"ANTAI: your traffic fine notice no. 7841556230 remains unpaid. Amount 35 EUR, increasing to 75 EUR on 30/09. Pay immediately: https://antai-avis-paiement.com"
The message lands on a Tuesday at 8:12 a.m., right in the middle of the morning commute. No glaring spelling mistakes, no outlandish promise, no phantom parcel. Just a ten-digit case number, a believable amount, a deadline two days away and a perfectly neutral administrative tone.
This is exactly what French smishing does best in 2026: a scam that no longer tries to seduce you, but to remind you of an obligation you may genuinely have forgotten. And on that terrain, the traffic fine is a golden target: every year, several tens of millions of traffic fine notices are issued in France. Statistically, there is a decent chance the recipient did indeed drive, park, or exceed something somewhere.
ANTAI, the acronym everyone has seen without ever remembering it
The Agence nationale de traitement automatisé des infractions (national agency for automated traffic offence processing) is a public body attached to the French Ministry of the Interior. It issues and sends out the fine notices generated by automated enforcement (speed cameras) and by electronic ticketing, and it runs the official site antai.gouv.fr. Payment itself goes through amendes.gouv.fr, operated by the Directorate General of Public Finances.
Two acronyms, two websites, and a system few drivers really understand. That grey area is precisely what the fraudsters exploit. When a text message mentions ANTAI, you vaguely recognise the name — it appears on the letters you have already received — without being able to say through which channel this agency is supposed to contact you.
The answer, however, is simple and worth committing to memory:
ANTAI and the DGFiP never send a text message or an email containing a payment link for a traffic fine. A fine notice arrives by post, at the address shown on the vehicle registration document.
There is indeed an information service by text message or email, but it is optional and requires explicit subscription through your user account, and it contains no direct payment link. In other words: if you never asked for it, you should never receive it.
Anatomy of a fake notice: the seven ingredients
The campaigns observed over the past year follow a remarkably stable template. Spotting it is the vaccine.
| Ingredient | What the scammer does | What the real authorities do |
|---|---|---|
| Case number | A randomly generated string of 10 to 12 digits | A genuine notice number, printed on a paper letter |
| Amount | €35, €45, €68 — always plausible, never a round figure | Statutory amounts set by the Highway Code |
| Surcharge | Announced within 24, 48 or 72 hours | Surcharge after 45 days (or 60 days online) |
| Sender | A 10-digit mobile number, or a spoofed short name | No payment text messages, full stop |
| Link | antai-avis-paiement.com, amendes-gouv-fr.net, paiement-antai.info | antai.gouv.fr and amendes.gouv.fr, never anything else |
| Tone | Administrative, terse, no polite closing | Administrative too — that's the trap |
| Payment method | Bank card only, immediate form | Card, direct debit, digital stamp, cheque |
The most telling detail is the deadline. French law allows 45 days to settle a fixed fine before a surcharge is applied (extended to 60 days for online payment). No genuine procedure gives you 48 hours. When an administrative message compresses time, it is never the administration talking.
The second clue is the domain name. Every French public authority online uses a .gouv.fr domain, and only a public authority can obtain one. A site ending in .com, .net, .info, .top or .online claiming to collect a state fine is a fake, without exception and without discussion. The hyphen is the scammers' favourite trick: amendes-gouv.fr has nothing to do with amendes.gouv.fr. What matters is what sits immediately before the first slash.
What happens after the click
Contrary to popular belief, the goal is almost never the €35 advertised. That's the bait.
The payment page is a carefully crafted copy of the amendes.gouv.fr interface: tricolour banner, Marianne logo, copy-pasted legal notices, a clearly visible HTTPS padlock — an encryption certificate can be obtained free of charge in a few minutes and proves absolutely nothing about the honesty of a site. You enter the notice number (which will of course be "recognised"), then the sixteen digits of your card, the expiry date and the security code.
Three scenarios then follow, sometimes combined:
- The small confirmation charge. €35 really does leave your account. The scammer thereby verifies that the card is active, and reassures you: you have "paid", and in your mind the matter is closed.
- The big delayed charge. Your card details are resold or reused a few days or weeks later, for far larger online purchases.
- The fake bank adviser. This is the most formidable sequel. A few hours later, a call: "This is your bank's fraud department, we have detected a suspicious payment attempt of €35 to a fraudulent website." The bogus adviser knows the amount, the time and the transaction label — because he is the one who set up the charge. He then asks you to approve an operation in your banking app, or to read out the code received by text message, "to block the transaction". In reality, it is the registration of a new payee or the authorisation of a transfer.
The Banque de France and the Observatoire de la sécurité des moyens de paiement have been warning for several years about this shift: fraud no longer relies on the technical theft of data, but on manipulating the victim, who approves the operation herself. A transfer authorised by the customer is, legally, far harder to get refunded than an unauthorised debit.
Why this scenario works so well on drivers
Three psychological mechanisms combine.
Legitimate uncertainty. Nobody remembers precisely every place they parked over the past six months. The doubt — "what if I really did forget something?" — is enough to make you open the link. That is a major difference from the parcel scam: you know whether you are expecting a delivery, you never know whether you have been caught on camera.
Fear of the surcharge, not of the fine. €35, you pay without thinking. €75 stings. The scammer isn't selling the penalty, he is selling the saving you make by acting fast.
Documentary anchoring. People who have recently sold or bought a vehicle, changed address or received a genuine ticket are hyper-receptive. And data breaches affecting mobility platforms, car rental companies, ride-sharing sites or dealerships feed targeted lists. Some messages now quote an exact registration plate: that is no longer chance, that is a database.
The three-minute check, without ever clicking
The method boils down to one rule: never verify information within the channel that delivered it. Get out of the text message.
- Open a browser yourself and type
antai.gouv.froramendes.gouv.frby hand. Never copy-paste from the message, never search by keywords (fake sites buy ads at the top of the results). - Use the "consult my offence file" service on antai.gouv.fr: it requires the notice number printed on the paper letter. No letter, no notice number → no fine in your name through that channel.
- Log in to your account on impots.gouv.fr or check your statements: unpaid fines that have been increased eventually appear in correspondence with the Treasury, always by post.
- Call the automated road offence processing centre whose contact details appear on the paper notice — never a number given in a text message.
One extra reflex: on a smartphone, a long press on the link (without releasing) displays the full URL in a preview, letting you read the real domain without opening the page. If you often check your messages outdoors, in a vehicle or in bright light, a simple anti-glare screen protector saves you from squinting and clicking blindly on a badly read link — it's a small thing, but many lapses in vigilance start out as legibility problems. Drivers who receive this kind of message at the wheel would do well to leave the phone on a magnetic car mount and only touch it when stopped: the message's manufactured urgency has never made the road any safer.
Reporting: the official channels
Reporting is not a symbolic gesture. It feeds the blocking systems.
- 33700: forward the suspicious text message to this number (free of charge), then send the sender's number in a follow-up message. This is the cross-operator platform for reporting voice and SMS spam, backed by Arcep and the French operators. It allows sending numbers to be shut down.
- Cybermalveillance.gouv.fr: the national victim assistance scheme offers a guided diagnosis and puts you in touch with local providers. It also publishes quick-reference sheets on smishing.
- Phishing Initiative / internet-signalement.gouv.fr (PHAROS): to report the address of the fake site and help get it listed in browsers' blocklists.
- SignalConso, run by the DGCCRF, for any associated misleading commercial practices.
You have paid: the emergency procedure, in order
Time matters more than embarrassment. A few minutes can change everything.
- Block the card immediately with your bank (number on the back of the card, or in the app). Ask for the card to be blocked and for pending transactions to be reviewed.
- Never take an incoming call claiming to be from your bank in the hours that follow. Hang up and call the official number back yourself. No legitimate adviser will ever ask you for a verification code, a password or a "security" transfer.
- File a complaint at a police station, with the gendarmerie or via the online pre-complaint service. Keep a screenshot of the text message, the URL, the time and the amount.
- Request a refund under Articles L.133-18 et seq. of the French Monetary and Financial Code. For an unauthorised transaction, the bank must refund you immediately, unless you were grossly negligent — a claim it will have to prove. The Fédération bancaire française and your institution's ombudsman can be called upon if it refuses.
- Change the passwords of linked accounts (email, online banking, merchant accounts), enabling two-factor authentication everywhere. A password manager makes this manageable; a book on cybersecurity for consumers helps you understand the logic behind it once and for all.
Protecting the most exposed drivers
Feedback from prevention associations all points the same way: the worst-hit groups are not the least tech-savvy, but the most rushed. Executives on the move, tradespeople, delivery drivers, parents working irregular hours — those who deal with their messages between two tasks.
A few settings mechanically reduce the exposure:
- Enable filtering of unknown senders: both iOS and Android offer to move messages from numbers not in your contacts to a separate tab.
- Never save your bank card in the mobile browser: entering it by hand creates ten seconds of friction, which is plenty of time to come to your senses.
- Cap your online payments from the banking app, and switch on instant notifications for every transaction.
- Use a single-use virtual card for payments on unfamiliar sites, a service offered by most French banks.
- For an elderly or less confident relative, a large-button mobile phone with no internet browser removes the risk of clicking altogether, without depriving them of text messaging.
Finally, a word about preserving evidence. Many victims delete the message out of sheer embarrassment. That is a mistake: the text message, the URL and the timestamp are the only material elements of the case. A screenshot, a notebook to record the date and time, and you're covered — both the bank and the investigators will ask for them.
Key takeaways
The fake traffic fine scam is no more technically sophisticated than the others. Its strength lies elsewhere: it leans on a real public body, a plausible pretext and a diffuse sense of guilt. It doesn't ask you to believe in a windfall, merely to admit a possible oversight — which is infinitely easier.
Three sentences are enough to protect you for good:
- A traffic fine arrives by post, never by text message with a payment link.
- The statutory deadline is 45 days, never 48 hours.
- A payment to the state is made on a
.gouv.frdomain, never anywhere else.
The rest — the case number, the plate, the amount, the tone — is just scenery. And scenery, however carefully built, never survives three minutes of checking carried out somewhere other than in the message itself.
