A message arrives saying you have an unpaid traffic fine. It gives an amount, a deadline, and a link to settle it before penalties are added. It is the most persistent Morocco SMS scam of 2026, and three separate Moroccan authorities have now publicly contradicted it: the DGSSI (Direction Générale de la Sécurité des Systèmes d’Information, the national information systems security authority) on 3 April 2026, NARSA (the National Road Safety Agency) on 13 April, and the Ministry of Justice again in June.
Nobody is being singled out. These messages go out in bulk and work on volume: send enough of them and some reach a driver who is genuinely unsure whether a fine is outstanding. What follows is how the campaign operates, the tells that hold up whatever wording it uses next, and the only places a traffic fine can really be paid in Morocco.
How the Morocco SMS scam works
The mechanics are the same in every version. A text creates a plausible obligation and a short deadline, then offers a link that appears to solve it. The link opens a copy of a government payment page. What happens next is the point of the whole exercise: the page collects your identity details, then your card, then the confirmation code your bank sends you.
That last step is what turns a convincing web page into money leaving an account. A payment page you reached yourself never needs you to type a code back to it that your bank has just sent to your phone.
Wave one: foreign numbers and a cloned payment page
On 3 April 2026 the DGSSI issued a security alert about the campaign. The messages, written in Arabic, arrived from foreign numbers carrying +44 or +63 country codes, claimed an unresolved traffic violation, and pressed for immediate payment to avoid a penalty. The fraudulent site behind the link asked for name, CIN number and phone number, then card number, expiry date and CVV, and finally the OTP (one-time password) sent by the victim’s bank.
The DGSSI’s guidance was specific and it is the most useful thing to remember from this whole affair: official authorities do not use foreign numbers to contact citizens, and every genuine Moroccan government site sits under the .gov.ma domain. Fines should be checked only through the amendes.justice.gov.ma portal or the official Infractions Routières application.
Ten days later, on 13 April, NARSA added its own denial, stating that it “does not offer any service of this type” and has “absolutely no link” with the messages circulating. NARSA also described the technique: criminals use spoofing tools to make a text appear to come from an official source, and the links lead to cloned versions of government portals where victims enter licence or ID details before being asked for card information. Legitimate payment runs through recognised channels, including accredited payment centres such as Barid Cash and M2T.
Wave two: a “Notice of Administrative Enforcement”
The campaign did not stop after April, it got more formal. In June 2026 the Ministry of Justice alerted the public to a new version of the same Morocco SMS scam, this time presented as a “Notice of Administrative Enforcement”. It carried a fabricated case number, claimed the violation had been detected by surveillance systems, set a deadline, and threatened administrative and legal consequences including seizure of accounts. The link used a misspelling of an official domain hosted on a free, non-governmental domain ending.
The Ministry confirmed the message has no connection to any official government system, and repeated the same instruction: do not click, do not share personal or banking information, delete the message, and report it.
Why the sender name proves nothing
Most people assess a text by who it appears to be from. That instinct is exactly what the technique defeats. Sender identity on SMS is not verified the way a bank card or a passport is, and spoofing tools let an attacker put almost any name or number in that field. It is the same principle behind the fake bank messages we covered in our guide to Bank Al-Maghrib phishing, and behind the WhatsApp hack Morocco wave in September, where messages really did come from a friend’s account.
Treat the sender field as a claim, not as evidence.
Why the targeting feels so accurate
A second reason these messages land is the volume of Moroccan personal data that has circulated publicly after the breaches of the past two years, which we examined in our analysis of the Morocco data leak. Accurate details in a message are not proof that it is genuine, only proof that somebody has your details.
Five tells that give a Morocco SMS scam away
- The number is foreign, or simply unknown. The DGSSI is explicit that authorities do not contact citizens from foreign numbers.
- The link does not end in .gov.ma. Read the part immediately before the first single slash. In
amendes-paiement.example.com/infraction, the owner isexample.com, notamendes-paiement. - There is a deadline and a consequence. Urgency is not an administrative habit, it is a pressure technique.
- It wants your card, then the code your bank sends. Handing over an OTP is handing over the transaction.
- You cannot find the same fine anywhere official. A real fine exists in the official portal whether or not anyone texted you about it.
Where traffic fines are actually paid in Morocco
There are only a few legitimate routes, and none of them start with a link in a message:
- The official portal at amendes.justice.gov.ma, typed into the address bar yourself.
- The official Infractions Routières application.
- Accredited payment centres such as Barid Cash and M2T, as NARSA noted.
If a message and the official portal disagree, the portal is right.
What to do if you already entered your details
Speed matters more than embarrassment, and this happens to careful people.
- Call your bank now and have the card blocked. If you passed on an OTP, say so explicitly, because a disputed transaction is easier to stop early.
- Change any password you reused on the fake page, starting with your email account.
- Watch your statements for small test charges, which often precede a larger one.
- Report it to your bank, and to the authorities through e-Blagh, the DGSN’s cybercrime reporting portal, which accepts reports around the clock and anonymously. Warn whoever else received the same message.
- Check the link before anyone else in your team taps it with our free website safety checker.
What this means for Moroccan businesses
This is a consumer scam that walks into companies on personal phones. The same playbook, an official-looking notice with a deadline and a payment link, is used against businesses through fake supplier invoices and fake tax notices, and a finance inbox is a far more valuable target than one driver’s card.
Two habits remove most of the risk: no payment is ever made from a link inside a message, only from an address someone types themselves, and any urgent payment instruction is verified on a phone number your team already had, never one supplied by the message. Our guide on how to spot phishing emails applies the same reasoning to email, where the stakes for a business are usually higher.
Frequently asked questions
Does NARSA send SMS messages about traffic fines?
No. NARSA stated on 13 April 2026 that it “does not offer any service of this type” and has “absolutely no link” with the messages circulating about fine payments.
Is amendes.justice.gov.ma the only official place to pay?
It is the official government portal for traffic fines, alongside the Infractions Routières application and accredited payment centres such as Barid Cash and M2T. Whatever route you use, reach it yourself rather than through a link you were sent.
I opened the link but did not type anything. Am I at risk?
Opening a page is far less serious than submitting data to it. Close it and do not return through the same link. If it prompted you to install anything, have the device checked.
What to do next
The single habit that defeats this entire Morocco SMS scam costs nothing: when a message tells you to pay something, ignore the link and go to the official source yourself. Share that with your family and your team, because the people most likely to be caught are the ones who never heard the warning.
If your business handles payments or customer data, SecureWeb offers a free website security scan as a starting point, and security awareness training for teams that need the habit to stick.
Sources: DGSSI security alert of 3 April 2026, reported by le360; NARSA statement of 13 April 2026, reported by Morocco World News; Ministry of Justice alert of June 2026, reported by The North Africa Post.
