"BANK: attempted transfer of €1,249.00 to an unknown beneficiary. If you did not authorise this operation, do nothing, an adviser will call you back."
This text message has one formidable feature: it asks you for nothing. No link to click, no form to fill in, no code to enter. All it does is instil a fear — that of watching your money disappear — and announce a solution that will come to you on its own. Two minutes later, the phone rings. The screen displays your branch's number, the one printed on the back of your bank card. And at that moment, the victim drops every defence.
This is what's known as the fake bank adviser scam, or "CEO fraud, consumer edition". It is today one of the costliest frauds for French households: the sums stolen are rarely counted in tens of euros, but in thousands, sometimes tens of thousands. The Banque de France and the Observatoire de la sécurité des moyens de paiement regularly warn about this "manipulation fraud", in which it is the victim who carries out the fraudulent operations.
Why this text message doesn't look like a scam
Classic smishing campaigns — the fake parcel, the fake fine, the fake health card — all rely on a booby-trapped link. We have learned to be wary of links. Fraudsters have adapted.
The fake-adviser text message is designed to slip past every mental filter we have built:
- It contains no link: impossible to "click by mistake".
- It asks for no data: nothing to enter, so seemingly nothing to steal.
- It explicitly tells you to do nothing: which, paradoxically, inspires trust. A crook would want you to act, or so we assume.
- It often appears in your bank's existing message thread, right after the genuine one-time-code messages.
That last point deserves an explanation. In France, business text messages use an "alphanumeric sender ID": instead of a number, you see "MaBanque", "Ameli" or "Colissimo". This field is not authenticated end to end: a fraudster can fill it in at will through certain international gateways. The result: the phone, which sorts messages by sender name, files the fake message alongside the real ones. The fraudulent message thus inherits all the credibility built up over months of legitimate messages.
The text message isn't the scam. The text message is the stage setting that makes the call believable.
The call: thirty minutes of well-rehearsed theatre
The call that follows is the heart of the operation. It uses telephone spoofing: the caller ID is falsified to display your bank's number. Since the implementation of the Naegelen law and the number authentication scheme set up by Arcep, French operators filter out some of these spoofed calls — but blind spots remain, particularly with calls routed through foreign operators.
On the line, the voice is calm, professional, almost bored by the routine. It never asks for your password. That is precisely what makes it credible.
Step 1: establishing authority
The fake adviser introduces themselves with a name, an employee number, sometimes a department ("anti-fraud department, Nantes platform"). They recite information only they should know: the last four digits of your card, your date of birth, the name of your branch, sometimes your most recent transactions. This data comes from leaked customer databases or from an earlier phishing attack.
Step 2: reversing the burden of proof
"For your security, I need to verify that I'm speaking to the account holder." You are the one who must prove your identity, even though they are the one who called. This reversal is a social engineering classic: it puts the victim in the position of supplicant.
Step 3: creating controlled urgency
"Three payment attempts are currently being processed. I have 12 minutes before interbank clearing validates them definitively." The countdown prevents any verification, any call to a relative, any stepping back.
Step 4: the decisive request
It takes one of these forms:
| What the fake adviser asks for | What actually happens |
|---|---|
| "Approve the notification in your app to cancel the operation" | You approve a transfer or the addition of a beneficiary |
| "Read me the 6-digit code I've just sent you" | They validate an online payment with your card |
| "We're moving your funds to a secure holding account" | You transfer your savings to a mule account |
| "Install this support app so I can run a diagnostic" | They take remote control of your phone |
| "A courier will come to collect your card for destruction" | They collect the card, which is still usable |
The "holding account", the "escrow account" or the "Banque de France vault" do not exist. No bank, no institution, no authority has a holding account into which a private individual should transfer their savings. That is the central fiction of the scam.
The signs that give the fake adviser away
Some elements never lie, even when everything else seems genuine.
1. A genuine adviser never asks you to approve anything during the call. Not a code received by text, not an app notification, not a fingerprint. Strong authentication exists to authorise an operation, never to cancel one. If you're asked to approve something in order to cancel it, you are being defrauded. That is the one criterion to remember if you remember only one.
2. A genuine adviser is fine with you calling back. A fake one never is. They will invoke the queue, the overloaded line, the lost case file, the liability that would fall on you. The right answer never varies: "I'm hanging up and calling the number on the back of my card."
3. A genuine adviser never has you install software. Remote-access applications are legitimate tools being misused. A bank will never ask you to install one.
4. A genuine adviser never asks you to lie. "If your bank calls you, say it's a furniture purchase": this line, very common in transfer fraud scripts, is a complete confession.
5. Time pressure is always artificial. Under the French monetary and financial code, a suspicious transfer can be disputed for thirteen months. No operation ever hinges on twelve minutes.
The move that breaks everything: hang up and call back
There is a countermeasure of absolute simplicity, and it is enough to derail the entire script: hang up, then call the official number yourself.
Hanging up is not rude. Nor is it "taking a risk": if the call was legitimate, the bank will call you back or will have a record of the incident. One precaution does apply, however, on older landlines: some crooks used to stay on the line to simulate a dial tone. On a mobile, that risk is nil once the call has genuinely been ended; if in doubt, use another device, or wait thirty seconds before dialling.
For people who still use a landline a great deal, particularly older people, a landline phone with call screening and blocking of unknown numbers eliminates a large share of these approaches before the phone even rings. The principle is the same as for text messages: fewer unsolicited contacts, fewer opportunities to be caught out.
Three numbers to know, and to save before you need them:
- Your branch's number, copied from the back of your bank card or from a paper statement — never from a text message or a search engine result, where fake numbers are sometimes listed.
- 0 892 705 705: the interbank card-blocking service, available 24/7.
- 17 119: the national helpline for victims of cyberattacks and online fraud, free, open every day.
What to do in the hour following a fraudulent operation
Reaction time directly determines your chances of recovering the funds. A SEPA transfer is not instantly irreversible: a funds recall request can sometimes be triggered by the sending bank if the money has not yet been withdrawn from the recipient account.
- Block the card immediately and, if necessary, request a freeze on outgoing transfers.
- Change your online banking credentials from a device other than the one potentially compromised.
- Uninstall any app installed during the call, then check for apps with extended permissions in your phone's settings.
- Write a dated, time-stamped statement to the bank: time of the call, number displayed, name given by the caller, amounts, recipient IBAN if visible. Send it by registered post with acknowledgement of receipt. A simple A5 notepad kept near the phone lets you jot these details down in the moment, while your memory is still fresh — that is often what makes the difference in a case file.
- File a complaint at a police station or gendarmerie. Filing a complaint is not a legal condition for reimbursement, but it strengthens the case.
- Report the text message to 33700 by forwarding it, and report the fraudulent call on the Signal Conso platform or to 33700 as well.
What the law says about reimbursement
This is the point most victims are unaware of, and one that some banks are careful not to explain.
The French monetary and financial code (articles L133-18 et seq.) sets out a clear principle: in the event of an unauthorised payment transaction, the bank must reimburse immediately, at the latest by the first business day following the report. It can only refuse if it demonstrates gross negligence on the customer's part — and the burden of proof lies with the bank, not with the customer to prove their innocence.
The Cour de cassation has moreover handed down several decisions favourable to spoofing victims. In a notable 2024 ruling, the commercial chamber held that disclosing security data to a caller presenting themselves as an adviser, in a context where the number displayed was the bank's own, did not automatically constitute gross negligence. In other words: when the impersonation is technically convincing, the fault does not fall mechanically on the victim.
In practice:
- If the bank refuses, first contact its complaints department, in writing.
- Then the institution's banking ombudsman (free, response within 90 days in principle).
- As a last resort, the protection litigation judge. Associations such as UFC-Que Choisir and CLCV regularly assist with cases of this kind.
Watch out for one important nuance: protection is considerably stronger for unauthorised operations (a payment made without your knowledge) than for transfers the victim ordered themselves under manipulation. The distinction is technical, but it can be argued — all the more so as the European payment services directive currently under revision provides for extending compensation to cases of fraud involving the impersonation of a financial institution.
Preparing the ground before you're targeted
This scam strikes indiscriminately, but it succeeds more often when the person is alone, rushed, or unfamiliar with banking mechanisms. A few measures taken in advance radically change the outcome.
Cap your transfers. Most banks let you set a daily transfer limit in the app settings. Lowering that limit to a realistic amount (€500 or €1,000) turns a catastrophe into an incident. Raising it takes time — and time is precisely the crook's enemy.
Ring-fence your savings. A savings account not linked to instant transfers, or whose movements require a visit to a branch, keeps the bulk of your assets out of reach.
Agree on a family password. A phrase known only to you, to be requested when a relative calls you about a financial emergency. It also works against the "child in distress" scam.
Write the rule down on paper. A notebook with alphabetical index placed near the phone, listing the genuine numbers and the sentence "I always hang up and call back", is a considerable help to people who go to pieces under pressure. It's basic, and it works.
Learn without frightening yourself. There are excellent accessible books on cybersecurity for private individuals, written without jargon, that explain the mechanics of manipulation rather than the technology. Cybermalveillance.gouv.fr also publishes free, printable quick-reference sheets to put up at home or at an elderly relative's.
Protect the device itself. A phone damaged or out of service at the wrong moment means being unable to block your card quickly. A reinforced protective case and a portable power bank are not comfort accessories in this context: they are guarantees that you'll be able to act.
In summary
The fake bank adviser scam relies neither on hacking nor on a technical flaw. It relies on a sequence: a text message that creates anxiety, a call that brings relief, an authority that reassures, an urgency that prevents thought.
A single sentence defuses the whole set-up, and it deserves to be repeated out loud until it becomes a reflex:
"I'm hanging up, and I'll call the number on the back of my card myself."
No legitimate adviser will take offence. No crook will survive it.
