Strange toll scam emails appear to originate from Indiana email addresses

INDIANAPOLIS – Strange messages from email addresses belonging to the state of Indiana began arriving in inboxes late Monday night.

The messages, which appeared to originate from legitimate state email accounts, have flooded the newsroom inbox. They are clearly spam messages.

It was initially unclear if the vulnerability is related to the state itself or GovDelivery, a platform used by government agencies to manage emails. Many state agencies no longer use GovDelivery and have transitioned to a different platform.

There is some evidence the emails may be from holdover accounts, as the ones coming from the governor’s office still feature Gov. Eric Holcomb instead of Gov. Mike Braun, who took office in January.

However, officials from the Indiana Department of Technology said that a contractor’s account was hacked, which was used to send the messages.

Each email indicated the recipient had “unpaid toll charges.” While the amounts of the tolls varied, the emails urged the recipient to visit a certain website and make a payment to “avoid late fees.”

The emails carried a subject line of “TxTag Account Suspension Warning.” In recent months, toll-related scams have been on the rise via bogus text and email messages. Anyone who receives the email should ignore it and avoid clicking the link.

The emails originated from addresses associated with the state of Indiana. Some of the ones received so far include:

• Indiana Department of Revenue
• Indiana Department of Correction
• Indiana Department of Transportation
• Indiana Department of Education
• Governor of the State of Indiana
• Indiana State Comptroller
• Indiana Personnel Department
• Indiana Prosecuting Attorneys Council
• Indiana Family and Social Services Administration
• Indiana Department of Child Services
• Indiana Department of Health
• Indiana Department of Environmental Management
• Indiana Department of Insurance
• Indiana Emergency Operations Center
• Indiana Department of Natural Resources

In an official statement from the Indiana Office of Technology, they stressed that the messages are scams and urged users to not click on any of the links.

Officials said the state’s contract with the company that sent the messages ended on Dec. 31, 2024 but the company reportedly did not remove the state’s account. The statement read that a contractor’s account was hacked and used to send the messages.

“The State does not send unpaid toll notifications via text or email messages,” the statement read. “IOT is working with the company that was used to deliver those messages to stop any further communications.

“IOT is not aware of any current state systems being compromised,” the statement concluded.

The Indiana Supreme Court sent an email with the following information:

We are aware of a malicious email and/or text message being circulated from Indiana state agency GovDelivery accounts, including the Indiana Courts account. We no longer use GovDelivery to send email and texts. The message contains a hyperlink that is malicious in nature; do not click it.
Indiana Supreme Court