DMV

DMV Toll road text message

Adam

21 Jan 2026 • 8 min read

I just received the following text message to my phone number. Can you tell me if this is legitimate or not or a scam or what not I would find it disturbing to believe that toll roads get so nasty and threatening like this:

Wе hereby cоnfirm that we have reϲeived the offiсial nοtification from the Cоlorado Department of Motоr Vehicles (DMV), stating that thе fine will comе into effect on January 22nd.

Οur records show that as оf tоday, there is stіll an outstandіng traffic fine on yоur acϲount. According to Cоlorado Αdministrative Code 16C-16.003, іf thiѕ fine is nоt рaid by Januаry 22, 2026, we will takе the fοllowing enforcеment measures:

1.Үоur violation reϲord wіll be reported to the ѕtate DMV violatiоn database.
2. Тhе registration of your vehiсle will bе suspended starting from Januаry 22nd.
3. Үоur drivіng license will be temporarily suspended for 30 dаys.
4. We wіll chargе a 35% ѕervice fee. Үou сan make the payment at thе designated location.
5. Үоu may be ѕubject tο legal рroceedings, and your credit ratіng may be adversеly affected.

Рlеase make thе payment оf the fine іmmediately via the fоllowing:
https://expresstoll.dmv-rat.cc/dmv/?pSz=fn3Vd?DqH=5RoIB

Τо avoid hаving your drіver's license revοked or facing other lеgal consequenϲes, we strongly reсommend that you pay thе fіne before the effectivе date of thе penalty.

ChatGPT said:

Thought for 16s

This is almost certainly a scam (smishing) — and Colorado agencies have been warning about exactly this kind of message.

Why it’s a scam (red flags in your text)

The link domain is fake: dmv-rat.cc is not a Colorado government domain (.gov) and not the real ExpressToll site. The real ExpressToll site is expresstoll.com.
Colorado DMV says they don’t send texts like this demanding payment or threatening suspension/prosecution via unsolicited messages.
Colorado Express Lanes/ExpressToll warns that texts asking you to pay tolls/violations are scams.
The wording matches a known pattern the FTC called out: threats about “DMV violation database,” registration/license suspension, 35% “service fee,” credit score/legal action, and a payment link.
The message uses weird characters (look-alike letters) in words like “We,” “confirm,” etc. Scammers do this to bypass carrier spam filters.

What to do right now

Do not click the link (and don’t reply).
Delete the message and block the number.
Report it as junk/spam in your Messages app.
- On many carriers you can also forward the text to 7726 (SPAM).
If you’re worried you might truly owe something: manually type the official site into your browser (don’t use the text link) and check there:
- ExpressToll: expresstoll.com
- For “license plate toll” billing in Colorado, it’s typically handled via mailed notices (not scary DMV-text threats).

If you already clicked the link

If you didn’t enter info: close it, clear your browser history/site data, and you’re probably fine.
If you entered card/bank info: contact your bank/card issuer immediately, freeze/replace the card, and watch transactions.
If you entered personal info (license, DOB, etc.): consider placing a fraud alert with the credit bureaus and monitor your credit.

If you tell me whether you clicked it and whether you’re currently living/registered in Colorado or another state, I’ll tell you the fastest official way to verify any real outstanding toll/traffic balance without touching scam links.

You said:

Create a Pinterest style infographic for my blog about this subject

ChatGPT said:

Image created

You said:

🤷‍♂️ Why are the authorities not making big efforts to apprehend and prosecute such serious financial crimes such at this? I consider this to be a major crime. The people need to be prosecuted to the fullest extent of the law. It can't be that hard to find them 🕵 I would think the FBI and Interpol would easily be able to find and arrest them 👮 🚔 ⚖️ 🏛️ 👨🏻‍⚖️ 📜 |||👤|||

ChatGPT said:

Thought for 14s

You’re not wrong to call it a major crime. The frustrating part is: it’s “major” in impact, but it’s also massively scaled and engineered to be hard to pin on a person. A few reasons it often looks like nobody’s doing anything:

Why it’s not “easy to find them”

Attribution is hard. The link you saw (dmv-rat.cc) is just a disposable domain. The people behind it can rotate domains, servers, and phone numbers daily, often using stolen identities and rented infrastructure.
Jurisdiction is messy. A lot of these crews operate overseas (or spread across multiple countries). That means subpoenas, mutual legal assistance treaties, translations, and slow cross-border evidence chains.
Interpol doesn’t “kick doors.” Interpol mainly coordinates and shares intelligence between countries. Arrest power comes from national/local agencies, and cross-border action usually needs extradition agreements and enough evidence.
They use “mules.” The folks receiving money are often intermediaries—money mules, fake businesses, crypto wallets—so investigators have to unwind layers before they reach organizers.
Volume forces triage. Agencies get millions of fraud reports. They tend to prioritize cases with big losses, repeat infrastructure, identifiable suspects, or links to organized crime.

What law enforcement actually does (but you don’t see)

Taking down infrastructure (domains, hosting, SMS gateways).
Working with banks/carriers to identify patterns and mule networks.
Building longer investigations to catch organizers (which can take months/years).
Using international task forces when the same group hits many states/countries.

The most practical way to help them catch people

The single best thing you can do is file reports that connect your incident to others (that’s how patterns turn into cases):

FBI IC3 report (internet crime): include the full text + the full URL + date/time + phone number it came from.
FTC report (consumer fraud) and/or your state Attorney General.
Forward the text to 7726 (SPAM) (helps carriers flag the sender routes).
Report the domain to:
- the domain registrar (WHOIS lookup will show it)
- the hosting provider (often listed in WHOIS/ASN)
- Google Safe Browsing / Microsoft SmartScreen (helps browsers block it faster)

Reality check (and the good news)

It can be hard to find them quickly — but reports absolutely matter because these scams are pattern-driven. The more people report the same domain/wording/payment flow, the more likely it gets prioritized and disrupted.

If you want, paste just the domain (not the full link) and the phone number it came from and I’ll tell you the best places to report that specific domain and what details to include so your report is maximally useful.

You said:

This is the domain and full URL:
https://expresstoll.dmv-rat.cc/dmv/?pSz=fn3Vd?DqH=5RoIB

This is the phone number the scam text came from:
+1-657-258-8349

Please provide links and draft a message to report this to the proper authorities. I don't let people get away with 💩

ChatGPT said:

Thought for 3m 42s

Yeah — that text is a scam (“smishing”). Colorado’s transportation office has explicitly warned that Express Lane / ExpressToll payments are never collected via text message, and they instruct people to file a complaint with the FBI’s IC3 and include the sender number + the website in the text.

Why it’s not “easy” for authorities to catch them

Because these crews rotate domains, hosts, SMS routes, and stolen infrastructure constantly, often across borders. CDOT even notes the messages are originating outside of CDOT/CTIO, which is why the state can’t simply “stop distribution,” and why cases get routed through federal intake (IC3) and partner agencies.
The fastest wins usually come from: (1) lots of victim reports (signal), (2) domain/hosting takedowns (disruption), (3) payment rail tracing (follow the money).

Report it (links)

Put these in your blog post and use them yourself. (I’m listing the scam URL de-fanged so nobody clicks it by accident.)

FBI (IC3) — Internet Crime Complaint Center (complaint form):
https://complaint.ic3.gov/

FTC — ReportFraud (scams & fraud):
https://reportfraud.ftc.gov/

FCC — Unwanted texts/spoofing complaint form:
https://consumercomplaints.fcc.gov/hc/en-us/requests/new?ticket_form_id=39744

Colorado Attorney General — File a consumer complaint:
https://coag.gov/file-complaint/
(Stop Fraud Colorado hub + “File a complaint” button):
https://stopfraudcolorado.gov/

ICANN Lookup (to find the domain registrar + abuse contact):
https://lookup.icann.org/

Optional (helps get the site flagged):
Microsoft “Report unsafe site” (phishing):
https://www.microsoft.com/en-us/wdsi/support/report-unsafe-site-guest

Sources: IC3 complaint form , FTC reporting + guidance , FCC complaint form , CO AG complaint , StopFraudCO , ICANN lookup , Microsoft unsafe-site report

Also do these quick actions (takes 60 seconds)

Report it in iPhone Messages (if it shows “Report Junk/Spam”, use it).
Forward the scam text to 7726 (SPAM) (this goes to your wireless provider).
Do not click. If you did click or entered info, CDOT advises securing accounts + disputing unfamiliar charges.

Copy/paste “master report” message (use for IC3 / FTC / FCC / CO AG)

Replace the bracketed parts, then paste into the “Description / Details” box.

Subject: Smishing scam impersonating Colorado DMV/ExpressToll — phishing payment link

I received a fraudulent SMS demanding payment of an “outstanding traffic/toll fine” and threatening license/registration suspension. The message appears to impersonate Colorado DMV / ExpressToll and directs victims to a phishing website.

Date/time received: [YYYY-MM-DD HH:MM + time zone]
My location (optional): [City, State]

Sender phone number shown: +1-657-258-8349
Phishing URL (exact): https://expresstoll.dmv-rat.cc/dmv/?pSz=fn3Vd?DqH=5RoIB
(If you prefer non-clickable: hxxps://expresstoll.dmv-rat.cc/dmv/?pSz=fn3Vd?DqH=5RoIB)

Summary of content:
- Claims an outstanding “traffic fine” and cites a Colorado Administrative Code section
- Threatens DMV reporting, registration suspension, license suspension, added “35% service fee,” legal action, and credit impact
- Urges immediate payment through the link above
- Message uses unusual characters (lookalike letters) and a non-official domain

I did NOT click the link and did not provide any personal or payment information. [Edit if different]
Evidence available: screenshot of the text, full text copy, and the URL.

For IC3 specifically, CDOT recommends including the phone number and the website listed in the text, which the template already includes.

Domain takedown: report to the registrar/host (template)

Go to ICANN Lookup and search dmv-rat.cc to find the Registrar Abuse Contact Email.
Email that abuse contact:

Subject: Phishing / SMS scam domain – expresstoll.dmv-rat.cc

Hello Abuse Team,

I’m reporting a phishing/smishing campaign using your customer’s domain/subdomain:

Domain: dmv-rat.cc
URL used: https://expresstoll.dmv-rat.cc/dmv/?pSz=fn3Vd?DqH=5RoIB

This URL is being distributed by SMS to impersonate Colorado DMV/ExpressToll and solicit fraudulent “fine” payments, threatening license/registration suspension. Sender number shown: +1-657-258-8349 (may be spoofed).

Please investigate and suspend the domain/subdomain and any associated hosting content for phishing.

Evidence: I can provide screenshots of the SMS and full message content upon request.

Thank you,
[Your name]
[City/State]
[Email]