Skip to content

Inside a Toll Way RFID Tag

TxTagAEver wonder what is inside a toll way RFID tag? The windshield on one of our cars had to be replaced the other day and we removed the toll way RFID tag before taking the car to the shop so I could peek inside. I doctored the picture here so the registration number is not shown.

TxTagBackHere is the back side of the tag after it was removed from the windshield. You can see a layer of copper covered by a plastic adhesive. There was a noticeable bump on the front side of the tag so used an X-Acto knife to cut near the bump. I found that the front side was covered in a film of plastic that could be peeled away.

TxTagExposedThe picture to the right shows the RFID circuit exposed after peeling away the top layer of plastic. The tan-colored area shows the copper backing on the opposite side of the tag. White areas are not covered with copper on the back side. There is a small IC in the center area of the tag. The large copper area and the shorter traces on this side form the antenna. The IC is the only other component in the tag.

TxTagScanICUsing a flat bed scanner as described in a previous article, I did a high resolution scan of the chip as you can see in the last picture here. The chip is marked with two strings “4085” and “201F”. A Google search did not yield the details for this chip. I assume it is a custom part for TxTag.

Comments Please:

Let us know with a comment if you have any information on this chip. I do not want to do any hacking to get free toll access. I am just interested in the technology.

Posted in Discovering, Hacks.

10 Responses

Stay in touch with the conversation, subscribe to the RSS feed for comments on this post.

  1. Daniel says

    Thanks n5nwi explained it well.

  2. n5nwi says

    Active / Passive RFID Whitepaper:

  3. Florin says

    its true, i recently read an article about these things, and it appears that with the right amount of power you can read an RFID tag from a great distance.

  4. dfowler says


    We just drive though some readers without even slowing down using these tags. Berni is correct, this tag is powered up by the reader.

  5. Daniel says

    Thats what I thought. I have no idea why the ones in California are so large then and require power, must have more fuctionality. And or Range, We dont have to stop to get the toll taken, maybe they do for that one? It even contains a speaker, for a chirp sound.

  6. Berni says

    oh and to Daniel. This is a RFID tag it gets power trough radio waves. The reader trasmits a certan freaency strong enugh to power the tag and it starts transmiting what it has in its memory back trough radio.

  7. Berni says

    Nope i cant find any info about the thing.

  8. Daniel says

    Its strange yours is a sticker, Here in California we get a plastic box. No clue whats inside it. But it isnt particularly light, so it has some sort of AAA size battery inside and some hardware. When we need knew ones they require you send the old part back, else I would know what was inside it. How is that one powered?

  9. n5nwi says

    I believe that this is a 915 Mhz RFID tag manufactured by TransCore:

    The product information for this product:

  10. Kevin G. says the folks over at this website might want to peer into that chip for you. Check out some of the scans of this Atmel chip… . I also want to see into that RFID tag too. I love seeing how these things fuction.