Texts and calls

The Cap Tow Text Scam, October 2026

Updated 6 October 2026

You assume the $39.99 charge is a real fee, and that is exactly what the cap-tow text scam is counting on. The text lands while you are still mentally checking which side of the street you parked on, and the amount is low enough that paying it feels easier than arguing. It is a fake, and the only money that moves when you tap the link is yours, going the wrong way.

What the cap-tow text actually says

The October 2026 version of the cap-tow scam is short and tidy. Most readers report a text that reads along the lines of CAP TOW: Vehicle plate ending 7GK3 has been towed to the impound lot. Release fee $39.99 due before pickup. Pay and schedule at cap-tow-release[.]info or a similar lookalike domain. Some variants swap the amount for $42.50 or $47.75, both small enough to feel like a parking add-on rather than a scam.

The plate fragment is a hook. Scammers either pull a partial plate from a data broker, harvest it from a previous breach, or just send the same text to a wide list and hope one in a few thousand recipients recognises it. If the plate is wrong, the message gets deleted. If the plate is right, or close enough, the recipient panics. That panic is the product.

Three details mark the text as fake. The domain is not a real municipal or police impound address. The fee is demanded through a link, not a phone call to a listed lot. And the URL itself is a giveaway. A genuine impound notice in most US cities will point you to a .gov site, a known private operator like a city-contracted tow yard, or a phone number printed on a sign at the lot itself. Anything with a hyphenated phrase and an unfamiliar TLD, or a country-code domain you have never seen used by US municipal services, is a scam landing page.

A second wave of the cap-tow text in October 2026 uses a one-time passcode trick. The message reads Use code CT-39481 to release your vehicle at the front gate, with no link at all. The follow-up text, if you reply, asks for a name, address, and a small payment to 'verify the release'. The code is meaningless, and the payment screen is the only thing the scammer actually wanted.

Who is behind the cap-tow impersonation, and why now

Brands get impersonated because the impersonation works, and 'Cap Tow' is a convenient label because it sounds like a generic municipal contractor. In most US cities the actual tow operator is named after the police department, the county, or a private firm that holds the city contract, and the name is usually plastered on every tow truck in the rotation. A name like Cap Tow shows up in search results as a small private lot in a handful of states, which gives the scammers just enough cover to claim the text is a reminder from a real operator.

The October timing is not accidental. Autumn is when parking enforcement ramps up around school zones, street cleaning rotations shift, and visitors flood into city centres for events. Drivers are more likely to second-guess a parked car they have not seen for a few hours, and the text fits that half-memory. The Federal Trade Commission logged an increase in parking and tow-related impersonation texts through the second half of 2026, with consumer losses reported in the low millions of dollars nationwide, according to public FTC fraud trend reporting.

Behind the cap-tow text is a familiar stack. The link usually routes through a low-cost redirector, lands on a cloned page that mimics a payment portal, and pulls the victim into either a card harvest or a peer-to-peer payment request. Some of the kits used in October 2026 are the same templates that powered the unpaid toll text scam earlier in the year, with the branding swapped. The same group, or copycats using the same kit, recycle the wording and the domain registrar, which is why the FTC and the FBI's Internet Crime Complaint Center continue to flag tow-themed smishing as a persistent category.

What a real tow notice looks like, and how to confirm one

No legitimate tow operator or police department will notify you by text that your car has been towed and that you owe a release fee. Real notices come on paper, taped to the spot where your car used to be, or they are not provided at all. In most cities, if your car is gone, the only reliable confirmation is a phone call to the non-emergency line of the local police department, which will tell you which lot holds the vehicle and what the release fee is.

Release fees in real life are not $39.99. They are whatever the city council or the contract allows, often $100 to $300 or more, and they are paid at the lot, in person, by card, cash, or sometimes a money order. They are not paid by clicking a link in a text. If you ever receive a tow notice with a clickable payment link, the only correct response is to ignore the link and verify independently.

Here is the short verification list that actually works.

Step 1. Go to where you parked. If the car is gone, look for a posted sign at the entrance to the lot that names the operator and lists a phone number. Use that number, not anything from a text.

Step 2. Call the non-emergency line of the local police department and ask which lot has your vehicle. The police will tell you the operator name, the lot address, and the hours. They will not text you a link.

Step 3. If you are not in your home city, search the city or county name plus 'impound lot' and confirm the lot through the official municipal website. A genuine .gov page is the only URL worth trusting for a release fee amount.

Step 4. Pay only at the lot, only by the methods the lot accepts, and only after you have your car in front of you. No legitimate operator demands payment by gift card, peer-to-peer app, or cryptocurrency. If the 'release fee' you are staring at asks for any of those, you are looking at a scam.

If you already paid the cap-tow text

Stop and assume the worst. Treat the card or app you used as compromised, because for the scammer's purposes, it is. The money may be small, but the card number, expiry, and CVV are now in someone else's hands, and that is the more valuable harvest.

Call your card issuer's number on the back of the card, not the number in the text, and report the charge as fraud. Ask for the card to be closed and reissued, and ask whether a chargeback is possible. For card payments, the chargeback window is typically 60 to 120 days from the statement date, depending on the network, and your issuer will walk you through the form. For peer-to-peer payments through Zelle, Venmo, or Cash App, the money is usually gone, and the recovery odds are bad, but report the payment in-app and ask the platform to freeze the recipient account.

Then report the text itself. Forward it to 7726, which routes to the GSMA spam reporting service used by US carriers, and file a complaint with the FTC at ReportFraud.ftc.gov. The FBI's Internet Crime Complaint Center at ic3.gov also accepts the same complaint, and it helps with the broader pattern, even when the dollar amount is small. A separate report to your state's attorney general is worth the five minutes if your state runs its own scam tracker, and many do.

Finally, watch your card statement for the next two billing cycles. A common follow-up move after a small fake charge is a second, larger one a few days later, or a series of small authorisations that are testing whether the card is still live. Report anything you did not authorise, and keep the case numbers from your card issuer, the FTC, and IC3 in a single note so you can reference them if the dispute escalates.

Why the cap-tow scam keeps working, and how to spot the next one

The cap-tow text works because it triggers a fast, emotional reaction in a moment of uncertainty. You parked somewhere questionable, or you forgot where you parked, and a text arrives that seems to explain the missing car. The amount is small, the wording is bureaucratic, and the link looks official enough. None of that is proof, and the proof is in the source, not the message.

Three habits kill most smishing attempts, including this one. First, treat every unsolicited text with a payment link as a scam by default, and verify through a channel you chose, not one the text gave you. Second, never reuse a card for a sketchy link, because a small scam is often a card-testing exercise. Third, keep your number off people-search sites where possible, since the partial plate trick relies on linking your phone to your car, and you can remove yourself from people-search sites in an afternoon.

Expect the cap-tow template to be back, with a different brand, a different amount, and a different domain. The underlying kit has been running for over a year and shows up as unpaid tolls, fake delivery fees, and DMV renewals on a rotating schedule. The defence is the same every time. Read the text, refuse the link, verify independently, and report. The five minutes you spend on verification is the cheapest insurance you will ever buy against a stolen card and a long Friday on hold with your bank.

This is general safety information, not legal advice. Scams change. If you need an official desk: FTC ReportFraud or IC3.