Last year, we wrote about the explosion of toll scam texts flooding phones across the country – fake messages impersonating E-ZPass, SunPass, and other toll agencies and DMVs, designed to steal your payment information and identity.
These messages followed a familiar formula: a wall of text claiming you owe a payment for an outstanding toll or traffic violation, paired with threats of massive fines and suspensions, and ending with pressure to pay immediately through a suspicious-looking link. Annoying, but easy to spot once you knew what to look for.
That scam campaign never stopped, but it has evolved. Scammers have recently retooled their approach. The new version is more convincing at a glance and specifically designed to slip past spam filters.
What’s New With Toll Scams
If you haven’t read our original article on the toll scam text epidemic, you can find it here. It breaks down how these scams work, what happens when you click the link and make a payment, and how scammers steal your information.
The new version of this scam follows the same playbook, but with one major change – it ditches written text entirely. Instead of sending a typed-out message with a link, scammers are sending an image with a message instead. These images are designed to look like official documents or notices from your state DMV or a local court (often based on your area code), claiming that you have an outstanding toll, parking ticket, or traffic violation.
If you haven’t seen this yet, take a look at some examples submitted below:
Compared to the toll scams from before, which often threatened some sort of legal penalties for not paying a toll, these go a step further. Many of the scams that have been submitted to our investigation team included case numbers, legal statute references, hearing dates, physical addresses of real agencies or courts, courthouse phone numbers (sometimes just a single digit off the real number), and official-looking state seals, all signed by a judge or court clerk.
Most importantly, they often include a link or QR code at the bottom with instructions to scan it to settle your “unpaid balance.”
Every single one of these “documents” is completely fake.
Why Scammers Switched to Images
You might be wondering why scammers switched gears and moved from typed messages to images. The change isn’t simply cosmetic – it has to do with how spam filtering works.
Most spam filters are designed to scan text. They look for suspicious keywords, links, and sender information. Some phones even prevent you from clicking on links from unknown senders. But, spam filters can’t always easily read what is inside a picture file. The QR code or suspicious link is baked into the image, making it invisible to the filters.
It’s a simple workaround, but it’s working. These messages are getting through in large numbers. Functionally, the scam message serves the exact same purpose - scan the QR code or click a link and get taken to a fraudulent payment page designed to steal your card information and personal details. QR codes are just harder to evaluate at a glance - they tell you nothing about where they are going to take you, and that’s what makes them so dangerous.
To keep yourself safe, follow a simple rule: don’t trust QR codes. If you receive a QR code in an unsolicited message, treat it the same way you would a link – if you didn’t ask for it or weren’t expecting it, don’t scan it.
A quick note on the logistics: If you receive one of these images on your phone, scanning the QR code from the same device isn’t always convenient. Not all phones can scan QR codes directly from an image. You might need to scan it from a second device or send the image elsewhere to scan. Scammers likely aren’t losing sleep over this. They just need a small percentage of people to follow through - at the scale of these scams, it’s more than enough.
A Cleaner Look, Built to Deceive
One of the things our investigation team noticed about this new wave of scams is the improved presentation. Overall, they just feel a little bit more polished. Details in the image, like the legal statute references and overall formatting, can make it feel more credible to potential victims.
The payment pages themselves are clean, professional-looking and generally well-formatted. While previous toll scams sometimes mimicked the look and branding of real toll agencies, these new pages often have a more modern but generic look. In many cases, the overall look, just like with the texted images themselves, suggests a level of automation or AI-assisted generation.
That said, the production quality isn't perfect, and when we looked a bit closer, the cracks still show. Links and buttons (aside from the ones associated with the payment flow) usually don’t work and the website URL looks off. The notice may reference the wrong state, use a generic judge’s name, use a fake-looking digital signature, and come from a weird phone number.
Casting a Wide Net
Perhaps the most telling scam sign of all – the fake document and website likely won’t have your name anywhere on it. Scammers don’t have time for that (yet). That's because, in most cases, the scam is not targeted at you specifically. The same image is being sent to thousands of phone numbers at once. They may use your area code to impersonate a court near you, but scammers have no idea who you are. For them, it’s a numbers game – blast a generic message out to thousands of people in the hope that at least a couple of people will scan it and pay.
One thing has stayed the same: the urgency is still cranked up to eleven in a way that the real government, courts, and toll agencies don't actually operate. Real communication from these institutions is sent via paper mail, not QR codes in text messages.
What to Watch For
The message arrives as an image file
It looks like a document coming from a court, state DMV, or toll agency
It includes a QR code or link to pay
The language is urgent (final notice, immediate action required)
It threatens serious consequences (license suspension, fines, court orders, collections)
You haven’t received any prior paper notice or any communication from official agencies through the mail
The sender is unknown, or the message arrives from a random number or email address
How to Protect Yourself
Check the sender. Toll authorities, courts, and government agencies do not resolve legal or financial matters through out-of-the-blue text messages. If there is a real issue, you will receive a physical notice sent through the mail. If in doubt, call the agency directly using a number from their official website, not one listed in the suspicious message.
Don’t click links or scan QR codes. If you receive a communication from an agency, go directly to their official website (not through links or QR codes in the message) to check for any unpaid fees.
Never reply to suspicious messages. That includes simple responses like “STOP” which can confirm to scammers that your number is active. Forward them to 7726 (SPAM), block the sender, and delete the message.
Watch for urgent language. Toll scams try to create a sense of urgency with alarming language and threats if you don’t comply. Real toll agencies do not threaten or pressure you like this.
Just like before, scammers are counting on you speeding past the red flags of these toll & parking violation scams so they can steal your money and even your identity. But now that you know what to look for, you’ve already taken away some of their power. If you get a text about a toll charge or some other violation, remember:
It’s not real.
Don’t be tempted to scan the QR code or visit the link.
Block the sender and delete the message.
Then go one step further: talk about it. Tell your friends, family, neighbors, and coworkers. These scam campaigns are enormous, and the more people who know what to look for, the fewer victims they will find. Share this information with your family, especially anyone who might be less familiar with how these scams work. One quick conversation could be the roadblock to stopping someone from getting scammed.
- The Seraph Secure Team
