Pennsylvania Warns of PennDOT Text Phishing Scam Threatening Drivers

A Wave of Fake PennDOT Texts Hit Pennsylvania Phones

On March 27, 2026, Governor Josh Shapiro's administration — flanked by the Pennsylvania Department of Transportation, the Pennsylvania State Police, and the Pennsylvania Turnpike Commission — issued a joint warning about text phishing scams sweeping the commonwealth1512. The fraudulent messages purport to come from PennDOT or a "Commonwealth of Pennsylvania Motor Vehicles (DMV)" office, threaten suspension of driving and vehicle registration privileges over an unpaid fine or toll violation, and push recipients toward a payment link124.

The timing of the alert was no accident. Local police departments, including Northampton Township, had begun posting their own warnings the same day as residents forwarded examples of the texts, and reports were spiking statewide12. One local outlet went as far as to offer a blunt rule of thumb: if you've received a text message from PennDOT recently, it is definitively a phishing scam, because PennDOT simply does not text its customers6.

What the Scam Texts Look Like

The messages are engineered to look official — and increasingly, they succeed. Some versions circulating in Pennsylvania carry state seals, formal legal language, and headers reading "FINAL COURT-ORDERED MANDATORY COLLECTION NOTICE," while others embed QR codes that route victims to payment portals designed to harvest financial information12. The guise varies: some texts impersonate PennDOT, some the Turnpike Commission's E-ZPass or Toll By Plate programs, and others lean on generic unpaid-toll language that has been recycled across the country313.

Cybersecurity analysts who dissected the scam waves found the fingerprints of industrial-scale fraud operations. The Cybersecurity Association of Pennsylvania examined sample texts originating from a Philippines-based phone number and pointing to a bogus domain with a ".win" extension rather than any legitimate ".gov" suffix, along with a fabricated statute citation that does not exist in Pennsylvania's administrative code11. The scammers even made the telltale amateur error of calling the agency a "DMV," a name Pennsylvania does not use1113.

Those details matter because the campaign is anything but amateur in aggregate. The FBI's Internet Crime Complaint Center first flagged a national surge in toll-related "smishing" in 2024, and by early 2025 had logged more than 2,000 complaints, with the scheme migrating state to state and using near-identical language171820. Palo Alto Networks reported that a single threat actor had registered more than 10,000 domains for these scams, impersonating toll services and package delivery companies in at least ten states plus Ontario1819.

The Identity Theft Angle: Why a Fake Toll Bill Is Dangerous

The money demanded in these texts is usually trivial — a few dollars for an "outstanding toll" plus a late fee — but the real product being harvested is personal data. State officials were explicit that clicking the links hands scammers personal and financial information they can use to steal a victim's identity or drain their accounts36. The FTC has made the same point nationally: a toll scam text isn't just after your money; the link can yield your driver's license number and enough personal detail to open fraudulent accounts in your name1720.

The delivery mechanism compounds the risk. Apple disables links in messages from unknown senders by default, so scammers ask recipients to reply "Y" to unlock the message — a seemingly innocent step that both re-enables the malicious link and confirms the number is live1718. QR codes carry the same risk as embedded URLs, with the added disadvantage that the destination is harder to preview before visiting12.

This fits a broader pattern of Pennsylvania officials chasing impersonation scams across 2026. Attorney General Dave Sunday warned in February about texts mimicking Philadelphia Municipal Court over unpaid parking tickets, again with threats of license suspension916. In June, Chief Justice Debra Todd's office had to warn the public about texts spoofing the state Supreme Court itself, demanding PayPal payments to fix an "incomplete court filing"1415. Read together, the scams share one playbook: borrow the credibility of a government institution, invent a debt, manufacture urgency, and route the victim to a payment page. As Sunday put it in February, scammers "rely on fear, urgency, and embarrassment to pressure people into acting quickly"9.

The Ground Truth: How Pennsylvania Agencies Actually Communicate

The administration's warning rests on a simple, memorable fact: PennDOT does not send text messages to customers for any reason, and uses traditional U.S. Postal Service mail for all official correspondence about licenses, registrations, fines, and violations145. "If you receive a text message notice from a sender claiming to be from PennDOT who is threatening to suspend your license or registration privilege, do not click on any links and just delete the message," said Kara Templeton, PennDOT's Deputy Secretary for Driver and Vehicle Services. "These messages are not from PennDOT"12.

The Turnpike Commission issued the parallel assurance: it does not text E-ZPass or Toll By Plate customers, and any link in such a message is unconnected to the agency's systems35. Customers who want to check a real account should use only the official PA Turnpike E-ZPass website or the PA Toll Pay app from the Apple and Google app stores512.

State Police Acting Commissioner Lt. Col. George L. Bivens framed the threat in appropriately stark terms, noting that "malicious actors are becoming increasingly sophisticated in their attempts to exploit Pennsylvanians" and that these messages are "designed to create a sense of urgency to steal personal or financial information"2612.

What Officials Say to Do

The guidance from the PSP and the joint announcement is consistent across sources5[6]:

• Never share personal, banking, or credit card details over text or email.
• Treat unexpected messages from any government agency with skepticism, even ones that look legitimate.
• Don't click links or reply to messages you weren't expecting; look up the agency's real customer service number and call directly.
• Delete the message and report it as spam or junk through your phone or email provider.

On the technical side, iPhone users on iOS 16 or later can enable "Filter Unknown Senders," which quarantines texts from unsaved numbers and auto-disables their links, while Android users can switch on spam protection in Google Messages; suspicious texts can also be forwarded to 7726 ("SPAM"), a carrier-backed shortcode that feeds reporting into network-level filters12. Experts caution against replying at all — even "STOP" tells a scammer your number is active12.

If You Already Clicked

For victims who entered payment or personal details, the remediation path is time-sensitive. The FTC recommends immediately contacting your bank or card issuer to dispute charges and freeze or cancel the card; anyone who typed in a Social Security number or other sensitive data can generate a personalized recovery plan at IdentityTheft.gov; and placing a fraud alert or credit freeze with Equifax, Experian, and TransUnion can block new-account fraud in a victim's name12. Changing passwords on any accounts that shared credentials with the fraudulent site is also advised12.

Reporting channels run in parallel: contact PennDOT Driver and Vehicle Services at 717-412-5300 about suspicious driving-record messages14; file a complaint with the FTC at reportfraud.ftc.gov and with local law enforcement24; and submit complaints, including copies of the messages, to the Pennsylvania Attorney General's Bureau of Consumer Protection at 1-800-441-2555912. The FBI separately asks recipients of toll-smishing texts to file with IC3 at ic3.gov1718.

The Read: This Is a Test of Digital Trust, and Governments Are Losing by Default

Pennsylvania's joint warning is a rare piece of good news — three state agencies speaking with one voice to establish a verifiable ground truth about how government does and does not communicate. That clarity is the only real defense against a scam whose entire power comes from impersonation. But the deeper problem is structural: as courts, tolling agencies, and DMVs nationwide have moved customers toward digital payments, every text about money now plausibly seems official. The FBI's toll-smishing numbers, the 10,000-domain fraud infrastructure, and the string of Pennsylvania impersonation alerts — courts, tolls, DOTs — all point to one conclusion: attackers have industrialized the trust that citizens place in a ".gov"-shaped message, and they will keep recycling the same urgency-fraud playbook until consumers internalize the rule that Pennsylvania officials are now shouting. No legitimate agency will ever demand payment or personal data by unsolicited text. The scam text isn't a nuisance to delete; it's a reconnaissance probe for identity theft, and the only winning response is the one the state keeps repeating: don't click, don't reply, delete.