"Hello, I'm Léa, a recruitment officer. Your profile matches a work-from-home position, 30 min/day, pay of €120-350 per day, no experience required. If interested, add me on WhatsApp: +63 9XX XXX XX"
You haven't applied anywhere. You've never heard of this company. And yet you don't delete it straight away. Because the message is polite, correctly spelled, it asks for nothing, it threatens no one, and it may well arrive just as your fixed-term contract is ending, as your hours have changed, as the back-to-school budget has blown up.
That is exactly where the strength of this scam lies: unlike the fake parcel text or the bogus fine, it doesn't frighten you. It tempts you.
A fraud that has exploded in France over the past two years
Fake recruitment campaigns sent by text are now one of the main entry points for "pig butchering" — the term adopted by Interpol and Europol to describe scams that patiently "fatten up" a victim before "slaughtering" them.
France's consumer protection and fraud watchdog, the Direction générale de la concurrence, de la consommation et de la répression des fraudes (DGCCRF), and the Cybermalveillance.gouv.fr platform regularly warn about these unsolicited job offers received by SMS, WhatsApp or Telegram. The national police, through the Perceval platform and THESEE, the online complaint system for digital fraud, are recording a sharp rise in reports.
The method has one peculiarity: it doesn't rely on a booby-trapped link in the text message. The text is merely a filter. Its only job is to sort, out of tens of thousands of numbers blasted at random, the few hundred people interested enough to reply. Those are the ones the fraudsters will then handle one by one, by hand.
That's why anti-spam filters struggle so much: there is no malicious URL, no attachment, no impersonation of a well-known brand. Just one friendly sentence.
Anatomy of the scenario, in five steps
1. The first contact, deliberately harmless
The initial text never asks for money or personal data. It only asks you to switch channels: "add me on WhatsApp", "message me on Telegram". That switch serves three purposes:
- getting out of SMS, where the carrier can block and where the 33700 service allows reporting;
- moving to an encrypted messaging app, harder to trace;
- setting up a long, warm, daily conversation.
The number displayed is often foreign (+63 Philippines, +44 United Kingdom, +212 Morocco, +234 Nigeria) or, increasingly, a French mobile number starting with 06/07 obtained via a resold prepaid SIM card or a hijacked SMS gateway.
2. The "company" and the fake interview
Next comes a company name, often that of a real digital marketing, e-commerce or staffing brand, misappropriated. You're sent a polished PDF brochure, sometimes a link to a showcase website created a few weeks earlier. A "manager" welcomes you into a chat group where other "employees" post screenshots of transfers they've received.
Those other employees are accomplices. The entire group is a stage set.
3. The first assignments… which really do pay
This is the heart of the trap. You're given trivial tasks: liking videos, "optimising" product listings, validating orders on an internal platform. And you really are paid €20, €40, sometimes €80 into your account.
That first transfer is an investment by the scammers. It turns doubt into trust, and trust into eagerness. Many victims later describe telling friends and family about "their new job" — which makes the eventual confession all the harder.
4. The "bulk order" you have to front the money for
One day, the platform displays a "premium" task: it pays more, but it requires you to front a sum, presented as a deposit refunded on validation. €50, then €200, then €900. Every advance is refunded… as long as the amounts stay small.
Then comes the block: a "handling error", a "frozen account", an "unlocking fee". To get back the €1,800 showing on your dashboard, you have to pay another €600. The dashboard, however, is just a web page. The money displayed doesn't exist.
5. The final wringing-out
At this stage, the scammer plays on the commitment effect: you've already put in €2,000, and giving up means losing everything. Some victims borrow, take out consumer loans, or turn to their loved ones. Payments go through instant transfers, prepaid cards, or cryptocurrency purchases — almost impossible to reverse.
The variants worth knowing
Fake recruitment by text isn't limited to the "paid task". Four versions are actively circulating in France:
| Variant | Promise | What the scammer is really after |
|---|---|---|
| Paid task / micro-assignments | €100 to €300 a day, 30 min of work | Successive cash advances |
| Fake personal assistant job | €800/month to handle errands and parcels | Money laundering: you become a "mule" |
| Fake product testing | Receive and rate free items | Reshipping parcels bought with stolen cards |
| Fake staffing agency / major retailer recruiter | Real position, fast-tracked interview | Copy of your ID, bank details, credit opened in your name |
The "mule" variant is the most dangerous legally. Agreeing to receive transfers into your account and then pass them on, even in good faith, exposes you to money laundering charges (article 324-1 of the French criminal code) and to your bank account being closed with a report to Tracfin. Students have been convicted over facts of this kind without ever having met their "employer".
Seven signals that never lie
- You didn't apply. No serious recruitment agency cold-texts candidates who have submitted nothing.
- The pay is out of all proportion to the work described. "30 minutes a day" and "€3,000 a month" do not coexist in the real world.
- You're asked to switch to WhatsApp or Telegram immediately, with never an offer of a call from a company number or a professional email address.
- No professional address: the email is @gmail.com or @outlook.com, never @companyname.fr.
- The contract is missing or arrives very late, and mentions no verifiable SIRET number, no collective agreement, no URSSAF registration.
- You're asked to put money up front, for whatever reason: training, deposit, licence, starter kit, unlocking fee. In France, an employer can never charge a candidate to be hired (article L5331-1 of the labour code).
- Urgency and flattery alternate. "Your profile is exceptional" / "the spot goes in two hours".
Checking an offer in five minutes
Before replying to anything at all, three checks are enough to weed out 95% of fake recruitment attempts.
Check that the company legally exists. The site annuaire-entreprises.data.gouv.fr (a public service, based on INSEE data) lets you find a SIREN number, a creation date and a declared business activity in seconds. A "digital marketing leader" created three months ago, registered at a PO box and with no declared employees, is an empty shell.
Check the recruiter, not just the company. Search for the name on professional networks: a recently created profile, with no history and no shared connections, is a fake. Scammers also steal photos of real employees; a reverse image search often settles the matter.
Call the company on its official switchboard, using a number you found yourself on its website, never the one provided in the conversation. Simply ask: "are you currently recruiting for a position as…?". The answer takes a minute.
Finally, if you browse a lot of job ads on your phone, note that scammers count on hurried reading on the move. Reading an ad on a small scratched screen, while walking, doesn't help you spot an odd URL: a tempered glass screen protector and a bit of calm genuinely improve the quality of your vigilance. It sounds trivial, but eye strain is one of the levers of social engineering.
What to do if you've already replied
You only chatted
Block the contact, leave the groups, and don't try to "scam the scammer": you would simply be signalling that your number is active and attentive, which makes it more valuable on resold lists.
Report the original text by forwarding it to 33700, the national SMS spam reporting service run by French carriers under the supervision of Arcep. It's free, and it's what gets sending numbers shut down.
You sent documents
If you sent a copy of your ID, your bank details or a proof of address, assume they are now in circulation.
- File a complaint (at a police station, gendarmerie, or through the THESEE platform on service-public.fr): the receipt will help you contest any fraudulent credit application.
- Exercise your right of access to the FICP and FCC registers with the Banque de France to check that no credit has been opened in your name.
- Keep an eye on your post: the first traces of identity theft often arrive by mail.
You paid money
Time is the decisive factor.
- Contact your bank immediately and ask for a recall of the transfer. On a recent SEPA transfer, there is a small window.
- If you paid by card, report it on Perceval (via FranceConnect) and request a refund under article L133-18 of the French monetary and financial code.
- File a complaint with all the evidence: screenshots of conversations, phone numbers, destination IBANs, statements.
- Never pay the "unlocking fee". No victim has ever recovered a single cent that way.
- Be wary of the "fund recovery companies" that will contact you afterwards: that's the second layer of the scam, and it specifically targets victims who have already been identified.
Reducing your attack surface in advance
You can't stop a number from circulating, but you can limit how widely it spreads and sharpen your reflexes.
Compartmentalise your number. If you're job-hunting and posting a CV online, consider a second, dedicated line. A no-contract prepaid SIM card, slipped into an old phone or a second SIM slot, lets you hand out a "public" number without exposing the one linked to your bank accounts and your two-factor authentication. The day it's drowning in solicitations, you throw it away.
Protect the device itself. A good share of frauds of this type continues with the installation of an "internal company app", outside the official stores. Never install an APK file sent by someone you're talking to, however friendly they seem. On Android, leave installation from unknown sources disabled.
Keep the phone charged and self-sufficient. It may sound anecdotal, but many rushed decisions are made while the battery is flashing and you want to "sort this out quickly". A compact power bank in your bag saves you from handling a money question in a hurry, at 3% charge, on a station platform.
Turn on the free protections you already have. The Messages app on your phone offers filtering of unknown senders; your carrier often offers blocking of premium-rate numbers. And with Bloctel, registering remains useful against legal telemarketing — though it has no effect whatsoever on fraudsters, who consult no lists at all.
Educate those around you. The groups most targeted by fake jobs are 18-to-30-year-olds, people retraining, and stay-at-home parents. A general-audience book on cybersecurity in everyday life, left lying on the living room table, often has more effect than a long lecture. For older relatives, a mobile phone with large buttons, deliberately without a browser or third-party messaging apps, mechanically eliminates nearly all of these scenarios.
The key takeaways
Fake recruitment by text doesn't look like a scam because it has none of the usual signs: no glaring spelling mistakes, no threat, no dodgy link. It looks like an opportunity.
Yet three sentences are enough to unmask it:
I never applied here. No legitimate employer asks a candidate for money. A company that refuses to speak to me from its official switchboard is not a company.
The rest — the enthusiastic WhatsApp group, the screenshots of transfers, the dashboard displaying your earnings — is nothing but scenery. And scenery, by definition, has nothing behind it.
If you receive this kind of message: don't reply, forward it to 33700, block the number, and talk about it. That's still the most effective way to stop someone close to you from proudly announcing, two weeks later, that they've just landed "a little job paying 200 euros a day".
