Unpaid toll text scams across the US (2024 to 2025)

Google's complaint describes a Data Broker Group inside the Lighthouse enterprise whose members supply targeted lists of potential victims' contact information, collected from public records, social media, and data breaches (paragraphs 52 to 54), rather than targeting known toll-account holders; the operators bet that enough recipients in any large batch are genuine toll-road users to make the lure land. Cisco Talos judged that multi-state targeting indicates the likely use of publicly leaked databases, while stating it has no evidence that the toll road smishing campaign was fueled by the National Public Data leaks.

Affiliates subscribe by the month to a commercial phishing-as-a-service platform sold through Telegram, which supplies ready-made toll-agency-branded website templates, rotating look-alike domains, and bulk messaging tools designed to evade carrier spam filters. Which platform depends on the period: Censys attributes the spring 2025 toll scams to Lucid, Cisco Talos attributes the wave it tracked from the middle of October 2024 to a kit built by a developer known publicly only by an online alias, and Google's November 2025 complaint describes Lighthouse, a brand that did not exist until March 2025.

The kit's bulk-messaging infrastructure sends near-identical 'you owe a small unpaid toll' texts to large numbers of phone numbers regardless of whether the recipient uses the impersonated toll system, using urgency language (late fee, suspension, collections) and a link or reply-to-unlock link, per FBI IC3 and Censys/Prodaft reporting.

The recipient, often a genuine toll-road user who finds the small dollar amount plausible, either follows a link carried in the message itself, which is how Cisco Talos described the messages it saw, or replies first to a message whose link is not live, a reply-gated variant Censys documented that withholds the live phishing link until after a reply and so dodges first-contact URL scanning. Both patterns were current in spring 2025 and neither source presents one as succeeding the other.

The victim lands on a look-alike toll-agency page and enters payment card details and, per FTC guidance, sometimes driver's license or Social Security numbers into a form designed purely to capture that data, with no real toll balance ever displayed by a legitimate agency system.

Per Google's civil complaint and Silent Push, a separate 'theft group' within the phishing-as-a-service ecosystem resells or directly uses the harvested card and personal data, completing the objective of payment-card fraud and identity-data theft without ever touching a real toll agency's systems.