Identifying a vehicle in a toll system includes accessing a set of toll transaction entries. Each entry in the set designates a toll transaction between a vehicle and the toll system and includes a transaction descriptor and a transaction time stamp. A series of toll transaction pictures is accessed. The series includes a plurality of pictures, each of which is associated with a picture time stamp. A toll transaction entry is identified from the set as a violation transaction entry based on the transaction descriptor. A toll transaction picture is selected from the series. The transaction time stamp of the violation transaction is compared, using a processing device, with the picture time stamp of the selected toll transaction picture. The selected toll transaction picture is identified as a violation picture corresponding to the violation transaction entry based on a result of the comparison.