Malwarebytes says a newer scam copies Free Mobile’s branding and asks customers to pay a €9.99 invoice. Check account messages through the official app or website instead of clicking email links.
In 60 seconds
- Free Mobile customers who receive invoice or account emails should treat unexpected payment requests with care.
- Check your account through the official Free Mobile app, mobile.free.fr, or 3244—not through the email.
- The reported scam asks for card details on a page that copies Free Mobile’s website.
- Do not click the email link, enter payment details, or trust a familiar logo by itself.
Who should pay attention
Free Mobile customers in France should watch for an email saying a €9.99 invoice must be paid or service will be suspended. Malwarebytes reports that the campaign is designed to look like a real Free Mobile message.
The email used the Free Mobile logo and a familiar-looking template, but came from the address freemobile-regularisation[@]knowledgegrowthcenter[.]help. That mismatch is a useful warning sign. The report says the scam page asks for credit card details.
How to check without using the message
Do not use links in an unexpected email about an account or invoice. Open the official Free Mobile app directly, type mobile.free.fr into your browser, or call the official help line at 3244, as Malwarebytes advises.
If you inspect a link, look at the actual domain in the browser’s address bar. Malwarebytes says the expected Free Mobile site is mobile.free.fr. A page that uses a different domain, even one with “free” or “mobile” in its name, should not be treated as official.
Why this campaign may look believable
Malwarebytes says Free Mobile suffered an October 2024 data breach that exposed sensitive customer records, including bank account details and login information. The company was later fined €27 million by France’s data protection regulator, the CNIL, according to the report.
Since the breach, Malwarebytes says it has seen scam campaigns aimed at Free Mobile customers. The newer campaign stands out because its wording and design are more polished than earlier examples. The reported links passed through several addresses before reaching a fake payment page, which can hide the final destination from a recipient who clicks quickly.
What to do with a suspicious message
Treat an unexpected account or invoice message as untrusted until you verify it outside the message. Check the account through the official app or website, or contact Free Mobile at 3244. Do not enter card details into a page reached from the email.
Malwarebytes also recommends keeping real-time anti-malware protection with web protection up to date. That may help block scam pages, but it does not replace checking the address and using an official route.
Does this affect me?
- Who may be affected
- Free Mobile customers who receive unexpected emails about invoices, payment, or possible service suspension should care. Anyone managing a family or work phone account should check messages before forwarding them or paying.
- How to check
- Look at the sender’s full email address and the website address, then verify the account in the official Free Mobile app, at mobile.free.fr, or through 3244.
- What to do
- Delete or ignore the email link and use an official Free Mobile channel to check whether an invoice is actually due.
- What to avoid
- Avoid clicking unexpected links, entering card details on a linked page, or trusting a logo and copied website design as proof of authenticity.
Common questions
What does the reported Free Mobile scam ask for?
The email says a €9.99 invoice must be paid to prevent service suspension. The linked page asks for credit card details, according to Malwarebytes.
How can I check whether my Free Mobile account really has an unpaid bill?
Open the official Free Mobile app, type mobile.free.fr into your browser, or call 3244. Do not use the link inside the email.
Does a Free Mobile logo mean the email is genuine?
No. Malwarebytes says this campaign copied Free Mobile’s logo and email design. Check the sender and the actual website address instead.
What should I look for in the web address?
Malwarebytes says the expected site is mobile.free.fr. Be cautious if the address leads somewhere else, even if it contains words such as “free,” “mobile,” or “regularisation.”
Primary source
This draft uses Malwarebytes’ report, “Convincing Free Mobile phishing emails appear after data breach,” published October 1, 2026: https://www.malwarebytes.com/blog/threat-intel/2026/10/free-mobile-phishing-texts-appear-days-after-data-breach. See the linked original for the complete technical details and examples. Read the complete original source.
Get the important updates without the noise
Choose the devices and topics you care about in Cyber Alerts.
Article history: Published Oct 2, 2026 at 7:08 pm EDT. Updates and corrections are noted here when material facts change.
