On 13 October 2026, Britain’s travel association told British travellers to do something unusual: nothing. Do not apply for an ETIAS authorisation, do not pay any website that offers to secure one for you, and do not assume that a professional-looking page with a European flag is the official channel. The warning, reported by The Guardian the same day, came with a striking figure: more than 150 websites are already offering to obtain the new European travel authorisation for money, even though the system has not launched and no application can currently be made. The association’s public affairs director warned that users of these sites risk both losing money and exposing their personal data. For a British family booking a ferry to Calais, a couple flying to Bergerac for a viewing trip, or a retiree returning to a Dordogne home, the question is practical and urgent: is the site in front of you genuine, what has the money you already paid actually bought, and what does French law let you do about it? This article answers those three questions for a British reader. It explains the real ETIAS timetable and the single official channel, how the copycat sites operate and which French criminal offences they may commit, and the exact sequence for recovering money and filing a complaint that French police, prosecutors and courts will take seriously. Every French term is translated at first use, and every decisive statement is tied to the statute or court decision that says it.
I. ETIAS has not launched and only the official EU channel will count: what British travellers to France must check first
ETIAS, the European Travel Information and Authorisation System, is the European Union’s pre-travel authorisation for visitors who do not need a visa, which since Brexit includes British citizens travelling to France and the rest of the Schengen area. It was created by Regulation (EU) 2018/1240 of 12 September 2018, presented on the official EU ETIAS information site, and the European Commission’s Directorate-General for Migration and Home Affairs oversees the only official information site at travel-europe.europa.eu, an address inside the europa.eu domain that marks every genuine EU website. The parallel Entry/Exit System (EES), the EU’s electronic border register that records entries and exits with biometric checks, is in operation at the external border, although border authorities have been told not to enforce penalties where entry points suspend it to let queues flow. ETIAS itself, by contrast, remains suspended after repeated postponements, and the travel industry has asked that it not be switched on until EES works properly everywhere, including at the French juxtaposed controls in Dover, Folkestone and St Pancras where British holidaymakers first meet the French border. That distinction matters because it decides everything that follows: any page that takes your money today for “processing” or “reserving” an ETIAS authorisation is selling something that does not yet exist.
A. Can I apply for ETIAS now, what will it really cost, and where is the only genuine application channel?
The short answer, on 14 October 2026, is no, and that answer comes from the industry body that speaks for British travel agents and tour operators. ABTA’s advice, carried by The Guardian on 13 October 2026, is that Britons travelling to EU countries should not apply for the waiver at all for now, because introduction of the scheme has been delayed again and no date has been set for launch. Its director of public affairs added that travellers cannot and should not apply for an ETIAS authorisation now, a sentence worth memorising. Awareness of the coming requirement is rising fast, from 41 per cent of travellers in 2024 to 56 per cent now according to ABTA research, and that rising awareness is precisely what the copycat sites harvest. The price quoted in October 2026 reporting is 20 euros, about 17 pounds, per application, up from the 7 euros originally envisaged, with travellers over 70 and under 18 exempt from the fee. None of that money is payable anywhere today. When ETIAS does go live, there will be exactly one official application channel, the EU’s own site, and the European border agency Frontex has warned for years that commercial intermediaries, even the lawful ones that will one day be allowed to file on a client’s behalf, create risks ranging from data protection failures and identity theft to extortionate fees. Some unofficial pages already mimic the layout of the official site, use convincing domain names, and give inaccurate information about who even needs an authorisation. The practical test is therefore simple and should be applied before a single detail is typed: check the domain, and treat anything outside europa.eu, however official it looks, as a commercial intermediary at best. If it demands payment now, while the scheme is suspended, it is not an intermediary at all.
Three further checks separate a future lawful intermediary from today’s trap. First, a lawful service will never claim your travel depends on paying immediately, because no carrier, no French border officer and no airline can require an authorisation from a system that is not operating. Second, it will state its own identity, price and terms in plain language instead of borrowing the EU’s visual identity, because passing itself off as the authority is the hallmark of the sites Frontex described. Third, it will not ask for your passport number, let alone a scan of the photograph page, before any official application exists to attach it to, because harvested identity documents are the most valuable part of the fraud. Keep screenshots of every page, the web address, the price shown, any receipt and the card statement entry, before the site changes or disappears. That file of evidence is what turns an angry email into a recoverable claim, as the second part of this article shows.
B. How do the copycat ETIAS sites take your money and your passport data, and which French criminal offences does that conduct match?
The business model of the copycat site has three layers, and each layer maps onto a French criminal offence your complaint can name. The first layer is the passing-off itself: a name close to the official one, EU colours, testimonials, sometimes a countdown timer warning that fares or entry will be refused without immediate payment. In French consumer law that presentation is judged against a flat prohibition: article L. 121-1 of the Consumer Code (Code de la consommation) provides that “Les pratiques commerciales déloyales sont interdites”, meaning unfair commercial practices are prohibited. A practice is unfair, the same article continues, where it is contrary to the requirements of professional diligence and where it alters, or is likely to alter in a substantial way, the economic behaviour of the normally informed and reasonably attentive consumer with regard to a good or a service. A page that presents itself as the authority when it is a private till, that invents urgency around a suspended scheme, and that conceals that nothing will be filed anywhere, is the textbook example of the misleading practices defined at articles L. 121-2 to L. 121-4 to which L. 121-1 points. The penalty is not symbolic. Article L. 132-2 of the same Code states that “Les pratiques commerciales trompeuses mentionnées aux articles L. 121-2 à L. 121-4 sont punies d’un emprisonnement de deux ans et d’une amende de 300 000 euros”, two years’ imprisonment and a 300,000-euro fine, and then raises the stakes for the online context that is ours: “Lorsque l’infraction a été commise par l’utilisation d’un service de communication au public en ligne ou par le biais d’un support numérique ou électronique, les peines sont portées à cinq ans d’emprisonnement et à 750 000 euros d’amende.” A scam run through a website therefore exposes its operators to five years and 750,000 euros, and the fine can rise further in proportion to the takings, up to 10 per cent of average annual turnover. That arithmetic is worth quoting in a complaint and in any letter to a bank’s disputes department, because it signals that the file is criminal, not a mere customer-service grievance.
The second layer is the payment: typically 20 to 60 euros dressed up as the “official fee plus processing”, sometimes with subscriptions or extra “priority” charges added after the card number is captured. Where the site invents an official status, invents a filing that never happens, and pockets the difference, French criminal law calls the conduct by its classic name. Article 313-1 of the Criminal Code (Code pénal) defines it in these terms: “L’escroquerie est le fait, soit par l’usage d’un faux nom ou d’une fausse qualité, soit par l’abus d’une qualité vraie, soit par l’emploi de manoeuvres frauduleuses, de tromper une personne physique ou morale et de la déterminer ainsi, à son préjudice ou au préjudice d’un tiers, à remettre des fonds, des valeurs ou un bien quelconque, à fournir un service ou à consentir un acte opérant obligation ou décharge.” Fraud, escroquerie, is the act, by use of a false name or false capacity, by abuse of a genuine capacity, or by fraudulent manoeuvres, of deceiving a person and thereby determining that person to hand over funds or valuables. “L’escroquerie est punie de cinq ans d’emprisonnement et de 375 000 euros d’amende”, five years and 375,000 euros. The courts apply that definition to staged authority with striking regularity. On 16 September 2026 the criminal chamber of the Court of Cassation (Cour de cassation, chambre criminelle, pourvoi no 25-83.924) upheld reasoning that had convicted defendants who, “pour obtenir ces fonds, mis en place une fausse entreprise, fait état d’un crédit imaginaire, l’activité de la société étant inexistante”, who to obtain the funds had set up a sham business and invoked an imaginary credit line while the activity did not exist, and it approved findings that brought out “l’existence de manoeuvres frauduleuses antérieures à la remise des fonds, notamment l’utilisation d’une fausse entreprise, d’un crédit imaginaire”, fraudulent manoeuvres prior to the handing over of the funds, including the use of a sham business and an imaginary credit facility. A website that dresses itself as the EU gateway and sells a filing that cannot exist is the digital twin of that sham business, and the manoeuvre necessarily precedes the payment, which is exactly the sequence the offence requires.
The third layer is the data: passport numbers, dates of birth, home addresses, sometimes scans, all entered by travellers who believed they were dealing with the authorities. Frontex warned expressly of data protection harm and identity theft, and the warning is easy to understand once the file is seen through a criminal’s eyes: a passport scan plus a home address is a full identity kit, reusable for other frauds long after the 30 euros are forgotten. French law treats that reuse as a separate wrong. Passing yourself off with another person’s identity details to disturb that person’s tranquillity or damage their honour, standing or interests is the offence of identity theft, usurpation d’identité, and the victim who later finds accounts or claims opened in their name has a second criminal head of complaint alongside the fraud. The practical consequence is immediate: treat any document sent to a suspect site as compromised, watch for follow-on approaches by email or telephone that reuse the same details, and never send additional “verification” payments or photographs to unlock a supposed refund, because the refund desk is the same operator under a second mask.
II. Paid a copycat ETIAS site before your France trip: how to get the money back and make the French complaint count
Discovering the payment bought nothing is unpleasant, but it is also the moment the file is strongest: the site still exists, the card statement shows the debit, and the screenshots prove what was promised. French procedure rewards victims who move in the right order, and the order below is built for a British resident or visitor acting partly from the United Kingdom and partly in France. It distinguishes three tracks that run in parallel rather than in sequence: stopping further loss at the bank, reporting the business to the consumer authorities, and entering the criminal process in a way that preserves a claim for damages. Readers who already know the companion guide on EES and ETIAS checks, refusals and remedies for British holidaymakers in France will find the same method here applied to the fraud that has grown up around the new border: identify the exact legal hook first, then use it everywhere the file travels.
A. How do I stop the payments and dispute the card debit from Britain?
Start with the bank, the same day if possible, and frame the call correctly. Two different refund routes exist, and confusing them is the most common reason files stall. The first route concerns payments you did not authorise at all: a second debit you never approved, a subscription added after a one-off fee, an amount different from the one displayed. For those, French banking law is blunt and fast. Article L. 133-18 of the Monetary and Financial Code (Code monétaire et financier) provides that “En cas d’opération de paiement non autorisée signalée par l’utilisateur dans les conditions prévues à l’article L. 133-24 , le prestataire de services de paiement du payeur rembourse au payeur le montant de l’opération non autorisée immédiatement après avoir pris connaissance de l’opération ou après en avoir été informé, et en tout état de cause au plus tard à la fin du premier jour ouvrable suivant”, meaning that where an unauthorised payment transaction is reported by the user, the payer’s payment service provider refunds the amount immediately after learning of it and in any event no later than the end of the next business day, restoring the debited account to the position it would have been in. Report in writing through the bank’s messaging system as well as by telephone, state expressly that the transaction was not authorised, and keep the written acknowledgment, because the next-business-day clock runs from the bank’s knowledge. The only escape the statute gives the bank is a genuine suspicion of fraud by the user itself, notified in writing to the Banque de France, the French central bank, which is not the situation of a traveller reporting a scam.
The second route concerns the payment you did authorise, the initial 20, 40 or 60 euros typed willingly into a site that turned out to be a copycat. No statute forces an automatic next-day refund there, but the file is far from hopeless, and three levers work together. First, the card network’s dispute procedure, commonly called a chargeback, allows the issuing bank to reverse a card payment for services not provided, and a filing that could never be made because the scheme is suspended is the clearest possible case of a service not provided. Ask the bank expressly for its “litige carte” or card-dispute form rather than a generic complaint, attach the screenshots showing the promise, the ABTA warning and the receipt, and quote the misleading-practices penalties, because dispute handlers escalate criminal-pattern files faster than billing queries. Second, oppose any recurring element at once: cancel the card if the site stored its number, since the operator who sold one fake filing will sell a second charge more easily than it will find a new victim, and confirm in writing that no further debit is authorised, which moves any later taking into the automatic-refund route above. Third, write to the site itself demanding repayment within a short stated deadline, by email and through any contact form, keeping proof of sending. The letter rarely produces money, but it proves the operator was put on notice, it fixes the date from which interest and persistence can be shown, and judges reading the file later see a victim who behaved as the reasonable consumer the statutes protect. Throughout, never pay a “refund fee”, “release fee” or “verification deposit” to recover the first sum: no French authority, bank or court releases money against an upfront fee, and that demand is the standard second act of the same fraud.
Where identity documents were transmitted, add two same-day measures. Ask the bank to flag the account for identity-theft watch, since the card number travelled with the passport data, and prepare to renew any passport whose scan was uploaded if the fraud-monitoring signs appear, through the normal United Kingdom passport channel. On the French side, note precisely what was sent and when, because the criminal complaint will need that inventory, and because limitation periods for concealed wrongdoing run from discovery, a point developed below. None of these steps requires residence in France, a French bank account or a French lawyer: a British account holder calls a British bank, and the French dimension enters through the reports and the complaint, which is where the next section turns.
B. Where do I report the scam in France: SignalConso, the THESEE online complaint and the criminal complaint that carries a civil claim?
France offers three doors, and the efficient victim knocks on all three, because each produces a different piece of paper and the pieces reinforce each other. The first door is the consumer authority. SignalConso, the online reporting platform run by the DGCCRF, the French competition, consumer affairs and fraud prevention directorate, at signal.conso.gouv.fr, collects reports against businesses that breach consumer law, and a copycat ETIAS site trading from or towards France is its natural target. The report takes minutes, can be filed from abroad, and triggers the administrative track: inspectors can investigate, order compliance and pass findings to the prosecutor. Name the misleading-practices provisions in the free-text box, describe the passing-off, the invented urgency and the fee for nothing, and upload the screenshots. The acknowledgment rarely brings personal compensation, and that limitation should be understood rather than resented: SignalConso polices the market, while compensation travels through the bank dispute and the criminal complaint.
The second door is the police report, the plainte, and here French procedure has a purpose-built online channel for exactly this pattern. The public guidance on filing a complaint explains that a victim who does not know the perpetrator may report online, and that victims of internet scams, arnaques sur internet, may file through THESEE, the Interior Ministry’s dedicated teleservice, whose listed cases expressly include phishing, hameçonnage, and purchases from a fake commercial site, l’achat sur un faux site commercial. A copycat ETIAS page is precisely a fake commercial site, and where passport data was phished alongside the payment, the phishing head applies too. The official page for filing a complaint (plainte) sets out the mechanism: the online statement is examined by an officer who decides whether it can become a formal complaint record, a procès-verbal de plainte, with a digital copy made available if accepted. File in French or with a short French summary of an English narrative, list every debit with dates and amounts, inventory the documents transmitted, and attach the screenshots and the bank’s acknowledgment. If THESEE declares itself unavailable for the case, the fallback is unchanged: file at any commissariat or gendarmerie in person, or by letter to the public prosecutor, the procureur de la République, of the place of the facts or of your French address. Keep the receipt, récépissé, of everything, because the third door is timed from it.
The third door is the one that converts a police file into a personal remedy: the complaint joined with a civil-party claim, the plainte avec constitution de partie civile, before the investigating judge, the juge d’instruction. Article 85 of the Code of Criminal Procedure (Code de procédure pénale) opens it in these words: “Toute personne qui se prétend lésée par un crime ou un délit peut en portant plainte se constituer partie civile devant le juge d’instruction compétent”, any person claiming to have been harmed by a felony or misdemeanour may, by filing a complaint, become a civil party before the competent investigating judge. For a misdemeanour such as fraud, one timing condition applies, and the same article states it: the civil-party complaint is admissible only if the victim shows either that the prosecutor, after a complaint filed with the prosecutor or with the police, has indicated no prosecution will be brought, or that three months have passed since the complaint was filed with acknowledgment of receipt. In practice the sequence is therefore: complaint first, diary the three-month date, then, if the prosecutor has closed the file or stayed silent, the civil-party complaint reopens the matter before a judge and carries the damages claim, the action civile, for the sums paid, the bank charges, the replacement documents and the proven consequential loss. Victims who discover the fraud late should know that French law anticipated the concealed scam. Article 9-1 of the Code of Criminal Procedure provides that limitation for a hidden offence runs from the day it appeared and could be established in conditions allowing prosecution, capped at twelve full years from commission for misdemeanours, and it defines the concealed offence as the one “dont l’auteur accomplit délibérément toute manœuvre caractérisée tendant à en empêcher la découverte”, where the perpetrator deliberately carries out a characterised manoeuvre aimed at preventing its discovery. The Court of Cassation gave that definition teeth in a Bulletin-published fraud ruling on 25 March 2026 (pourvoi no 24-80.607), holding that a fraud may be characterised as concealed where the statutory conditions are met, and approving findings that, throughout the whole period, the defendant, who held administrative and financial responsibility, had manufactured false invoices to justify sums unduly paid to him so that the facts stayed hidden until he left the company: “l’arrêt attaqué énonce que, pendant toute la période de prévention, M. [U], qui exerçait des fonctions de responsable administratif et financier, a confectionné des fausses factures pour justifier les paiements qu’il s’est fait remettre indûment de sorte que les faits sont restés dissimulés jusqu’à son départ de l’entreprise”. The Court added: “En l’état de ces seules énonciations, dont il résulte que le prévenu a délibérément accompli une manoeuvre caractérisée afin d’empêcher la découverte de l’escroquerie”, those findings alone showing a deliberate characterised manoeuvre aimed at preventing discovery of the fraud. A copycat site that mimics the EU gateway, invents filings and buries its identity behind privacy-protected domains performs the same concealing function as those false invoices, and a traveller who finds the debit months later on a statement is not out of time. File, keep every receipt, and let the prosecutor or the investigating judge, not the site’s vanished “support desk”, have the last word.
Conclusion
The position on 14 October 2026 is unusually clear for a fast-moving story. ETIAS exists in law but not in operation: no British traveller to France needs an authorisation today, no one should pay for one, and the only channel that will ever count is the EU’s own site inside the europa.eu domain. The more than 150 copycat sites counted in October 2026 reporting sell urgency around a suspended scheme, and French law answers each layer of their model, misleading commercial practices punishable by up to five years and 750,000 euros when committed online, fraud punishable by five years and 375,000 euros on facts the Court of Cassation has already described as sham businesses and imaginary facilities, and a banking rule that refunds unauthorised payments by the next business day. The victim’s sequence follows from that map: freeze the card and dispute the debit in writing, report the business on SignalConso, file the THESEE or police complaint with the full screenshot file, and, if the prosecutor does not act within three months, carry the damages claim before the investigating judge as a civil party, with limitation running from discovery for a concealed fraud. Keep the evidence, pay nothing further to anyone promising to unlock a refund, and check the official EU page before every future trip. The border is changing, and the change will come with a real 20-euro authorisation one day, but that day has not arrived, and until it does, the cheapest ETIAS is the one nobody pays for.