There is a fundamental difference between a text telling you your bank account has been frozen and one demanding €2.80 for an unpaid toll. The first sets off an alarm: it's big, it's serious, it's suspicious. The second sets off nothing at all. It's small, plausible, almost boring — and that is precisely why it has become, in 2026, one of the most profitable smishing campaigns in France.
"You used the A10 on 03/09 without a validated passage. Amount due: €2.80. Settle within 48 hrs to avoid a €90 surcharge."
Nobody panics reading that. You sigh. You assume your transponder didn't register. And you pay, because three euros aren't worth thirty minutes of investigation. Except the form isn't asking for three euros: it's asking for your card number, its expiry date, its security code, and often a code texted to you a few minutes later. At that point, it's no longer €2.80 walking out the door.
Why drivers attract so many campaigns
Drivers are an ideal target for one very simple reason: they legitimately receive a lot of short messages about their car. Toll transponder alerts, penalty notices, post-parking charges, roadworthiness test reminders, insurance notifications, charging points, parking apps. The SMS channel is already saturated with genuine, impersonal messages, which makes the fake one almost impossible to spot by reading alone.
Three factors specific to this period make matters worse.
Regulatory drift. Between the gradual disappearance of physical toll barriers on several motorway routes, the shift to free-flow tolling where you pay after driving through, and the widespread use of post-parking charges managed by private contractors, drivers no longer really know who has the right to demand money from them, or within what timeframe. Free-flow tolling in particular has created an unprecedented situation: a message asking you to pay a few days after a journey can be perfectly legitimate. Fraudsters piled into that gap from the first quarter of 2026 onward.
Data leaks. The databases circulating on parallel markets often contain far more than a phone number: name, postcode, sometimes vehicle make or partial registration. A message displaying "your vehicle registered XX-123-XX" becomes instantly credible, even though the scammer has never laid eyes on your car.
The small amount. This is the real innovation. A campaign demanding a €400 fine gets a low click rate and plenty of reports. A campaign demanding €2.80, €4.10 or €17.50 slips under the emotional radar and under the radar of bank anti-fraud services, which let micro-payments through without friction.
The four families of messages in circulation
1. The unpaid toll
This has been the most visible campaign since spring 2026, notably through the impersonation of well-known toll transponder brands such as Ulys, Bip&Go or Ulys/Vinci. The message mentions an unvalidated passage, a faulty transponder, or an unsettled free-flow journey. The amount is trivial, the surcharge threat is quantified and dated.
Telltale sign: the link never points to the operator's official domain. You'll find variants such as ulys-regularisation.com, peage-flux-libre.info, paiement-vinci-autoroutes.net. No French operator handles its payments on a parallel domain created the week before.
2. The fake ANTAI penalty notice
The Agence nationale de traitement automatisé des infractions (ANTAI) is the official body that issues penalty notices in France. It is impersonated on a massive scale. The text announces a speeding offence, an infraction caught by a camera, or an imminent increased fine.
The crucial point to remember: ANTAI does not send initial penalty notices by SMS. A penalty notice arrives by post at the address on the vehicle registration document, or in your personal account on the official site antai.gouv.fr. A text out of nowhere demanding payment of a fine you never received by post is, in the overwhelming majority of cases, a fraud. Cybermalveillance.gouv.fr regularly repeats this point in its smishing alerts.
3. The post-parking charge
Since paid parking was decriminalised, the well-known "FPS" charge has been managed by local councils or their contractors. It's a perfect playground for fraud, because the terms vary from one town to the next and few people know what a genuine notice actually looks like. The message refers to unpaid parking in a town you did in fact visit — sometimes by sheer probability, sometimes thanks to purchased data.
4. The reverse refund
A craftier variant: nothing is demanded of you, something is owed to you. "Following a billing error, a refund of €38.40 is due to you. Enter your bank details to receive it." The psychological mechanism flips: you're no longer afraid, you're pleased. And you hand over your bank details, or even a card number, to a complete stranger.
What the message is really after
You need to distinguish three objectives, because the right response isn't the same in each case.
| Objective | What the form asks for | Consequence |
|---|---|---|
| Direct payment | Bank card for a "small" amount | One-off debit, sometimes a hidden subscription |
| Card harvesting | Card + security code + validation code | Fraudulent purchases up to the card limit |
| Profiling | Name, address, registration, email | Resale and later targeted campaigns |
The third case is the most underestimated. A form that does not ask for money is not harmless: it fleshes out a record that will fuel a fake bank adviser scam two months later — one that costs far more.
The thirty-second check
The good news is that there's a simple method that works for all four families of messages, with no technical skill required.
1. Don't click on anything. No exceptions. The link is the attack's only entry point; as long as you don't open it, nothing happens.
2. Go through the official channel you already know. For a fine: antai.gouv.fr, typed by hand into the address bar. For a toll: your operator's app or website, the one where you opened your contract. For a parking charge: the council's official site. If the sum really is owed, it will show up in your personal account. If not, the message was fake.
3. Look at the amount and the deadline. Urgency quantified in 24 or 48 hours is a signature. The French administration works with deadlines of several weeks and with letters.
4. Check it against your actual life. Did you drive that route? Park in that town? A message referring to a motorway you've never taken disqualifies itself.
5. Report it. 33700 remains the national reporting system for fraudulent texts: forward the message to 33700, then send the sender's number when prompted. The service is free. Alongside that, the Signal Conso platform and the cybermalveillance.gouv.fr site catalogue ongoing campaigns.
General rule: it's never up to you to prove the message is fake. It's up to the message to prove it's genuine — and it can only prove that through a channel you chose yourself.
The special case of the driver on the road
Vigilance drops when you're travelling. You read the message at a motorway service area, between two legs of the journey, tired, with 12% battery. That is precisely the moment these campaigns target, concentrating their sends on Friday evenings, the start of holidays and major changeover weekends.
A few practical habits cut the risk more effectively than any abstract advice:
- Keep a properly fitted phone holder for your car so you never have to read a message in a rush or while driving: a text read while stopped is a text better assessed.
- Carry a power bank for your smartphone: a dead phone means you can't check anything on the official site, hence the temptation to "just settle it quickly" from the link you received.
- Store your vehicle documents — registration certificate, insurance certificate, accident report form — in a single car document wallet. When you know where your papers are, you can check a registration number in ten seconds instead of trusting the figure shown in the text.
None of this is spectacular, but the fake toll scam isn't won or lost on technology: it's won or lost in the five seconds when you decide whether or not to check.
If you've already clicked and paid
The mistake is common and there's nothing shameful about it. The only thing that matters is speed.
Within the hour: call your bank or block the card from its app. The interbank emergency number for card blocking is 0 892 705 705. Explicitly ask for the card to be blocked, not just for the debit to be disputed.
Within the day: change the passwords of any accounts sharing the email address used in the form, starting with the mailbox itself. If you passed on a code received by text, assume the associated account is compromised. A password manager — or failing that a paper password notebook kept out of sight — stops you recycling the same combination everywhere, which is exactly what fraudsters exploit next.
Within the week: file a complaint. An online preliminary complaint is possible on the Ministry of the Interior's website, but filing in person at a police station or gendarmerie remains more effective for obtaining a report your bank can actually use. Keep screenshots of the text, timestamps, the sender's number and the debit on your statement.
The law is on your side: Article L. 133-18 of the French Monetary and Financial Code provides for immediate reimbursement of an unauthorised payment transaction reported within the deadline. The bank can refuse by invoking gross negligence on the customer's part, but the Cour de cassation has repeatedly held, notably in rulings from 2023 and 2024, that merely passing on data following a fraudulent message impersonating an official body is not enough to constitute such gross negligence. If refused, refer the matter to the banking ombudsman, then to the Banque de France if necessary.
Reducing the attack surface upstream
You can't stop a scammer from sending a text, but you can reduce the odds of being targeted and, above all, the odds of taking the bait.
- Compartmentalise your contact details. Using a secondary email address to sign up for parking, charging or ride-sharing services limits how easily leaks can be cross-referenced.
- Turn on SMS spam filtering on your phone. Both Android and iOS offer filtering of unknown senders — imperfect, but useful.
- Never save your bank card in parking apps where it isn't essential. A single-use virtual card, offered by many banks, mechanically limits the damage.
- Warn those around you. The most exposed drivers are often those who use digital tools least and who, faced with a text mentioning a government body, prefer to pay "for peace of mind". An everyday cybersecurity guide left within reach in a household does more than a long lecture.
The takeaway
The fake toll or fine text wasn't designed to fool gullible people. It was designed to fool people in a hurry, over an amount small enough not to warrant a check. It's a volume scam: it doesn't earn much per victim, but it reaches hundreds of thousands of numbers with every wave.
Its weakness is constant and won't change: it needs you to click on its link. A government body never asks you to pay via a URL sent by message; it always leaves you the option of going to its official site yourself. The day that reflex becomes automatic — check elsewhere, never inside the message — the campaign collapses, however sophisticated it may be.
And if doubt lingers: a genuine notice can easily wait thirty minutes for verification. A scam can't. That's the whole difference.
