC Quick Pass branding. The fake unpaid-toll figure is almost always under $10 — sometimes as little as $4.67 — designed to feel trivial enough that the victim pays without examining the URL or the sender carefully. Many Triangle and Charlotte area drivers do hold real NC Quick Pass accounts, which makes the lure feel plausible at first glance.

The NC Toll Invoice Scam targets victims by phone number and email rather than by actual toll usage. Lists of US mobile numbers are bought in bulk on dark-web markets, then bombarded with the NC Toll Invoice Scam messages regardless of whether the recipient lives in North Carolina, has ever driven the Triangle Expressway, or has ever held a NC Quick Pass account. Many recipients of the NC Toll Invoice Scam have never even visited the Carolinas.

Despite the regional branding, the scam follows the same playbook as every other smishing fraud: a believable sender, a small urgent amount, a look-alike domain, and a payment form that captures card data. The same approach is documented in our phishing scam pillar, the Illinois Tollway Invoice Scam sister guide, the Ohio Turnpike Text Scam guide, and the traffic violation text scam broader category guide.

The NC Toll Invoice Scam follows the same six-stage pattern used by every smishing campaign that has hit US toll authorities since 2024. Recognising the structure makes the individual warning signs easier to spot before any payment information is entered.

Step 1: The Phone Number and Email Harvest

The NC Toll Invoice Scam begins with bulk contact lists. The criminals buy or obtain millions of US mobile numbers and email addresses from data brokers, leaked breach dumps, and dark-web marketplaces. The lists are not filtered by North Carolina residency — anyone with a US mobile number or email is a potential target.

This is why people who have never driven in North Carolina — or even visited the Carolinas — still receive the smishing message. The criminals do not know or care whether the recipient has any genuine reason to interact with NC Quick Pass. The volume of messages sent means even a tiny conversion rate is profitable.

Step 2: The Smishing or Phishing Message

The NC Toll Invoice Scam message arrives looking convincingly official. A typical text reads: “NC Quick Pass: You have an outstanding toll balance of $4.67. To avoid late fees and DMV registration holds, please pay immediately at ncquickpass-pay.com/invoice/[random-string].” Sender names include “NC Quick Pass,” “NC Toll Bureau,” “North Carolina Tolls,” “NC Turnpike Authority,” or numeric short codes.

The message deliberately mimics a real notification from NC Quick Pass — short, urgent, low-dollar, and link-driven. The NC Toll Invoice Scam also uses iMessage and email delivery where possible to add the apparent legitimacy of a blue-bubble message or branded HTML email rather than an SMS short code.

Step 3: The Look-Alike Domain

The link in the message never points to the real ncquickpass.com. Instead it points to a look-alike domain — ncquickpass-pay.com, nc-quickpass-toll.com, ncturnpike-invoice.com, ncquickpass.live, or hundreds of similar variations. These domains are registered in bulk, rotated every few days as they get blocked, and hosted on infrastructure designed to evade takedown.

The look-alike domain in the NC Toll Invoice Scam is the single most reliable verification check. The genuine NC Quick Pass uses exactly ncquickpass.com — anything else, including subdomains, hyphenated variations, or alternative TLDs, is fraudulent.

Step 4: The Phishing Form

When the victim clicks the link, the NC Toll Invoice Scam landing page renders a near-perfect clone of the real NC Quick Pass payment portal. The logo, fonts, colours, and layout are copied. The victim is prompted to enter a name, address, phone number, and full card details — including the CVV — to pay the small claimed amount.

The form processes the payment for the trivial sum, then thanks the victim and closes. To the victim, the NC Toll Invoice Scam appears resolved. In reality, the card details have been captured and the larger fraud is just beginning.

Step 5: Card Monetisation

Once the criminals have card details from the NC Toll Invoice Scam, monetisation begins. The card is typically used for high-value online purchases routed through reshipping mules, or sold in bulk on dark-web markets to other criminals. The small “toll payment” was a tiny test charge to verify the card was live.

Victims of the NC Toll Invoice Scam often see fraudulent charges appear within hours or days. The amounts vary from a few hundred dollars to thousands. Card issuers usually reverse the charges under zero-liability policies — but only if the victim reports promptly.

Step 6: Identity Layer-On

Beyond the immediate card fraud, the NC Toll Invoice Scam often harvests enough personal data to feed downstream identity theft. Name, address, phone, and card number provide a foundation that criminals combine with data from other breaches to attempt new-account fraud, mobile carrier port-outs, and synthetic identity theft. This is why the NC Toll Invoice Scam overlaps with our identity theft scams guide.

The NC Toll Invoice Scam is one of many regional smishing campaigns that share the same underlying infrastructure and playbook. The criminal networks rotate the impersonated brand based on the state list they are targeting — but the warning signs are identical. These are the five sister variants of the fraud.

The Raleigh Commuter and the $8.67 Triangle Expressway Charge

A 41-year-old software engineer from Raleigh who uses NC Quick Pass daily on I-540 received an NC Toll Invoice Scam text claiming an $8.67 unpaid balance. Because she actually held a NC Quick Pass account and had crossed multiple toll plazas that morning, the message seemed credible. She clicked the link, which led to a near-perfect NC Quick Pass clone at ncquickpass-invoice.com, and paid the $8.67 with her Bank of America Visa.

Two days later, her card showed $1,872 in charges at electronics retailers and a luxury hotel in three different states. Her bank reversed the fraudulent charges and issued a new card — but the criminals had also harvested her name, address, and phone number, which began appearing on phishing lists for unrelated frauds over the following months.

The lesson: legitimate use of a service does not validate every message claiming to be from it. NC Quick Pass does not send SMS payment requests under any circumstances. Verifying the balance directly at ncquickpass.com would have exposed the NC Toll Invoice Scam in under thirty seconds.

The Charlotte Resident Who Almost Took the Bait

A 47-year-old project manager in Charlotte received an NC Toll Invoice Scam email warning that his Monroe Expressway account was overdue and threatening DMV registration suspension. The email had a convincing NC Quick Pass logo and styling. Something felt off, so he searched “NC toll invoice scam” before clicking — and immediately found warnings about this exact campaign.

He had not been a victim — but his email address was clearly on a circulated criminal list. Over the same period he received variants impersonating RiverLink, BayAreaFasTrak, the Ohio Turnpike, and a fake “South Carolina Toll Authority” message that mentioned roads he had never driven. All from the same campaign infrastructure, rotated across the toll brands.

The lesson: a single Google search for the exact scam name often surfaces warnings from authorities and consumer publications. Pausing to verify before clicking is the entire defence against the NC Toll Invoice Scam. If you have never used NC Quick Pass, the messages are fraud; if you have used NC Quick Pass, the messages are still fraud because the agency does not contact customers this way.

The Triangle Family of Identity Theft Victims

A family of four in Durham clicked through an NC Toll Invoice Scam text on a shared family iPad. The wife entered the requested card details and a North Carolina driver licence number to “verify the registered vehicle owner.” Within eleven days, two new credit cards were opened in her name and another in her husband’s name. The fraudsters then attempted a SIM swap on her mobile number using the harvested data.

Over five months the family recovered most of the financial losses through dispute and chargeback processes — but spent dozens of hours filing reports, placing fraud alerts, freezing credit at all three bureaus, and resetting accounts. Their credit files showed unauthorised inquiries that took nineteen months to fully clear.

The lesson: the NC Toll Invoice Scam is not just about the small card payment — it is the entry point to a broader identity-theft attack that exploits any extra data the victim provides. Driver licence number and SSN have no role in paying a toll. Their request in a payment form is the second-layer warning that this is not just a card-skimming operation.

US consumer protection bodies and the North Carolina toll authorities themselves have all issued public warnings about the NC Toll Invoice Scam and the broader toll-smishing wave it belongs to.

The FBI’s Internet Crime Complaint Center (IC3) issued a public service announcement specifically about US toll-smishing in 2024 and has updated it since. The IC3 confirms that the NC Toll Invoice Scam and its sister variants are part of a coordinated criminal infrastructure that has expanded to nearly every US state with major tolled roads. Report at ic3.gov.

The Federal Trade Commission has published consumer alerts about toll-text scams including the NC Toll Invoice Scam. The FTC stresses three core rules: real toll agencies do not text you about unpaid tolls, look-alike domains are the giveaway, and reporting at reportfraud.ftc.gov directly helps the takedown effort against the criminals running these campaigns.

The North Carolina Turnpike Authority and NC Quick Pass have issued multiple public warnings on the official site at ncquickpass.com and via press releases. The Authority confirms it never sends payment-due SMS messages and operates only the ncquickpass.com domain. Any NC Quick Pass-branded message demanding payment is the NC Toll Invoice Scam by definition.

The North Carolina Department of Justice and the NC Attorney General’s office have warned North Carolina drivers about the NC Toll Invoice Scam through public-safety bulletins. These advisories note the criminal pattern is identical to the parking-fine and traffic-violation smishing operations the same networks run across other US states and abroad.

Mobile carriers including AT&T, T-Mobile, and Verizon have all set up the 7726 (SPAM) short code as a free reporting route. Forwarding the smishing text to 7726 helps carriers block the sender at the network level — an effective community-level mitigation against the campaign.

Treat Every Toll-SMS as Fraud by Default

The single most effective protection against the scam is to treat any text claiming to be from a toll authority as fraud, regardless of how authentic it looks. NC Quick Pass, RiverLink, BayAreaFasTrak, the Ohio Turnpike, the Illinois Tollway, and every other US toll system have publicly confirmed they do not send payment-due SMS messages. The arrival of the text is itself the proof of the fraud.

This single rule defeats the overwhelming majority of toll-text fraud at first contact. The criminals depend on the small fraction of recipients who do not know the rule. Once you know it, the NC Toll Invoice Scam cannot reach you regardless of how convincing the message appears.

Verify Balances Only via Official Channels

If you genuinely use NC Quick Pass and want to confirm your toll balance, type ncquickpass.com directly into your browser. Do not click any link in any text or email. Do not search for “nc quick pass login” and click the first result — sponsored search ads for the fraud look-alikes have been documented. Type the URL directly.

You can also call NC Quick Pass customer service at 1-877-769-7277 — the number printed on official NC Quick Pass mail and on the genuine ncquickpass.com site. If the message wants you to call a different number, that number is part of the criminal infrastructure.

Forward Suspicious Texts to 7726

Every major US mobile carrier supports the 7726 (SPAM) reporting short code. Forward the smishing text to 7726 and the carrier’s spam-filtering system processes it — helping block similar messages to other customers and contributing data to the takedown effort.

Forwarding is free, takes seconds, and works regardless of carrier. After forwarding, delete the smishing text from your inbox so you do not accidentally tap the link later.

Block the Sender and Report on iMessage

On iPhone, long-press the NC Toll Invoice Scam message and choose “Report Junk” — Apple’s built-in tool that reports the sender to Apple for blocking. On Android, use the “Report spam” option in your messaging app. For emails, use your provider’s “Report phishing” option in Gmail or Outlook.

Block the sender afterwards so future NC Toll Invoice Scam variants from the same source do not reach your inbox. The criminals will rotate to new numbers and addresses, but blocking each one slows them down.

Never Enter Card Details After Clicking an SMS or Email Link

If you accidentally clicked an NC Toll Invoice Scam link, close the tab immediately. Do not enter any details — name, email, card number, anything. Closing the tab before entering data means no information was captured beyond the click event itself, which by itself is not enough for the criminals to use against you.

If you did enter data, contact your card issuer through the number on the back of the card and request a fraud freeze. Then change passwords on any account that uses the same email address you entered.

Educate Family Members — Especially Elderly Drivers

The NC Toll Invoice Scam disproportionately targets older drivers who are less likely to scrutinise URLs or recognise smishing patterns. Show this guide to elderly relatives who drive in North Carolina. Explain that no US toll authority — NC Quick Pass, RiverLink, BayAreaFasTrak, anyone — sends payment-due texts under any circumstances.

One conversation prevents the NC Toll Invoice Scam from reaching the most-targeted demographic. Most prevention happens at this conversation, not at the bank’s fraud department after the fact.

Watch Card Activity for Weeks After Any Click

Even if you only clicked the NC Toll Invoice Scam link without entering anything, the criminals now know your phone number or email actively engages with their messages. You will likely receive more smishing and phishing attempts. Watch card and bank activity for at least 30 days after any click, and consider enabling transaction alerts on every account so unauthorised charges surface immediately.

If you have already entered card details or personal information through an NC Toll Invoice Scam link, act quickly. The steps below give you the best chance of limiting the damage and preventing the downstream identity-theft attacks that often follow.