"AGENCY: the transfer of your security deposit (€1,180.00) was rejected by your bank. Please confirm your bank details within 48h to avoid closure of your file: http://espace-locataire-remb.fr/xk29"
You handed back the keys three weeks ago. The move-out inspection went well, but the agent mentioned "a small deduction for the bedroom walls". Since then, radio silence. You followed up once by email, with no reply. And then this text message arrives, with the right amount — or almost — and an explanation that matches exactly what you were expecting.
You click. Because you have already paid the first month's rent on the new place, the deposit on the new lease, the van, and you need those 1,180 euros now.
That is the whole art of this scam: it does not create the anxiety, it settles on top of it.
Why the end of a lease is an ideal window of opportunity
Most smishing campaigns arrive cold: a parcel you are not expecting, a fine you never received, a bank account you are told is about to be frozen. They work on volume, hoping to land on someone who, that particular day, really was waiting for a parcel.
The fake security deposit text works differently. It targets a group of people who are genuinely waiting for money, who know the payment can take a while, and who often do not know the exact procedure.
It is worth recalling the legal framework, because it is the raw material of the scam. The French law of 6 July 1989 governing landlord-tenant relations requires the landlord to return the security deposit:
- within one month of the keys being handed back if the move-out inspection matches the move-in inspection;
- within two months where differences justify deductions.
Beyond that deadline, the landlord must increase the sum by 10% of the monthly rent excluding charges for each month of delay started. This is what the public service information site and ANIL (Agence nationale pour l'information sur le logement) point out; the latter receives thousands of questions on this precise subject every year.
The result: between the day the keys are handed over and the day of the transfer, there is a grey zone of thirty to sixty days during which you wait, you do not know when the money will land, and you find it perfectly normal to receive a message from the agency. That zone is exactly what the scammers have identified.
How they know you are moving
That is the question that always comes up. Four main sources, and none of them requires sophisticated hacking.
Public property listings. When a home goes back on the rental market, the ad contains the approximate address, the rent, the floor area and the availability date. A scammer who cross-references that date with a list of phone numbers can blanket-target a whole neighbourhood: out of a hundred messages sent, a handful of recipients really will be at the end of their lease.
Data breaches. Property search platforms, sites connecting tenants and landlords, and online removal services have all had incidents. The rental application file you put together contains your name, phone number, income and employer — a dream summary for building a credible scenario.
Change of address. Signing up for a new internet box, an electricity contract or mail forwarding: each step multiplies the copies of your contact details across different systems, with different levels of security.
Moving-help groups. On social media, it is common to post "I'm vacating my one-bedroom in the 11th on the 30th, anyone looking?" with a phone number in plain sight. That is freely available information.
None of these sources gives the exact amount of your security deposit. That is why the fraudulent text often displays a plausible but incorrect figure — and that is one of the first signals to spot.
Anatomy of the trap message
The variants look very much alike. Here are the recurring patterns found in public reports and on 33700, the French platform dedicated to reporting unwanted texts and calls.
| What the text says | What it is trying to trigger | The reality |
|---|---|---|
| "Transfer rejected by your bank" | You feel responsible for a technical problem | A rejected transfer generates a letter or a phone call, never a link by text |
| "Confirm your bank details within 48h" | Artificial urgency, fear of losing the money | No legal deadline for a security deposit expires in 48h |
| "File being closed" | Fear of having to start all over again | The file does not "close": the legal deadline runs, with penalties |
| "Processing fee of €1.90" | Making a bank card feel like a formality | No fee can be charged for returning your own money |
| "Secure tenant portal" | Creating the impression of an official portal | The URL is a domain name bought a few days earlier |
Two capture mechanisms exist side by side. The first, the simplest, asks for your IBAN: it will be used to set up other frauds, notably fraudulent SEPA direct debits, or resold. The second, more aggressive, demands your bank card number on the pretext of a "processing fee" of one or two euros — a trivial sum that disarms your vigilance, but which hands over the data needed for a far heavier charge, often completed by a phone call to extract the confirmation code from you.
The six signals that should stop you
1. The channel. An estate agency or a landlord never asks for bank details by text message. Your bank details go through the rental file, by post, or via a client area that you log into yourself, by typing the address.
2. The amount. Compare it to the cent with your lease. The security deposit for an unfurnished rental is capped at one month's rent excluding charges; for a furnished rental it can reach two months. If the figure shown does not match exactly, it is guesswork.
3. The link. Look at what comes before the first "/" after the domain name. espace-locataire-remb.fr, agence-remboursement-2026.com, restitution-caution.net: these domains have nothing to do with the name of your agency. Scammers bet on reassuring words, not on a genuine identity.
4. The absence of a file reference. An agency knows your lease number, the address of the property and the exact date of the inspection. A genuine text mentions them. A fraudulent text stays vague: "your property", "your file".
5. The imposed deadline. 24h, 48h, "before Friday". No deposit return procedure works like that. Urgency is the most reliable marker of fraud.
6. The sender. An alphanumeric sender name ("AGENCY", "IMMO-SERV") can be spoofed very easily — and it can even appear in the same message thread as a genuine message from your agency, which remains the most disorienting trap for victims.
The reflex that kills the scam in three minutes
It fits into one sentence: never respond through the channel that contacted you.
You receive the text? Close it. Take the lease you signed, or the confirmation email from the agency, and call the number written there. Not the number in the text message, not the one you find at the top of an online search — the one in your own documents.
This is exactly why it is useful to step back from full paperlessness when you move. Keeping a paper copy of the lease, of the move-in and move-out inspection reports, and of the bank details you provided, in an expanding file folder stored with your important documents, saves precious time on the day you have to check a piece of information under pressure. The agency's number is there, printed, unalterable, impossible to spoof.
Second reflex: document everything. Photograph the move-out inspection, keep the date the keys were handed over, note the name of the agent present. In the event of a real dispute over the return of the deposit, these elements are worth far more than a memory. Many tenants discover too late that they have no record of the condition of the property on arrival: a simple laser measuring tool and a series of time-stamped photos taken when you move in are enough to document floor areas and pre-existing defects.
And if you have already clicked?
It happens, even to very well-informed people — a text read on a packed metro, between two boxes, is not read with the same attention as an email in front of a screen.
You only opened the page
If you entered nothing, the risk is low. Close the tab and do not go back to it. As a precaution, check that your phone has not installed an app from outside the official stores.
You entered your IBAN
An IBAN alone does not allow someone to empty an account, but it does allow attempts at fraudulent SEPA direct debits. Three actions:
- notify your bank and ask for a whitelist of authorised creditors to be set up, or at the very least enhanced monitoring;
- monitor your statements for several months, including small recurring amounts;
- be aware that an unauthorised SEPA direct debit can be disputed and refunded within thirteen months (eight weeks without any particular justification), under the French Monetary and Financial Code.
You entered your bank card details
Here, you need to move fast.
- Block your card immediately with your bank, or via the interbank loss and theft reporting service (0 892 705 705).
- Do not answer any call from someone presenting themselves as your adviser in the hours that follow: the second phase of the scam almost always consists of calling you to obtain the confirmation code.
- Report the text message to 33700 (or by text, forwarding the message to 33700, then sending the sender's number).
- File a complaint, online via the THESEE system for online fraud, or at a police station.
- Report the incident on cybermalveillance.gouv.fr, which will point you to the appropriate steps.
Where an unauthorised transaction is reported within the deadlines, the bank must refund it, unless it can prove gross negligence on your part. Rulings by the French Court of Cassation in recent years have repeatedly stated that having been deceived by a message imitating the institution does not, in itself, constitute gross negligence. This is worth knowing: many victims give up on disputing the charge because they feel at fault.
Protecting your phone number during a move
This period is ripe for leaks. A few habits limit the damage.
Compartmentalise your numbers. For listings, help groups and viewings, using a secondary number stops your main line ending up in resold databases. A second phone with a prepaid SIM card, kept for this kind of temporary process, remains the simplest method — and it then doubles as a backup phone.
Never share an unredacted rental document. Tax assessments, payslips and ID documents sent to a "landlord" met online feed directly into later fraud scenarios. Mask tax reference numbers and IBANs with a redaction marker before making any copy.
Lock down physical access to your phone. A move means an open flat, strangers coming and going, a phone left on a box. A six-digit code rather than four, and automatic locking after thirty seconds, cost a few seconds a day and remove an entire attack vector.
Plan for a flat battery. On the day, your phone is your only link with the agency, the van rental company and your family — and a dead phone pushes you to borrow someone else's or to connect to a dubious public Wi-Fi. A 20,000 mAh power bank in your bag avoids that situation.
What this scenario says about the evolution of text message scams
The fake security deposit text belongs to a growing family: contextual scams. They do not invent an event, they slot into a real event in your life — a move, a hospital stay, the start of the school year, an inheritance.
Cybermalveillance.gouv.fr has been documenting this shift from mass smishing to more targeted phishing for several years now, where personalisation replaces volume. The logic is economic: a hundred credible messages sent to people who really are waiting for a transfer beat ten thousand generic ones.
The useful question is no longer "is this message well written?" but "through what channel would I normally receive this information?".
A security deposit is returned by bank transfer, with no action required from you, because the agency already has your bank details — you gave them for the rent payments. That simple piece of reasoning is enough to bring the whole performance crashing down.
And what if your security deposit really is late? It is not a text message that will solve the problem, but a registered letter with acknowledgement of receipt giving the landlord formal notice, then, if necessary, a referral to the departmental conciliation commission. ANIL and the departmental ADILs support tenants free of charge through this process. It is slower than a clickable link, but it is the only route that ends up giving you your money back.
