E-Z Pass is an American company that allows people to electronically pay tolls without having to carry change or come to a stop at toll booths. Instead, you have a device that you attach to the inside of your windshield that automatically pays tolls from a bank account or credit card when you pass through a special booth.

I saw a news article about E-Z Pass fraud that people did by stealing E-Z Passes out of cars and replacing them with fakes, but does anyone know how secure the devices’ protocols are? I’m imagining someone attacking the system with with a RFID reader/emitter walking through a parking lot and spoofing an E-Z Pass booth, allowing them to steal money from everyone in the parking lot.


I saw a news article about E-Z Pass fraud that people did by stealing E-Z Passes out of cars and replacing them with fakes, but does anyone know how secure the devices’ protocols are?

Let's assume you do clone the RFID tag. It certainly isn't tied to the payment information, as you change that through the web interface. It's tied to a toll-authority account and vehicle.

At least here E-Z pass is an RFID system and with OCR on the license plates, and high def camera shots on the face of the driver. You can run through it once every six months or year or whatever and they'll send you a nasty-gram. With a cloned tag, you could flip the plate by the time they'd catch you -- you'd be on your merry way. But, it's probably not worth it. From The Chronicle

Now, HCTRA has its own high-tech specialists. One uses software to analyze traffic and pinpoint the day of the week, time, lane and direction a frequent toll violator is likely to pass through. Another specialist spends part of her shift doing the equivalent of fingerprint analysis on the photos to track down car owners who have tried to mask their license plate numbers.

If you even take the tag to a second car, they know if the car's color make and model fails to match. I assume it gets Q/Aed if there is a color fail.

A better scam, if you want to skip the tolls, is to get an out of state dealer plate. Note these are not the temp dealer plates. They run up millions of dollars of unpaid of tolls every year. For reference you can see this mentioned here in 2012

  • state vehicle inspection, emissions inspection, and toll fees avoidance;
  • parking ticket fine avoidance (local level);

However, recently (2014) they've been cracking down on out-of-state plates, and I assume dealer plates are soon to follow

  • 1
    Thanks for the answer. I was thinking about this from the wrong point of view, and was thinking that the device in the car did the transaction. It makes way more sense for it to simply identify who went through, and let E-Z Pass handle the transaction entirely on their end. – Stella Biderman Nov 27 '17 at 0:07
  • I think you have a flaw in your logic re: stealing tags. The "high tech specialists" only kick into action if the toll is unpaid, using license plate analysis to track down the offenders. However, it is legal to move a transponder tag from vehicle to vehicle. This means that it is unlikely that they do a plate/transponder check for all transactions. A cloned pass would probably pay the fare, and thus they would not have a reason to check. – J Kimball May 24 at 20:22

I have no direct knowledge of EZPass' system details, other than being a customer. However, one can make a few observations and assumptions:

The device in your (my) car is an RFID device that when queried at a toll booth, responds with a "ID" code that is linked to both my EZpass account and my car. EZPass deducts the toll charge from my EZ Pass account. When the balance drops below a certain value, EZPass can charge my credit card or make a withdrawal from my bank account to replenish my EZPAss account.

The fraud is by stealing the RFID transponder, the criminals can evade tolls. They drive on the roads and you get the bill. That's the extent of the crime. Most people wouldn't notice that their transponder has been replaced, which gives the criminals time to rack up some charges.

Unless the criminals hack into EZPass' systems and steal their client database (certainly within the realm of possibility), there's no way to identify your bank account info. Knowing my transponder ID isn't very useful, other than to impersonate my car and drive on toll roads for "free."

  • I guess I was implicitly assuming that the device handles the transaction, but that doesn’t make sense. – Stella Biderman Nov 26 '17 at 23:53

I have a RFID reader. I find a car with EZ-Pass in a parkinglot. Just look above the rear view mirror. I get close to the windshield and now I make a clone of their ex-pass's RFID signal. I then get into my car and with my laptop, I'm able to transmit there signal to get thru the tunnel. 20 bucks saved on my end. I don't use the code more than once. On the way back, just find a shopping are. Plenty of EZ-pass people everywhere. Simple.

  • 3
    This is a dangerous game. If people notice the inaccurate charges and complain, they're going to start going back and looking at the license plate photos and corrolating your car with multiple fake EZ-Pass charges. You might get away with it, you might be facing crippling charges and fines, or they might just send you to jail. Not a path I'd recommend. – Xander May 23 at 23:35
  • 1
    I love when people think they can "game the system", but don't realize that they leave evidence all over the place. Always makes me chuckle. – MechMK1 May 24 at 8:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.