In the first months of 2026, over 400 phishing websites were identified that imitate pages for paying the Free Flow toll fee with the aim of stealing money from drivers. This figure is eight times higher than the approximately 50 domains that Kaspersky mapped during its first alert in February.
Kaspersky, a global cybersecurity company founded in 1997 and known in Brazil for its antiviruses, has a team specializing in tracking digital fraud in Latin America. According to the company, the fraud begins when a driver searches for toll payment services in search engines and clicks on advertisements or links from social media.
These fake pages copy official platforms. After entering the license plate number, they display correct vehicle data and a presumed small debt corresponding to the actual tariff. Payment is made via Pix and goes to 'black box' accounts in little-known fintech companies, while the recipient's name is constantly changed to hinder tracking.
Fabio Assolini, Kaspersky's lead researcher on security for Latin America, stated: 'In just a few months, criminals have moved from dozens to hundreds of fake domains, which indicates an operation that is highly scalable and likely automated.'
Drivers with an installed transponder (tag) do not need to take any action, as reading occurs automatically, and the amount is deducted against the payment. Drivers without a transponder can pay the fee within 30 days, as established by Resolution 6.079/2026 ANTT. After this period, the debt becomes a serious violation for evading the toll fee, which incurs a fine of R$ 195.23 and five points on the driver's license.
Internet experts agree that there are several advanced practices effective in preventing such fraud.