The message arrived at twenty to seven on a Tuesday evening. An unpaid toll of 6.94 dollars, a late fee starting Friday, and a link. The name of the state toll operator was spelled correctly. The amount was plausible and small enough that nobody would ring a call centre over it. The one thing in the message that could have settled the question was the web address, and the address was a run of words that had never appeared on any letter, sign, or bill.
That is the whole modern problem of public information in one notification. A resident is asked to decide, in about four seconds, whether a demand for money comes from a public body. Everything that used to help with that decision is gone. There is no letterhead, no franked envelope, no counter with a person behind it. What is left is a string of characters that most of us were never taught to read, on a screen that has quietly stopped showing us all of it.
Two thousand complaints in five weeks
The toll message is not a local nuisance. The FBI's Internet Crime Complaint Center published a public service announcement on 12 April 2024 reporting more than 2,000 complaints about smishing texts claiming a debt to road toll services, all of them received since early March that year, spread across at least three states.
Two details in that notice are the interesting ones. The wording of the messages was almost identical between states, and the link in each one was built to impersonate the name of that particular state's toll service. Somebody had industrialised the observation that Americans cannot tell a real transport agency web address from a fake one, then localised it. The phone numbers moved from state to state as the campaign travelled.
An operation like that only pays if the underlying confusion is reliable. It is. Toll authorities, transit agencies, courts, and utilities have spent two decades publishing themselves under whatever web names their communications departments liked, which means residents have no stable pattern to compare against.
A name you have to prove you deserve
There is one part of the internet where the confusion was solved on purpose. A .gov name cannot be bought. CISA, which took over administration of the space from the General Services Administration under the DOTGOV Act passed at the end of 2020, verifies the identity and government status of every applicant, and only federal, state, local, tribal and territorial bodies in the United States qualify. Since 2021 it has cost the applicant nothing.
That combination is unusual and worth understanding. The name is not a brand, a claim, or a design choice. It is an assertion about identity that somebody checked, backed by a registry that refuses everybody else. No encryption certificate, padlock, official-looking crest or reassuring paragraph carries the same weight, because all of those are available to anybody with a card.
Sixteen thousand names against ninety thousand governments
CISA also publishes the whole list, which makes the coverage question answerable rather than rhetorical. The registry data it maintains in the open held 16,630 names when this was written, split roughly like this.
| Registered .gov names by type | Count |
|---|---|
| City, including election sites | 9,372 |
| County, including election sites | 2,946 |
| State or territory | 1,447 |
| Special district | 1,146 |
| Tribal | 291 |
| School district | 65 |
Now set that beside the country being governed. The Census Bureau's 2022 Census of Governments counted 90,837 local governments, among them 3,031 counties and 35,705 general purpose governments below county level, which is to say 19,491 municipalities and 16,214 towns and townships. Counties have largely arrived. The layer of government that actually sends people bills, notices, permits and court dates, the city and the township, is mostly still somewhere else, on names indistinguishable from a fake.
School districts are the sharpest illustration. Sixty-five registered names, in a country with thousands of districts, all of them sending messages to parents about closures, transport, and money.
Why a town ends up on a dot com
The reasons are mundane, which is why they persist. A small town's website came bundled with a vendor package in 2009, on a name the vendor picked. Somebody in economic development wanted something memorable for tourism. The clerk who set it up has retired and nobody remembers the registrar login. Moving a name means redirecting old links, reissuing hundreds of staff email addresses, and updating printed material, which is real work with no visible payoff in the year it is done.
So the cost lands somewhere else, on the resident deciding whether a text about a permit is genuine. This is the ordinary shape of these problems, the same arithmetic that makes a default nobody chose so powerful: a modest one-time expense inside an institution, avoided, becomes a small recurring tax on thousands of people outside it.
Only eleven percent read the padlock right
Meanwhile the browser withdrew from the argument. For thirty years a padlock in the address bar was the public's shorthand for a safe website, and it never meant that. It meant the connection was encrypted, nothing whatsoever about who was on the other end.
Google finally said so out loud. In a post published on 2 May 2023 the Chrome team reported that its 2021 research found only 11 percent of participants correctly understood what the lock icon meant, noted that nearly all phishing sites use encryption and therefore display it too, and replaced the padlock with a neutral icon for site settings. The reasoning was sound. The effect on a resident staring at a toll message is that one more familiar cue has gone, and the only signal left is the name itself.
Reading an address before you pay it
The skill involved is small and nobody teaches it. An address is read from the last dot before the first slash, backwards. Everything to the left of that can be invented, which is why a convincing agency name early in the string means nothing at all.
- Find the final part of the name before the first single slash. That is who you are dealing with. Words placed before it are decoration.
- Treat any unexpected demand for money as a reason to leave the message entirely. Search the agency name, or use the number printed on an old bill, and start again from there.
- Do not read the padlock as a verdict about who owns a site. It reports the connection only.
- Check whether your own town, school district and transit agency publish on .gov. If they do not, that is a question for a council or board meeting, and the registration is free.
- Report the message to the complaint centre at ic3.gov, which is how the pattern in that April 2024 notice became visible in the first place.
- Tell one older relative the read-it-backwards trick. It travels better in conversation than in a leaflet.
None of this puts the burden where it belongs. A resident should not have to parse a domain name to find out whether their county wants 6.94 dollars. The fix is boring and available: a verified name, free to register, printed on every notice a public body sends, until the address bar means something again.