"Hi mum its me, i dropped my phone in water. Im texting from another number, save it. Can you do me a favour right now?"
No booby-trapped link. No government logo. No threat of a late-payment surcharge. Just a sentence any parent has heard before, complete with the spelling mistakes you forgive a child in a hurry. It is precisely this bareness that makes the fake relative scam — known as the Hi Mum scam in English-speaking countries — so hard to spot.
Where a fake bank text asks you to believe a story, this one simply asks you to reply to your son. And for the next fifteen minutes, you are no longer exchanging messages with a crook: you are exchanging messages with someone your brain has already filed as your child.
A fraud with no technology, or almost none
Most of the SMS scams described on this blog rely on technical spoofing: a falsified sender name ("SANEF", "CAF", "Ameli"), a domain that looks like the original, sometimes a fake mobile mast as in the case of the SMS Blaster. Here, none of that. The message arrives from an ordinary French mobile number — often a real 06 or 07, bought on a prepaid SIM or rented from a bulk SMS platform — and it contains no link at all.
The direct consequence: no spam filter can stop it. Operators block texts containing URLs known to be malicious, spoofed alphanumeric senders, and campaigns blasted out en masse from a single source. A fifteen-word message sent from an ordinary number to an ordinary number triggers absolutely no alert.
The technical part, where there is one, happens upstream: it serves to work out who to write to, and on whose behalf.
Where the scammers find the family connection
There is no longer any need to guess. Three sources feed these campaigns:
- Data breaches. Databases from hacked retail sites, booking platforms or forums routinely contain surname, first name, date of birth and mobile number. Cross-referenced with each other, they make it possible to reconstruct households: same surname, same address, two generations.
- Open social networks. One "Happy birthday mum ❤️" comment under a public photo, and the link is publicly established, with both parties' first names.
- Online death notices and announcements. They list names, family ties and towns with a precision that leaves scammers with nothing to do but cross-check.
Cybermalveillance.gouv.fr has documented this category of "fake relative scam" on several occasions, noting that it now spreads as much via WhatsApp, Messenger or Telegram as by SMS. The common thread: a private channel, a familiar tone, no suspicious attachment.
The script, step by step
The script is remarkably consistent from one campaign to the next.
Step 1 — The neutral hook. "Hey it's your son, new number." Nothing is requested. The sole aim is to get a reply, which confirms both that the number is active and that a son really exists. Scammers send these messages by the thousand; only those that get a reply move on to the next stage.
Step 2 — The justification. Phone dropped in the toilet, cracked screen, stolen on the metro, plan suspended. The story explains both the change of number and the impossibility of phoning. This is the centrepiece: it pre-emptively neutralises the reflex to call. "I can't call, the mic doesn't work any more."
Step 3 — The financial urgency. A transfer to make today, rent, a bill, a work purchase to settle before 5pm. The sum is calibrated: rarely more than €1,500 to €3,000, in other words an amount that hurts but is feasible, and that does not trigger an automatic bank alert.
Step 4 — The gentle pressure. No threats. Anticipated gratitude, "thanks mum I'll pay you back tomorrow promise", sometimes an emoji. The scammer keeps the conversation going while the transfer goes through.
Step 5 — The follow-up. If the first transfer succeeds, a second one comes within 48 hours. That is often when the victim finally calls the old number — and discovers the truth.
In the 2026 ranking of manipulation-based fraud published by the Observatoire de la sécurité des moyens de paiement, scams based on social engineering are growing markedly faster than "technical" bank card fraud. The Banque de France itself highlighted in September 2026 the rise in manipulation scams, in which the victim carries out the transaction themselves.
Why it works, even on cautious people
We would like to believe this scam only targets the gullible. That is false, and it is worth understanding why.
The channel is a channel of trust
An incoming SMS or WhatsApp message is processed by the brain as a conversation, not as a document. You do not verify your correspondent's identity with every message received from your loved ones. The scammer slips into a routine, not into an administrative process.
Changing numbers has become commonplace
Number portability, a second plan, a work number, an eSIM activated for a trip, a spare handset: it is now perfectly ordinary for a relative to write from a new number. The anomaly has lost its abnormality. Many families also keep a simple mobile phone with large buttons as a backup device, which makes the "I'm texting from an old phone" story even more credible.
Affection short-circuits verification
Research on social engineering shows it clearly: under emotional load, rational control weakens. Faced with a child you believe to be in trouble, the question "what if this is fake?" feels almost disloyal. Many victims recount having thought of it — and having dismissed the idea out of guilt.
Reverse-engineering the relationship
The scammer asks open questions: "did you get dad's message?", "how have you been since last week?". The victim answers and supplies the very details that will then be used to make the impersonation convincing. It is the victim who feeds the lie.
The variants spotted in 2026
| Variant | Pretext | Distinctive sign |
|---|---|---|
| Fake child | Broken phone, urgent transfer | Systematic refusal of a voice call |
| Fake grandchild | Accident, bail, lawyer | Targets older people, panicked tone |
| Fake spouse | Work purchase, card limit reached | Imitated couple's vocabulary |
| Fake friend abroad | Wallet stolen overseas | Request for a top-up or money transfer |
| Fake bereaved relative | Funeral costs to advance | Cross-referenced with a public death notice |
A more recent variant adds a voice message. A few seconds of a hoarse voice — "my throat hurts, I'll text instead" — sometimes generated by speech synthesis from a public clip. The quality does not need to be perfect: it just needs to be good enough that doubt never turns into verification.
The seven seconds that make it all fall apart
There is one response that is unique, free and unbeatable: call the old number. Not reply to the new one, not ask for confirmation within the ongoing conversation. Dial the number you have always had in your contacts.
If your relative picks up, the matter is closed. If they do not answer, call someone else in the household. In 100% of documented cases, the scammer will find a reason for you not to call. That is the signal.
Three other reflexes complete this rule:
- Ask a question with a private answer. Not "are you really my son?", but "remind me what Grandma's dog is called" or "what did we eat last Christmas?". A piece of information that appears in no data breach and on no social network.
- Refuse all urgency. No legitimate family situation requires a transfer within the hour without a single spoken exchange. Urgency is not a context, it is a tool.
- Never save the new number before verifying. Once the contact is saved as "Julien", your phone will display "Julien" with every message, and the doubt will disappear for good.
Protecting the most exposed without patronising them
Older people are over-represented among victims, not out of naivety but because they are more often alone at the moment of decision, and because the grandparent/grandchild relationship sits badly with suspicion.
A few concrete measures, to be put in place calmly and in advance:
- Agree on a family password. A word chosen together, never written online, to be requested in the event of a money request. It is the most effective and the simplest measure. Some practical cybersecurity guides for seniors offer ready-made exercises to establish this kind of rule without dramatising it.
- Install the two-channel rule. Any request for money received in writing must be confirmed by a call to a known number. No exceptions, including for €50.
- Keep the address book up to date. A large-format paper address book left next to the landline makes it possible to find the real number in seconds, even when the smartphone is displaying a deceptive conversation.
- Avoid a breakdown at the worst moment. A compact power bank in your bag prevents a dead phone from making verification by call impossible — the exact scenario scammers are hoping for.
- Limit public exposure. Set posts that reveal family ties to private, and avoid publishing your mobile number in plain sight on classified ads or forums.
If the transfer has already gone
Time matters, and it matters in hours.
- Contact your bank immediately to request that the transfer be blocked or recalled. A standard SEPA transfer can sometimes be suspended if it has not yet been credited; an instant transfer, far more rarely — all the more reason to act fast.
- File a complaint at the police station or gendarmerie, or report it online. Filing a complaint is a prerequisite for any claim against the bank.
- Report the number to 33700, the national reporting system for unwanted texts and calls, by forwarding the message and then supplying the sender's number.
- Report it on the Pharos platform or via Cybermalveillance.gouv.fr, which will point you to the right procedures and local service providers.
- Warn the family. These campaigns often target several members of the same household in the same week.
One important legal point: unlike an unauthorised payment transaction (stolen card, stolen banking details), a transfer you validated yourself falls under "manipulation" fraud. Reimbursement is not automatic. Case law is evolving, particularly where the bank has failed in its duty of vigilance over an unusual transaction, but no refund can be taken for granted. That is precisely why prevention here is more effective than repair.
The key takeaways
This scam does not test your digital literacy. It tests how fast your affection overtakes your verification. It needs no fake website, no booby-trapped link, no clandestine mast: just a first name, a family tie and a moment when you are alone in front of your screen.
The countermeasure fits in a single sentence, and it deserves to be said out loud in every family: you never send money to a new number without having heard the person's voice on an old one.
One last detail, trivial but decisive: keep your phone in a fit state to make that call. A cracked screen you can no longer read, a missing shockproof case on the day of the drop, and the whole verification chain collapses at the worst possible moment. A tempered glass screen protector costs a few euros; a fake relative scam costs several thousand on average.
