# "Unpaid toll, plate AB-123-CD": the free-flow toll text scam on barrier-free motorways

> Free-flow motorways, with no toll barriers, have created a perfect blind spot for scammers. A breakdown of a fake unpaid-toll text message that quotes your licence plate, plus a three-minute method to check it.

- Source: https://www.envoyer-sms-gratuit.com/en/blog/2026-09-22/arnaque-sms-peage-flux-libre-a13-amende-plaque
- Published: 2026-09-22 (22 September 2026)
- Author: L'équipe Envoyer SMS Gratuit
- Language: en
- Categories: Guide
- Tags: Cybersécurité, Guide, SMS, France 2026, Smartphone, Protection des données

---
"FREE FLOW TOLL: journey of 14/09 unpaid, vehicle AB-123-CD. Amount due: 4.20 EUR. Settle within 72h to avoid a 90 EUR surcharge: https://peage-fluxlibre-regul.com"

You did indeed take the motorway that weekend. The plate is yours. The amount is trivial — four euros twenty, less than a sandwich at a service station. The surcharge being threatened, on the other hand, is anything but.

That is the whole genius of this scam: it doesn't ask you to believe an implausible story. It asks you to pay a small sum that you may genuinely owe. And since you're no longer entirely sure you settled that journey, the cheapest solution in terms of time and anxiety seems to be reaching for your bank card.

![Hand holding a smartphone displaying a white screen with the handwritten text "enjoy it all"](/images/blog/2026-09-22-arnaque-sms-peage-flux-libre-a13-amende-plaque/hero.jpg)

## Free flow: a road revolution that opened a loophole

For fifty years, paying to use a French motorway meant one thing: slowing down, stopping at a barrier, handing over a card or driving under an electronic toll tag reader, and moving on. Payment was **synchronous** with the journey. You knew, to the second, that it was settled.

Free-flow tolling — sometimes called *free flow* — removes the barrier. Camera-equipped gantries read your licence plate at 130 kph, identify your toll tag if you have one, and let you carry on. Payment comes **afterwards**. If you don't have a tag, you have to log on to the operator's website to pay for your journey, usually within a few days (72 hours on the A79, up to ten days on other routes depending on the operator).

The system has been in place since 2022 on the A79 in the Allier department, then progressively on the A13 and A14 operated by Sanef, on sections of the A69 and across several projects under way. The French Ministry for Ecological Transition and the Autorité de régulation des transports (ART) are supporting this transformation, presented — rightly — as a gain in traffic flow, safety and fuel consumption.

But from a scammer's point of view, free flow delivers three gifts at once:

- **A time lag.** You drive on Saturday, the text arrives on Wednesday. That delay is *normal* in the real system, so it sets off no alarm bells.
- **Structural uncertainty.** Did you pay for that journey? On which site? With which card? Many drivers honestly can't remember.
- **Tiny amounts.** A journey often costs between 2 and 8 euros. Nobody disputes a €4.20 bill. You pay and move on.

Add a fourth ingredient, which has nothing technical about it: official communication around free flow has accustomed drivers to receiving reminders by text and email. So the scam isn't imitating some exotic channel. It's imitating a channel you were expecting.

## How scammers know your licence plate

This is the question that tips victims over: "They've got my plate, so it must be official."

No. There are at least four perfectly mundane ways for a plate number to land in a scammer's database.

**It's written on your car.** The dumbest and most effective route. A licence plate is, by design, public data permanently displayed outside your vehicle. An accomplice photographing plates in a supermarket car park or a car-sharing pick-up area collects several hundred an hour.

**It circulates in data breaches.** Used-car sales sites, car insurance comparison services, roadworthiness-test platforms, parking apps, fuel cards: all of them handle plate + phone number pairings. The CNIL and Cybermalveillance.gouv.fr regularly document data breaches affecting mobility players.

**It's guessed.** The French SIV format (two letters, three digits, two letters) is sequential. A scammer who knows the region and the approximate year of registration can generate plausible plates in bulk. Out of 100,000 texts sent with fabricated plates, only a handful need to land correctly — the other recipients just shrug.

**It comes from you.** Some campaigns first send a generic text ("an unpaid journey is associated with your number, confirm your plate") and use the reply to make the second message credible.

> A correct licence plate in a text message is not proof of authenticity. At best it's a clue that the sender bought a database — something a motorway operator never does.

## Anatomy of the fake text: the seven signals

Let's go back to the opening message, line by line.

| Element of the text | What a genuine notice does | What the fake gives away |
|---|---|---|
| Sender | Consistent short alphanumeric name (e.g. "SANEF") or postal letter | Mobile number starting 06/07, or an approximate name like "PEAGE-INFO" |
| Deadline stated | Several days, with a precise date | "72h", "48h", "today" |
| Surcharge | Mentioned in the terms and conditions, never brandished as a threat | Shock figure (€90, €375) put front and centre |
| Link | Operator's official domain | Long domain, with hyphens, in .com/.info/.shop |
| Spelling | Accents present, administrative syntax | Accents missing, choppy sentences |
| Payment method | Card, bank transfer, existing customer account | Bank card only, immediate form |
| Data requested | Journey reference | Full card details + 3D Secure code |

That last point is the heart of the operation. The form doesn't stop at taking your 16 digits. It then asks you to validate a transaction using the code sent by your bank — and that code actually authorises something else entirely: a recurring subscription, an online purchase, or the enrolment of your card in a mobile wallet controlled by the scammer.

In other words: you think you're paying €4.20, you're signing an open-ended authorisation.

## Act two: the call from the "anti-fraud department"

In the most polished campaigns, the text is only the first step. A few hours or a few days after payment, the phone rings. A calm, professional voice explains that an attempted fraud has been detected on your card following a toll payment, and that the account needs to be "secured".

The Banque de France and the Observatoire de la sécurité des moyens de paiement have been warning for several years about this rise in **manipulation-based fraud**: the loss no longer stems from a technical hack, but from a victim who validates the transactions herself, convinced she is protecting herself.

The rule is invariable, whatever the wrapping:

- No bank ever asks for a validation code over the phone.
- No bank ever asks you to transfer funds to a "secure account".
- No legitimate adviser rushes you.

If you have any doubt during the call, hang up and call back the number printed on the back of your card. A simple [car phone mount](https://www.amazon.co.uk/s?k=support+smartphone+voiture+magn%C3%A9tique&tag=ds0608-21) also lets you keep your hands free and never read a text while driving — haste at the wheel is one of these campaigns' best allies.

## Checking a free-flow journey in three minutes

The good news: unlike many scams, this one can be verified very reliably, and at no risk.

**1. Don't touch the link.** Not even "just to see". Some pages trigger the download of a malicious app on Android.

**2. List your actual journeys.** Open your diary or your phone's trip history. Did you use a free-flow route on the date given? If you didn't leave your area that day, case closed.

**3. Go and find the official site yourself.** Type the operator's name into your browser — Sanef, APRR, Vinci Autoroutes depending on the route — and log in to your account. If a journey really is unpaid, it will appear there, with the same reference. If nothing appears, the text is fake.

**4. Check your toll tag.** If you have a tag, the journey was billed automatically: there is *nothing* to settle. This is precisely why the scam consistently fails on subscribers — they know they never have to pay manually. A [no-commitment motorway toll tag](https://www.amazon.co.uk/s?k=badge+t%C3%A9l%C3%A9p%C3%A9age+autoroute&tag=ds0608-21) remains, for regular drivers, the best immunity against this specific scenario.

**5. Remember that the State writes letters; it doesn't text you for money.** A genuine free-flow surcharge, in the absence of payment, turns into a fixed penalty and then, where applicable, a fine notified by **post** via ANTAI. You will never receive a text announcing a €90 penalty with an immediate payment link.

## What you actually risk if you clicked

Let's distinguish two situations.

**You only opened the page.** The main risk is the installation of an app from outside the official store. Check your list of apps, delete anything you don't recognise, and run a scan. A reputable [antivirus solution for Android](https://www.amazon.co.uk/s?k=antivirus+android+licence&tag=ds0608-21) provides a useful safety net here, especially on a device shared within the family.

**You entered your card details.** Act in this order:

1. Block the card with your bank immediately.
2. Report the transaction on **Perceval** (via the service-public.fr website) if a debit has appeared.
3. File a complaint, possibly online via the **THESEE** service.
4. Forward the text to **33700**, the national number for reporting SMS spam, operated with the support of the telecom operators and the Association Française du Multimédia Mobile.
5. Report the website address on **Phishing Initiative** and on Cybermalveillance.gouv.fr.

The European payment services directive requires your bank to refund unauthorised transactions. The cruel nuance lies here: if you validated the 3D Secure step yourself, the institution can claim gross negligence. Court rulings are mixed, and several Cour de cassation judgments have found in favour of customers deceived by sophisticated impersonation techniques. So never give up without putting it in writing, with your screenshots as evidence.

## Three habits that make these texts harmless

**Keep payment separate from everyday banking.** A single-use virtual bank card, offered by most banks, or a [rechargeable prepaid card](https://www.amazon.co.uk/s?k=carte+pr%C3%A9pay%C3%A9e+rechargeable+paiement+en+ligne&tag=ds0608-21) dedicated to small online payments, mechanically limits the damage: what isn't on the card can't be stolen.

**Write your journeys down somewhere.** It sounds old-fashioned, but a [vehicle logbook](https://www.amazon.co.uk/s?k=carnet+de+bord+v%C3%A9hicule+trajets&tag=ds0608-21) tucked into the glovebox — date, route, payment method — makes any attempted fake notice instantly detectable. It's also valuable for claiming business expenses.

**Treat a text as a notification, never as a doorway.** A message may legitimately *inform* you. It must never be the route by which you *pay*. That single rule, applied without exception, neutralises almost all smishing — tolls, parcels, health insurance, fines or banks.

## Free flow isn't the problem

It would be unfair to conclude that removing the barriers was a bad idea. Less braking, fewer tailbacks, fewer accidents at toll approaches, less fuel burned: the technical record is solid, and the system will continue to expand across France in the coming years.

What this scam reveals is something else: **every time a payment becomes deferred and invisible, a space opens up for someone to come and claim it in place of the legitimate creditor.** It was true for parcels delivered without a signature, for automated health reimbursements, for energy direct debits. It's true for barrier-free tolling.

The countermeasure is neither technical nor expensive. It comes down to a habit: when a message demands money from you, you don't reply to the message. You go and look at the creditor's end, by a route you have chosen yourself. Three minutes of checking beats a card cancellation and six months of correspondence.

And if you're still in doubt, ask yourself the simplest question in the world: does a motorway company really need to threaten you with a €90 surcharge to recover €4.20?

{/* image-sources: https://images.pexels.com/photos/4114776/pexels-photo-4114776.jpeg?auto=compress&cs=tinysrgb&dpr=2&h=650&w=940 */}