Online scams are becoming increasingly sophisticated, combining information obtained from legitimate advertisements with criminal networks to deceive victims and generate financial gain. Cybercriminals are constantly developing new methods to exploit information publicly available on the internet, including vehicle advertisements, photographs, registration details, and other identifying characteristics. A recent investigation by the Civil Police in Rio de Janeiro highlights how criminals can use legitimate online vehicle listings as a blueprint to clone stolen vehicles and subsequently sell them through digital platforms. The case demonstrates the importance of caution when purchasing vehicles online and verifying both the seller and the vehicle independently before completing a transaction.
The “Free Flow” Scam
The expansion of the Free Flow electronic barrierless toll system in Brazil has been accompanied by a rise in digital fraud. The National Land Transportation Agency (Agência Nacional de Transportes Terrestres – ANTT) issued a warning to drivers regarding scams fraudulently using the Free Flow name. Free Flow allows vehicles to pass through toll points without stopping. Identification is carried out through cameras and sensors, and users must check and settle the fee later, within 30 days, directly with the concessionaire responsible for the highway. Criminals have taken advantage of this new system to carry out fraud, charge non-existent fees, and trick users into making unauthorized payments or handing over personal data. A survey by cybersecurity firm Kaspersky revealed that 480 fake websites simulating toll charges have been identified since the beginning of the year, 80 of which emerged just a few weeks ago.
This Content Is Only For Subscribers
To unlock this content, subscribe to INTERLIRA Reports.
How the Scam Works
The scam takes advantage of drivers actively searching for unpaid fees from recent trips. When searching for payment services or clicking on sponsored ads on social media, users are redirected to cloned pages that imitate highway concessionaires. Upon entering their license plate number on the fake site, victims see real vehicle data accompanied by a low-value charge that matches a typical toll fee. Payment is requested via Pix, but the amount is transferred to proxy accounts. In another variation, fake bank slips (boletos) are sent to victims’ physical addresses or emails using illegally obtained information.
Warning Signs
- Messages via email, SMS, social media, or WhatsApp indicate fraud, as ANTT and concessionaires do not collect payments directly through these means.
- Pix transfer to individuals or third-party accounts is a red flag, as payments must go directly to the official corporate tax ID (CNPJ) of the concessionaire.
- Urgent messages with small payment amounts, links containing QR codes for quick payment or eye-catching discounts are designed to force transfers without prior verification.
- Sites with typos, unusual web addresses, missing security seals, or those originating from sponsored ads indicate fake pages.
- Displaying details like license plate numbers and car models is a common tactic used by scammers to lend fake credibility to the charge.
How to Protect Yourself
- Enter the concessionaire’s URL directly into your browser or use official apps and websites to check outstanding fees.
- Carefully double-check the recipient’s name and corporate tax ID (CNPJ) before confirming any transaction to ensure funds go to the responsible highway concessionaire.
- Do not open links, buttons, or QR codes sent by unknown senders or via unsolicited messages.
- Ignore top sponsored ad results in search engines and access verified official Free Flow pages directly.
- Keep your personal, account, and vehicle information secure and never input details into platforms of doubtful origin.
If You Become a Victim
- Interrupt any transaction as soon as you suspect fraud to prevent further financial loss.
- Inform the bank or institution used to make the Pix payment to attempt to block and recover the funds via the Special Refund Mechanism (Mecanismo Especial de Devolução).
- Report the crime to the Civil Police (PC), attaching payment receipts along with screenshots of the fraudulent website or message.
- Report the case to ANTT through its official channels and file a complaint with consumer protection agencies such as Procon.
- Inform the concessionaire’s customer service team about the fake channel used in the scam so they can issue warnings or take down the fraudulent page.
Sources: G1; CNN Brasil; Gov.br/ANTT; Money Times
