FRANCE PHISHING GUIDE

Crit'Air SMS scam in France 2026: is the vignette text real?

A text lands on your phone: buy your Crit'Air sticker now, or pay an unpaid ZFE fine before it grows. It looks official. It is not. Here is how to tell in ten seconds.

SB

SafeBrowz Threat Research Security ResearchJune 28, 20269 min read

What the Crit'Air vignette actually is

The Crit'Air sticker, officially the "certificat qualite de l'air", is a small round disc you put on your windshield. It classifies your vehicle into an air-quality category based on its engine and age. You need one to drive inside a ZFE, a Zone a Faibles Emissions, which several French cities have set up to limit the most polluting vehicles. Paris, Lyon, and others enforce these zones, and the rules tightened again in 2026.

That is the hook. Millions of drivers either already have a sticker or know they need one, and the ZFE rules change often enough that nobody is quite sure if they are still in order. A message that says "your vehicle is not compliant, order your vignette now" feels plausible to almost anyone. The scam does not have to be clever. It just has to land at the right moment.

The real cost is the giveaway most people do not know. A Crit'Air vignette for a vehicle registered in France is a fixed 3.85 euros. That is the full price, postage included. Any "service" charging you 20, 30, or 60 euros for the same sticker is either a reseller adding nothing of value or, far more often, an outright fraud.

How the Crit'Air scam actually works

The fraud runs in two main flavors, and both end on a clone of the official site.

The "buy your sticker" version. An SMS or email tells you that you do not have a valid Crit'Air sticker and must get compliant quickly or risk a fine. It carries a link to a page that copies the logos, the colors, and the layout of certificat-air.gouv.fr almost exactly. You fill in your vehicle registration and your card details. The site either charges you far more than 3.85 euros, or it simply captures the card and you never receive anything.

The "unpaid ZFE fine" version. A text claims you drove through a low-emission zone without a valid sticker and now owe a penalty that will grow if you do not pay immediately. It links to a fake payment page. The threat of a rising fine is what makes people tap before they think. In reality, a ZFE infraction is a fixed fine of 68 euros for a light vehicle, handled through the normal fine system, never collected by a random SMS link.

Once your card is on the clone page, attackers run small test charges within minutes, then attempt larger ones or sell the data. Some variants add a fake "3D Secure" step that asks you to relay a code your bank really did send, which lets them authorize a bigger transaction in real time. The personal data you typed (name, address, plate) gets reused to make the next wave of messages look even more convincing.

The exact wording these messages use

Once you have read these lines, they stand out in any inbox. Real government communication does not write this way.

• "Votre vehicule ne dispose pas de vignette Crit'Air. Regularisez sous 48h."
• "Crit'Air: amende ZFE impayee. Paiement requis pour eviter la majoration."
• "Commandez votre certificat qualite de l'air: [lien]"
• "Derniere etape: confirmez votre adresse et votre paiement."

The tone is the tell. A real official message about air-quality rules is dry and formal, and it points you to your existing account or to the one official site without a countdown. The scam mixes administrative language with marketing urgency: "regularisez sous 48h", "derniere etape", "evitez la majoration". That blend almost never appears in genuine French government writing.

What the official process really looks like

Three rules cover every case. Learn them once and you will never fall for a Crit'Air text again.

Rule 1: there is one official site, and it ends in .gouv.fr. The only place to order a vignette is certificat-air.gouv.fr. Not certificat-critair.com, not air-vignette.fr, not any hyphenated cousin. The Ministere de la Transition ecologique et de la Cohesion des territoires states plainly that there is a single official site. Anything on a .com, .fr-without-gouv, or odd subdomain is hostile.

Rule 2: the price is fixed at 3.85 euros. For a vehicle registered in France, the sticker costs 3.85 euros, postage included. The government repeats this number specifically because the scams (and some opportunistic resellers) overcharge. If a page asks for 25 or 49 euros for a Crit'Air sticker, close it.

Rule 3: the government does not text or email you to buy it. The official Crit'Air service, the Ministry, and the Prefectures do not send SMS or emails inviting you to purchase a sticker on a link. You go to the site yourself when you choose to. So a payment request that arrives unprompted by text is fake by definition, no matter how good the page looks.

Fake URLs to watch for

These are the kinds of domains that show up in Crit'Air phishing. The list is not exhaustive, because attackers register new ones constantly, but the pattern repeats: take "critair", "vignette", or "air", attach it to a non-government TLD, and copy the official look.

• certificat-critair-paiement.com (real is certificat-air.gouv.fr)
• vignette-critair.fr (a .fr without gouv is not the government)
• critair-officiel.com ("officiel" in the name is a red flag, not a guarantee)
• zfe-amende-paiement.fr (no government service collects ZFE fines on this kind of link)
• certificat-air-gouv.fr (the hyphen replaces a dot, so the real domain is gouv.fr, not the whole string)

The single reliable check: the real address ends in .gouv.fr with a dot, as in certificat-air.gouv.fr. If "gouv" is glued on with a hyphen, or the address ends in .com or a plain .fr, it is not the French government.

Red flags: how to spot it in 30 seconds

• It arrived by SMS or email asking you to pay. The government never texts you to buy a Crit'Air sticker.
• The link is not certificat-air.gouv.fr. Any other domain is fake.
• The price is not 3.85 euros. Overcharging is the whole point of the clone sites.
• There is a countdown. "Sous 48h", "derniere chance", "avant majoration". Real rules do not work on a one-text deadline.
• It asks for your full card number and CVV on one page. The real site uses a secure bank gateway.
• The sender is a random mobile number or a generic short code.
• The grammar is slightly off or mixes formal and casual French.

Any one of these is enough to delete the message. Two or more and it is a confirmed phishing attempt.

What to do if you get one

Do not tap the link. If you actually need a sticker, open a new browser tab and type certificat-air.gouv.fr yourself. Order there for 3.85 euros and ignore the text. If you are unsure whether you even need a vignette for a given city, check the rules on service-public.fr, again by typing the address yourself rather than clicking anything.

If you are worried about a supposed ZFE fine, do not pay through any link in a message. Real fines run through the standard fine system at amendes.gouv.fr, and you check your situation by going there directly. There is no legitimate "pay your ZFE penalty here" SMS.

What to do if you already paid the fake site

Move fast. The attacker may already be testing your card.

1. Call your bank immediately and block the card. Use the opposition hotline on the back of your card or inside your banking app.
2. Dispute the charge. Under European PSD2 rules and Article L133-18 of the Code Monetaire et Financier, your bank must refund unauthorized card transactions unless it proves gross negligence, and you have up to 13 months to dispute.
3. Report to Cybermalveillance.gouv.fr. The official French cybercrime platform gives you a written reference and tells you the next steps.
4. File a plainte at your local commissariat or gendarmerie with screenshots of the message, the fake URL, and any receipts. The plainte often helps push the bank refund through.
5. Watch your statements daily for the next month. Some attackers wait before running a larger charge.

How to report the Crit'Air scam

Reporting protects the next driver. Each step takes under two minutes.

• SMS scams: forward the text to 33700, the free national reporting short code for unsolicited and fraudulent SMS, then delete it.
• Email scams: forward the message to signal-spam.fr through their official extension or web form.
• Phishing site URLs: report at cybermalveillance.gouv.fr, which publishes a dedicated page on Crit'Air hameconnage and tracks active campaigns.
• Phishing links generally: you can also report them to Phishing Initiative at phishing-initiative.fr so the page gets flagged for blocking.

Updated June 28, 2026.

How SafeBrowz blocks this threat

SafeBrowz runs a 3-layer detection architecture: Local + APIs + AI.

• Layer 1 - Local detection: 60+ URL patterns plus 550+ brand-specific signatures, including French government impersonation patterns like critair-{variant}.{tld}, vignette-critair-{tld}, and certificat-air-gouv-{variant}, all running in the extension and the SafeBrowz Android app before the page renders. The one official site, certificat-air.gouv.fr, is in the brand database, so a lookalike trips a warning before the clone payment page finishes loading.
• Layer 2 - API checks: cross-references Google Safe Browsing, PhishTank, URLhaus, and known scam-TLD lists for reported Crit'Air and ZFE lookalike domains.
• Layer 3 - AI deep scan (Premium): content analysis in French and 100+ other languages recognizes French government page mimicry, the Marianne logo and Republique Francaise header bar, and can flag a brand-new clone the moment it goes live, even before any blocklist lists it.

Honest scope: SafeBrowz flags the fake Crit'Air payment page before you type, so the card form never gets your details. It cannot reverse a charge you have already authorized, so if you already paid, go straight to your bank. The browser extension covers Chrome, Firefox, and Edge with Safari pending, and the SafeBrowz Android app protects links you tap inside apps and texts on your phone.

Detection signatures come from threat-intelligence research and our internal brand database, not from user browsing data. SafeBrowz does not store per-user browsing history.

Bottom line: the Crit'Air sticker costs 3.85 euros on one site, certificat-air.gouv.fr, and the government never texts you to buy it. Put SafeBrowz on your browser and phone so the fake vignette page never loads in the first place.

Frequently asked questions