Phishing was yesterday. Now watch out for smishing!

We all think we’re too canny to get caught out by these obvious scams…until we’re not! 

SMISHING

If you live in France, you’ve probably received a text message at some point saying something like:

“Votre colis est en attente de livraison…”
“Votre colis ne rentre pas dans votre boîte aux lettres…”
“Veuillez payer 1,99 € de frais de livraison…”
“Choisissez un nouveau créneau de livraison…”

With Christmas approaching, and many of us ordering gifts from France, the UK and elsewhere, these messages can look very convincing — especially when you really are expecting a parcel. And particularly now the scammers have learnt to spell thanks to AI!

This is called smishing: phishing by SMS.

What is smishing?

Smishing is a form of phishing carried out by text message.

The scammer pretends to be a legitimate organisation — very often a delivery company — and tries to persuade you to click on a link or provide personal or financial information.

You might receive a message claiming:

• your parcel is waiting for delivery;
• your address is incomplete;
• the parcel is too large for your letterbox;
• you need to choose another delivery slot;
• a small postage or customs charge needs to be paid;
• your parcel will otherwise be returned to the sender.

The message may appear to come from La Poste, Colissimo, Chronopost, DPD, Mondial Relay, UPS or another well-known delivery company.

And increasingly, the message may look extremely convincing, particularly since the scammers have learnt to spell thanks to AI!

Scammers can create websites that closely imitate the real website of a delivery company. They may also have your name, address or other information, making the message appear genuine.

Some scams have even used convincing photographs of a parcel bearing the victim’s name and address.

The most important rule: don’t click the link

If you receive an unexpected delivery SMS containing a link, don’t click it. even if you really are expecting a parcel.

That’s actually what makes these scams so effective. At Christmas, when you may have several parcels on their way, it is very easy to think: “Ah yes, that must be the parcel from the UK / the Christmas presents / that order I made last week.”

Instead, check the delivery independently. Go to the website or app of the retailer where you made the purchase, or find the delivery company’s official website yourself. Then enter the tracking number there.

Don’t use the link supplied in the SMS.

What should make you suspicious?

Be particularly careful if the message:

• asks you to pay a small amount to receive your parcel;
• asks for your bank card details;
• says your parcel will be returned unless you act immediately;
• asks you to confirm your address or other personal information;
• contains a link to a website you don’t recognise;
• asks you to download an application;
• asks you to telephone a number contained in the SMS;
• uses urgent or threatening language such as “dernier avis” or “action immédiate”.

A very small payment is not reassuring.

In fact, asking for €1, €2 or €3 can be part of the trick. The aim may be to obtain your card details rather than the small payment itself.

What about the website address?

If you DO click a link — and preferably don’t— look carefully at the web address.

A fraudulent website may look almost identical to the genuine one, including logos, colours and photographs.

The difference may be hidden in the address itself: an extra word, a different domain ending, an additional hyphen or a spelling designed to look authentic.

Don’t assume that a padlock symbol or a page that looks professional means that the website is genuine.

The safest approach is much simpler:

Don’t follow the link. Find the official website yourself.

🇫🇷 A special warning for foreign residents in France

This is particularly worth remembering if French isn’t your first language. A message in French from a familiar company can look very official, and it can be tempting to click simply because you aren’t completely sure what the message is asking you to do.

Don’t be embarrassed about asking someone you trust to look at it.

If you are unsure, do nothing until you’ve checked it independently.

Even a message without a link can be part of the scam

One particularly sneaky variation starts with a seemingly innocent message. You might receive something like:

“Bonjour, vous êtes chez vous ?”

“Hello, are you at home?”

There may be no link and no obvious request for money. The aim can simply be to get you to reply.

Once you have responded, the scammer can continue the conversation and eventually send a malicious link or attempt to obtain more information.

So don’t feel obliged to reply to an unexpected message simply because it doesn’t initially look like a scam.

You don’t have to answer a stranger who texts you about a parcel.

Never download an app from a delivery SMS

Another variation asks you to install an application because the delivery company supposedly needs it to arrange delivery.

Don’t do it.

Never install or update an application using a link received by SMS. Use the official app store on your phone instead. A malicious application can potentially give criminals access to information on your device or be used for further fraud.

What if you’ve already clicked?

Don’t panic. What you should do depends on what happened next.

You received the SMS but did nothing

Delete it and report it if possible.

You clicked the link but didn’t enter any information

Close the page. Don’t download anything and don’t follow any further instructions. If anything was downloaded or installed, or if your phone begins behaving strangely, seek appropriate technical assistance.

You entered your bank card details

Contact your bank immediately. Explain that you may have given your card details to a fraudulent website and ask what action is required, including blocking or replacing the card.Keep the SMS, screenshots and details of the fraudulent website as evidence.

You entered a password

Change that password immediately on the genuine website. If you’ve used the same password anywhere else, change it there too.

You installed an application

Don’t assume that deleting the SMS solves the problem. If you installed an application from a suspicious link, get advice promptly and consider having the device checked.

📞 How to report a suspicious SMS in France

– 33700

Suspicious SMS messages can be reported through 33700, the French service dedicated to combating unwanted and fraudulent communications.Reporting messages helps the authorities and operators identify fraudulent campaigns. It is unlikely that you will hear back from them so don’t hold your breath.

You should also consider reporting the scam to the delivery company whose identity has been used.

– Info Escroqueries — 0 805 805 817

The French Ministry of the Interior’s Info Escroqueries service can provide information and guidance if you’ve encountered an online scam.

The service is free and operates Monday to Friday, from 9:00 to 18:30.

– France Victimes — 116 006

If you have actually become a victim and don’t know where to start, France Victimes can provide help and guidance.

The service is free and available 7 days a week, from 9:00 to 19:00.

If your bank card has been used fraudulently

Contact your bank as quickly as possible. For eligible cases of payment-card fraud, you can also make a report through Perceval, the French government’s online reporting service.

If you’ve suffered a financial loss or been the victim of an offence, you can also contact the police or gendarmerie.

For certain types of online fraud, a complaint can be started online through THESEE. Not every situation qualifies, however, so if you’re unsure, contact the police or gendarmerie directly.

Keep all the evidence: SMS messages, screenshots, emails, telephone numbers, website addresses, payment records and bank statements.

REMEMBER: Just because you’re expecting it doesnt make it true!

Don’t assume that a message must be genuine because you are expecting something from abroad — or because the message uses your correct French address.

Scammers can obtain surprisingly accurate personal information, and they deliberately target people at moments when a delivery is plausible.

If you’re unsure, ask a French-speaking friend, neighbour or family member to look at the message before doing anything. Five minutes of checking can save a great deal of trouble.

And remember the golden rule:

STOP. DON’T CLICK. CHECK FOR YOURSELF.

With Christmas shopping coming up, please share this with friends, neighbours and especially anyone who might not be completely comfortable navigating French websites and official services.

A suspicious SMS is annoying.

Giving a criminal your bank details is considerably more annoying. 😬

Information based on current guidance from Cybermalveillance.gouv.fr and French government services. (⁠CYBERMALVEILLANCE.GOUV.FR)

Useful French words you may see in a scam SMS

Scammers often use ordinary French delivery and postal vocabulary to make their messages sound genuine. Here are some of the words worth recognising:

A word of caution

Seeing these words in an SMS doesn’t mean the message is fraudulent. They are perfectly normal French words. The warning signs are the combination of the message, an unexpected request, urgency, a link and a request for payment or personal information.

The simple rule to remember

If a text message tells you that something is wrong with your parcel and you need to click, pay, download something or provide information, stop.

• Don’t use the link.
• Don’t call the number in the message.
• Don’t download the app.
• Instead, find the official company website or app yourself and check what is happening.

A few extra seconds of caution can save you a great deal of trouble. The criminals are counting on people being busy, distracted and slightly worried about missing their parcel.

STOP. DON’T CLICK. CHECK FOR YOURSELF.

French banking
La Poste
French emergency/help numbers,