Unpaid Toll Texts: Lookalike Payment Sites Worked to a Finding
In March 2024, drivers began receiving texts claiming they owed small amounts for unpaid tolls. Each linked to a site posing as the state’s toll service. This case follows the public record the way a brand protection team works it in Scout and Nexus.
The Question
Did the toll texts and the payment sites they linked to come from the toll agencies they named, or did they impersonate them?
Research used
People and location research are not part of this case. The question is about texts, domains and sites, not individuals or places.
The Records Behind the Case
Each record is listed with what it is and what it can support. Read the second column before the first impression hardens.
| ID | Record | Public record | What it supports |
|---|---|---|---|
| B01 | Scout content result | Posts from drivers in March 2024 sharing texts that demand payment of an unpaid toll balance. | A relevant starting record. A text alone does not show who sent it. |
| B02 | Government alert | The FBI reports more than 2,000 complaints since early March from at least three states. The texts use nearly identical language, and each link imitates the state’s toll service name.The Washington Times | The authority’s account of the campaign and its pattern. |
| B03 | Domain record | The FBI’s sample text claims a $12.51 balance with a $50 late fee and links to myturnpiketollservices[.]com.The Washington Times | A domain used in the texts. Registration alone does not show who runs it. |
| B04 | Agency warning | The Pennsylvania Turnpike warns customers. State police say the links lead to counterfeit websites built to take personal data.FOX 11 Los Angeles | A named toll agency and the police describe the sites as counterfeit. |
| B05 | Website capture | Payment pages built to look like a toll service. They show a logo, business details and the date of the supposed unpaid toll.TechRadar | What the sites ask a victim to do. |
How the Investigation Ran
Each step is chosen for a reason. The label on the right says whether it is a research step, an analyst judgment, or a monitoring decision.
This sequence illustrates the method. It is not a recording of product screens. A walkthrough shows the supported actions in your configuration.
-
Detect the Texts
MonitoringScout flags posts from drivers sharing toll payment texts and links.
A pattern of texts across states, each with a payment link.
Records: B01
- Domain Transforms
Run the Lookalike Domains
ResearchRun Domain Transforms on the reported names: registration date, DNS and hosting.
Each domain kept with its own record.
Records: B03
- Website Transforms
Read the Payment Sites
ResearchCapture what each live site shows and what it asks for.
Pages built to look like a toll service that take card and personal details.
Records: B05
- Web and Social Content Search
Track the Spread
AnalystSearch agency notices and posts state by state.
The same pattern appears under different agency names.
Records: B06
-
Take In the Agencies’ Statements
AnalystAdd what each agency says about how it contacts drivers.
The agencies say they do not text for personal information.
Records: B07
-
Define What to Watch
MonitoringWrite the brief for new domains, payment pages and complaints using the agency names.
A bounded Scout scope with a brand protection owner.
Records: B08
What Each Relationship Rests On
The status is the assessment in this case. It is written out in words, and the records behind it are named.
The Texts Impersonate State Toll Services
B02 and B04: the FBI and a named toll agency say so.
The Linked Sites Pose as the Toll Service to Take Payment and Personal Data
B02, B04 and B05: the alert, the state police and the captures.
One Group Sends Every Toll Text
B02 notes the pattern moving between states. No record names an operator.
The Toll Agencies Sent These Texts
B07: the agencies say they do not text for personal information.
Questions Asked in Case Chat
Case inquiry is useful when it helps the investigator examine these distinctions. Each answer is checked against the records.
Which domains have a capture or report behind them?
Check: The answer should list only domains with their own record.
Who is behind the texts?
Check: The answer should say the record does not name an operator and cite B02.
What should customers be told?
Check: The answer should cite B02 and B07: check the account on the official site, and the agency does not text for personal data.
What the Review Changed
First reading
Drivers in several states share texts about small unpaid tolls. The first impression is a billing error at one agency.
Later evidence
The FBI, a toll agency and state police describe impersonation. The pattern spreads under new agency names into 2025, and the agencies say they do not send these texts.
- B06 Government alert: The FTC warns in January 2025 that scammers are posing as toll agencies across the country.NBC Boston
- B07 Agency statements: New York says E-ZPass and Tolls by Mail do not send texts asking for personal information. Massachusetts, Pennsylvania, Georgia, Minnesota and Texas agencies issue similar warnings.Minnesota Spokesman-Recorder
- B08 Monitoring brief: Brief covering new domains that use toll agency names, payment pages and complaint posts.
What the Records Establish
Written from the cited public recordThe public record establishes that, from March 2024, texts impersonating state toll services sent drivers to payment sites posing as those services. The FBI received more than 2,000 complaints from at least three states by April. The FTC warned in January 2025 that the scheme had spread nationwide. The agencies named say they do not text drivers for personal information. Each malicious domain is established by its own capture or report. The record does not name who sends the texts.
Still unresolved
Who sends the texts, and which new domains will carry the next wave.
What Scout Monitors Next
The finding defines the monitoring scope. Background records and rejected candidates stay out of it.
The brief is written by the investigator. Setting up the monitor in Scout is a separate step.
Scout monitoring and content searchMonitoring brief
- Subjects
- New domains and payment pages that use toll agency names
- Change that matters
- A new domain going live, a new agency name in the texts, or a spike in complaints
- Scope
- The agency and its program names, for as long as the campaign runs
- Review owner
- The brand protection or fraud lead
Sources for This Case
Every record above summarizes one of these public sources. The steps show how a team would work the public record.
- FBI warns Americans about smishing text scam regarding unpaid tolls
The Washington Times, April 19, 2024
- FBI alert: SMS phishing scam targeting highway toll customers
FOX 11 Los Angeles, April 2024
- A massive SMS toll fee scam is sweeping the US
TechRadar, 2025
- Spam texts about unpaid tolls are on the rise
NBC Boston, 2025
- Toll scam: fraudulent text messages
Minnesota Spokesman-Recorder, March 6, 2025
More Investigation Examples
Paris 2024: Rail Sabotage Before the Opening Ceremony
Arson hit three high-speed lines hours before the Olympics opened. Follow the public record from the first cancellations to what is established, and what no one could yet say.
View the exampleKey Bridge Collapse: Who Stood Behind the Ship
A container ship lost power and brought down a bridge, closing a major port for eleven weeks. Follow the public record from the first reports to the owner, manager and charterer.
View the exampleSee This Workflow on Your Case
Bring a case like this one. We will work it with you in Nexus.