Your company has just been registered. A week later, a letter arrives: an official-looking letterhead, your correct SIREN number (the nine-digit identifier every French business receives), an amount to pay "within seven days or face removal from the register", and a QR code to pay with. On 6 August 2026, INPI, France's intellectual property office, which also runs the online one-stop shop for business formalities, published an alert about this kind of letter, with a sentence worth remembering: "These requests are fraudulent, as INPI never sends letters asking for payment by QR code" (INPI).
This article, part of our series on the paperwork of setting up a business in France, is for anyone who has just created or taken over a company there, or registered as self-employed in France, and is now finding official-looking demands in the post. The bodies and procedures it describes are French; the box further down covers the UK.
It isn't an isolated case. As early as 2019, the French government noted that "many businesses, often newly created ones, are the target of fraudulent practices" (Assemblée nationale).
Why do these letters find you so quickly?
Because registration is public, by design. As soon as the company exists, its name, SIREN number, address, date of incorporation and the name of its director can be looked up free of charge, and the annonce légale (the legal notice every French company must publish in an authorised journal when it is formed) has already printed them (see the episode on articles of association). Fraudsters have nothing to hack: they read the new registrations and send their letters to the addresses listed. One specialist website observes that these letters arrive between 7 and 30 days after registration (Jedeclaremonmeuble).
That's also what makes them believable: the letter knows your number, your date of incorporation, sometimes your line of business. But this information is public; knowing it proves nothing.
What do they look like?
The fake INPI notice. A paper letter, an INPI letterhead, a QR code, a demand for payment "within seven days or face removal from the register" (INPI). Formality fees are paid online when you file on the guichet unique, the single government portal for business formalities, not afterwards, by post.
The fake register. A "Registre des sociétés et des indépendants" (register of companies and self-employed people) demanded 890 euros within seven days, with a QR code leading to a payment page; "this register doesn't exist and you owe nobody anything", concludes a specialist platform (Superindep). A "Registre numérique des entreprises" (digital business register) demands 195.18 euros within eight days "to finalise your registration", with a fake Cerfa number, the reference that official French forms carry (Jedeclaremonmeuble). Infogreffe, the online portal of France's commercial court registries (the greffes), lists more than 120 websites and letters of this kind in a directory updated on 8 September 2026: RSCI, E-siren, CNRCS, ANRCS, "Identification légale", "Registre TVA Intracommunautaire"… (Infogreffe). LegalPlace, a French legal-services platform, names others and points out that "URSSAF will never ask you to pay anything other than your social contributions" (LegalPlace); Urssaf is the body that collects social security contributions in France.
The business directory. A form presented as a simple "update of your contact details" is in fact an order form for a paid listing in a directory, often over several years. The DGCCRF, France's consumer protection and anti-fraud authority, notes that newly registered businesses are favourite targets, and advises: "Never sign in a hurry" (DGCCRF).
The fake trade mark invoice. If you've filed a trade mark, companies offer to "publish" or "renew" it in private registers. INPI points out that only publication in the BOPI, its official industrial property bulletin, has legal effect: "Any other listing has no legal effect" (INPI, a warning you can download from this page).
Watch the names: the European Business Register was a legitimate network of official European business registers, which ended its services on 31 March 2026 (Estonian register). The scams play on names close to those of real bodies.
How do you spot a fake letter?
No single sign is conclusive, but together they are:
- urgency: seven or eight days to pay, under threat of removal from the register or a penalty;
- an unusual way to pay: a QR code, a foreign IBAN, a generic online payment page;
- a name that sounds like an official body without being one: "register", "directory", "national", "official", a rough imitation of Marianne, the emblem on French government documents;
- small print revealing an optional commercial offer, often on the back;
- an organisation you don't know and have never dealt with.
Remember what you actually paid, at the time of filing: for a company, the registry fees and the annonce légale; for a micro-entreprise (France's simplified regime for sole traders), nothing, as registration is free. There is no extra registration fee to pay by post after registration.
What about where you are? UK companies get the same post. Companies House warns that scam letters may include QR codes, bank details, Companies House logos and "pressure to act quickly", and that "scammers have sent companies 'notifications' asking for money to maintain their company on a register", from names such as "New Companies Register" or "National Register of Companies": "This is not a real fee and Companies House is not connected to any of these organisations" (GOV.UK). If you receive one, don't pay, don't follow any link or QR code, and call Companies House on 0303 1234 500; it adds that it will never call you to ask for passwords, bank details or your authentication code.
What should you do if in doubt, or if you've paid?
Don't scan the QR code and don't call the number on the letter. Go to the official website yourself, typing in the address: formalites.entreprises.gouv.fr for your formalities, inpi.fr for a trade mark, your Urssaf account or impots.gouv.fr, the French tax website. A QR code doesn't show where it leads until you scan it: that's what makes it the favourite tool of these letters, as we explain in Phishing QR codes are hiding in PDFs. If the letter arrives as a PDF attached to an email, don't open it blindly: Inspect PDF flags, without sending the file to a server, the presence of links and active mechanisms (JavaScript, an automatic action on opening, an attached file, a form submission). It doesn't show the link addresses and doesn't read QR codes.
If you've paid: tell your bank immediately, as it can sometimes block or dispute the payment; keep the letter and proof of payment; report it on SignalConso, the French government's service for reporting problems with a business, and file a complaint with the police. For a signed directory order form, the DGCCRF advises first trying to settle it amicably by recorded-delivery letter with proof of receipt, then, if there's no reply, contacting the DDPP, its local office in your département; if the company is abroad, it recommends filing a complaint for fraud. It also warns that when the contract was properly signed, the fraudulent nature "is difficult to prove" (DGCCRF). Cybermalveillance.gouv.fr, the French government's support service for victims of cybercrime, helps victims: in 2025, phishing ranked "first among threats, for all types of victim", up 70% (Cybermalveillance.gouv.fr).
Keep a record. File your genuine proof of formalities (the guichet unique receipt, the invoice for the annonce légale) in one folder: faced with a dubious letter, you only need to check that it matches nothing you actually ordered.
Glossary
Phishing: posing as a trusted organisation to obtain a payment or information.
BOPI: Bulletin officiel de la propriété industrielle, the official industrial property bulletin, the only publication of trade marks that has legal effect.
SignalConso: the French public service for reporting problems encountered with a business.
DDPP: direction départementale de la protection des populations, the DGCCRF's local office in each département.
Misleading commercial practice: a practice that misleads people about the nature of a service or about who is offering it; in France, it is a criminal offence.
Check a suspicious PDF without sending it to anyone: PDFKami, in your browser.