ANTAI fake parking fine scam in France 2026: how the "amende impayée" fraud works

Why parking fine scams work on French drivers

Almost every driver in France has received a real ANTAI fine at some point. A windshield ticket in a Paris parking zone, a speed-camera flash on the autoroute, a missed Crit'Air sticker. The system is everywhere and most people pay within a few weeks without thinking about it. That ordinariness is exactly what makes the scam dangerous. The fraudulent email does not need to be brilliant. It just needs to look familiar.

Scammers also pick the amount carefully. €35 is too small to call a lawyer over, but too believable to ignore. Most drivers assume they probably did get a ticket and forgot about it. The countdown to €75 makes the math easy: pay now or pay double tomorrow. The whole transaction feels routine, not threatening, which is why people enter their card details before they even think to check the URL.

The third reason this scam spreads: a lot of French drivers really did register an email address with antai.gouv.fr to receive electronic notices. So a message from "ANTAI" landing in your inbox does not automatically feel wrong. Attackers know this and lean into it hard.

How the fake ANTAI scam actually works

The scam runs in two flavors: email and SMS. Both end in the same place, a card-capture page styled to look like a French government site.

The email version. A message arrives from "ANTAI" or "Service Public - Amendes" with a subject line like "Avis d'amende impayée - ANTAI". The body claims you have an unpaid fine of €35 from a parking infraction in a specific city. There is a vehicle registration plate listed (sometimes yours, sometimes a guess based on leaked data). A blue button labeled "Régler mon amende" or "Payer maintenant" sits in the middle. The button points to a lookalike domain like antai-amende-online.com or paiement-amende-france.fr, not to amendes.gouv.fr.

The SMS version. A text message arrives from a short code or a French mobile number reading something like "ANTAI: Amende impayée de 35 EUR. Majoration à 75 EUR sous 24h. Réglez: [link]". The link is shortened or uses a generic-looking domain. Tap it and you land on a mobile-optimized fake payment page that asks for your license plate, then your card number, CVV, and expiration date.

Once the card is captured, attackers run small test charges within minutes, then drain the account or sell the card data on the dark web. Some variants also push a fake "3D Secure" page that asks you to copy a code from a real SMS your bank sends, which lets the attackers authorize a much larger transaction in real time.

The exact phrases scammers use

Once you have seen these phrases, they jump out of any inbox. Real ANTAI communications do not write this way.

• "Avis d'amende impayée - ANTAI" as the subject line
• "Votre amende de €35 sera majorée à €75 dans 24h" in the opening sentence
• "Cliquez pour régler votre infraction" next to the payment button
• "Paiement amende - Service Public France" as the fake portal heading

The wording feels official because the scammers studied real templates, but the rhythm is wrong. Real French government emails are dry and formal. They do not push countdowns, they do not mix administrative language with marketing urgency, and they almost never use the casual phrasing "cliquez pour régler". Real notices say "vous pouvez régler votre amende en vous connectant à votre espace personnel sur amendes.gouv.fr".

What real ANTAI fines look like vs fake

This is the single most important section of this article. Memorize these three rules and you will spot every fake ANTAI fine for the rest of your life.

Rule 1: Real fines arrive by post mail first. ANTAI (Agence Nationale de Traitement Automatisé des Infractions) sends every initial fine notice on paper, in a yellow envelope, to the registered address of the vehicle. Always. Email or SMS notification is only available as a secondary channel, and only if you opted in by creating an account at antai.gouv.fr. If you have not opted in and an email about an ANTAI fine appears in your inbox out of nowhere, it is fake. End of story.

Rule 2: The only real payment URL is amendes.gouv.fr. Not antai-paiement.com, not paiement-amendes-fr.com, not any hyphenated variation. The real ANTAI website is antai.gouv.fr (the official agency page) and the real fine payment portal is amendes.gouv.fr. Both end in .gouv.fr. Anything with a different TLD or a hyphen in the middle (like avis-amende-gouv.fr where the hyphens replace dots) is hostile.

Rule 3: Fines do not double in 24 hours. The real French penalty schedule gives you 45 days to pay at the standard amount, then it increases according to the published rates in the Code de la Route. A €35 parking fine becomes a €75 majorée fine if unpaid after 45 days, not 24 hours. Any email that compresses that schedule into a one-day countdown is a lie designed to make you panic.

Lookalike URLs to watch for

These are the kinds of domains that have shown up in 2025 and 2026 ANTAI phishing campaigns. The list is not exhaustive (attackers register new domains daily), but the pattern is the same: add ANTAI or "amende" to a non-government TLD, or hyphenate the gouv.fr address so the real domain is buried.

• antai-paiement.com (real is antai.gouv.fr)
• amende-non-payee.fr (no such government service exists)
• paiement-amendes-fr.com (real uses .gouv.fr, not .com)
• antai-amende-online.com (real ANTAI does not use "online" anywhere)
• avis-amende-gouv.fr (looks official but the hyphens replace dots, so the real domain is gouv.fr, not the full string)
• amendes-gouv-fr.payment-site.com (subdomain trick, the real domain is payment-site.com)
• paiement-amende-france.fr (no real French government service uses this exact name)

When you hover the payment button in any ANTAI-branded email, the URL preview at the bottom of your browser will show you the truth. If it is not exactly amendes.gouv.fr or antai.gouv.fr, do not click.

Red flags: how to spot it in 30 seconds

• You never received a paper letter first. Real fines start on paper, every time.
• The URL has hyphens or a non-.gouv.fr TLD. antai-paiement.com is not the government.
• The countdown threatens a double penalty in 24 hours. Real majoration takes 45 days.
• The email asks for your card directly. Real amendes.gouv.fr asks for your fine reference number first, then redirects to a secure bank gateway.
• The sender domain is not @antai.gouv.fr. Look at the full address, not the display name.
• The license plate listed is wrong or close-but-not-quite. Scammers often guess from leaked databases.
• Grammar is slightly off or mixes vous and tu. Real government writing is consistent and formal.
• SMS comes from a generic mobile number, not the official ANTAI short code.

Any one of these is enough to throw the email out. Two or more and you are looking at a confirmed phishing attempt.

What to do (the safe routine)

If you think you might actually have an unpaid fine, do not click anything in the email or SMS. Open a new browser tab. Type antai.gouv.fr directly into the address bar. Sign in to your espace personnel using your fine reference number (the long alphanumeric code on the real paper notice) and your immatriculation. Any real outstanding fines will be listed there. If nothing is listed, the email was a scam.

To pay a real fine, go to amendes.gouv.fr, enter the reference number from the paper notice, and pay through the secure government gateway. The gateway uses 3D Secure with your bank, so you authorize the payment in your banking app, not on the amendes.gouv.fr page itself.

If a friend or family member sends you an email forward asking "is this real?", check it for them. The 30-second hover-and-verify check is the same on every fake ANTAI message. You save them €35 or worse.

What to do if you already paid the fake site

Speed matters. The attacker may already be running test charges.

1. Call your bank immediately and block the card. The number is on the back of your physical card or inside your banking app. Use the "opposition" hotline.
2. Dispute the transaction under PSD2. European payment law (Article L133-18 of the Code Monétaire et Financier) gives you up to 13 months to dispute unauthorized card transactions. Banks must refund unauthorized charges unless they can prove gross negligence on your part. Phishing fraud generally qualifies for refund.
3. File a report with Cybermalveillance.gouv.fr. The official French cybercrime platform will give you a written reference and direct you to next steps.
4. File a formal complaint at your local commissariat or gendarmerie. Bring screenshots of the email, the fake site URL, and any transaction receipts. The plainte is often required to push the bank refund through.
5. Change passwords on any account that shared the email address. Attackers reuse leaked emails across other phishing waves.
6. Watch your bank statements daily for the next 30 days. Some attackers wait a few weeks before running larger fraud, hoping you have stopped monitoring.

If the bank refuses the refund, file a complaint with the ACPR (Autorité de Contrôle Prudentiel et de Résolution). The ACPR enforces PSD2 against French banks and will mediate.

How to report the scam

Reporting protects the next victim. Each of these takes under two minutes.

• Email scams: forward the message to signal-spam.fr using their official browser extension or web form. Signal-Spam aggregates reports for ANSSI and CNIL.
• SMS scams: forward the text to 33700 (free short code run by the AF2M). Then delete the SMS.
• Phishing site URLs: report at Cybermalveillance.gouv.fr under "Signaler une cybermalveillance".
• Suspected ANTAI impersonation: contact ANTAI directly through the official contact form at antai.gouv.fr. They publish updated lists of active scam campaigns.
• For wider reach: tag the Police Nationale (@PoliceNationale) on social media with the scam screenshot, especially if it is a new variant.

Updated May 29, 2026.

How SafeBrowz blocks this threat

SafeBrowz runs a 3-layer detection architecture: Local + APIs + AI.

• Layer 1 - Local detection: 60+ URL patterns + 550+ brand-specific signatures (including French government impersonation patterns like antai-{variant}.{tld}, amendes-gouv-fr-{variant}, paiement-amende-{tld}) + community whitelist/blacklist, all running directly in the extension before the page renders. ANTAI, amendes.gouv.fr, and service-public.fr are in the brand database, so any lookalike triggers a block before the page can finish loading.
• Layer 2 - API checks: aggregates Google Safe Browsing, PhishTank, URLhaus, ScamAdviser, and 30+ scam TLDs for known malicious French government lookalike domains.
• Layer 3 - AI deep scan (Premium): 100+ language content analysis recognizes French government page mimicry (Marianne logo placement, République Française header bar, official font choices) and catches novel ANTAI variants the moment they go live, even before they appear on any blocklist.

Detection signatures come from threat-intelligence research and brand database analysis, not from user browsing data. No per-user browsing history stored.

Frequently asked questions