"SAFETY RECALL: a product purchased on your account is subject to a manufacturer recall (overheating risk). Refund of EUR 79.90 available. Register your device before 02/10: https://rappel-securite-conso.net"
The message doesn't threaten you. It doesn't demand anything. On the contrary, it tells you that money is owed to you — and that someone is worried about your safety. Two registers rarely associated with a scam, and that is precisely what makes this smishing campaign, which has appeared in French inboxes in recent months, so formidably effective.
Where the fake toll SMS plays on guilt and the fake bank SMS on panic, this one plays on something far more comfortable: the feeling of being looked after. A reputable manufacturer is warning you that a device you own could catch fire. Who would think to be suspicious of that?
Product recalls: an official system, real and poorly understood
Unlike other backdrops used by scammers, this one is not made up at all. Recalls of dangerous products are a legal obligation in France and throughout the European Union. Since April 2021, the RappelConso website, run by France's Directorate-General for Competition, Consumer Affairs and Fraud Control (DGCCRF), has centralised all recalls of food and non-food products placed on the French market. At European level, the Safety Gate system (formerly RAPEX) publishes the alerts submitted by member states every week.
Which categories come up most often in these recalls? Toys, cosmetics, food — and, very regularly, consumer electronics: non-compliant power supplies, lithium power banks presenting an overheating risk, chargers without valid CE marking, e-scooters, faulty smoke detectors.
In other words: a text message announcing the recall of a charger or a power bank is not saying anything absurd. That is exactly the kind of product that genuinely does get recalled, several times a year. The lie isn't about the scenario. It's about the channel.
How a real recall works
A genuine recall follows a fairly cumbersome process, and it is precisely that heaviness that makes it recognisable:
- It is published publicly on RappelConso, with a detailed record: brand, model, batch numbers, GTIN/EAN codes, sales period, nature of the risk, and what to do.
- It is displayed in the relevant points of sale, on a standardised notice.
- If the retailer has your contact details (loyalty card, customer account, online purchase), it may get in touch — but overwhelmingly by email or post, not by SMS with a link.
- The recommended action is almost always the same: stop using the product and return it to the store for exchange or refund, on presentation of the product itself.
That last point is the most important one, and it is exactly what the scam contradicts head-on. A real recall asks you to hand over an object. The scam asks you to enter a bank card number.
What the link actually asks for
The form the SMS leads to is polished. A generic but credible logo, a tricolour banner, references to the "Ministry of the Economy" or a "national product recall service", sometimes a pre-filled fake case number. The journey unfolds over three or four screens, and each one has a specific purpose.
| Screen | What you're asked for | What it's really for |
|---|---|---|
| 1 | Identify the affected product from a list | Getting you to say yourself what you own |
| 2 | First name, surname, postal address, email, phone | Building a resellable profile and making what follows credible |
| 3 | Bank details "for the transfer" | Capturing a card number or an IBAN |
| 4 | Processing fee of €1 to €2 | Confirming the card is active and triggering 3-D Secure |
The fourth screen is the most devious innovation. Asking for a micro-payment as part of a refund seems absurd — and yet it works, because it is dressed up as a "bank verification fee" or "identity validation". Its real purpose: to obtain strong authentication from you. By approving that €1.50 payment in your banking app, you sometimes enrol your card in a digital wallet controlled by the scammer, who can then pay in stores without ever needing you again.
The second scenario, less frequent but more expensive, is the recall with replacement. You're told your device must be replaced and that a substitute model will be shipped to you for a contribution of €19 to €39. You pay, you receive nothing, and on top of that you've handed over your full address.
Why this scam works better than the others
It reverses the balance of power
The vast majority of fraudulent text messages cast you as the debtor: you owe a fine, a toll, customs charges. The brain has learned to be wary of that pattern — Cybermalveillance.gouv.fr awareness campaigns have hammered home for years that "you are never asked for a payment by SMS".
Here it's the opposite: you are the creditor. And vigilance is a resource we mobilise in the face of a threat, far less so in the face of good news. Research in the psychology of persuasion on "optimism bias" has documented this letting-down of the guard for a long time.
It builds on a legitimate worry
Incidents involving lithium-ion batteries are not a fantasy. Fire services and insurers regularly warn about fires starting from devices left charging, particularly with uncertified accessories. A reader who has already seen a news report about an e-scooter going up in flames in an apartment block corridor has fertile mental ground already prepared.
This is a good moment to recall the underlying advice: with this kind of device, compliance is not a marketing detail. A certified USB-C charger bearing a legible CE mark, a manufacturer's name and a traceable reference costs a few euros more than an anonymous block, and that is exactly the difference between an accessory and an item listed on RappelConso. The same logic applies to a power bank with certified cells, whose spec sheet clearly states the actual capacity and the overcharge protections.
It sometimes knows about your purchase
Some variants name a specific retailer, or even a plausible order date. That's not magic: it's the result of the massive data breaches that have hit telecom operators, insurance brokers and e-commerce platforms in recent years. France's CNIL has been notified of several of these large-scale incidents, involving millions of records containing names, addresses, phone numbers and sometimes order histories.
A scammer with these databases no longer needs to send a million messages at random. They write to three thousand real customers of a single retailer, naming that retailer. The click-through rate goes through the roof.
Six reflexes to avoid falling for it
1. Check the recall at source, never via the link in the SMS. Open your browser yourself and search for "RappelConso". The public site lists current recalls and lets you filter by category and by brand. If the announced recall isn't there, it doesn't exist.
2. Question the refund method. No legitimate recall issues a refund by bank transfer after you enter a card number on a web form. Refunds are made in store, in exchange for returning the product, or as a credit note. Physical return is the rule, because the manufacturer has an obligation to withdraw the item from the market.
3. Scrutinise the domain name. rappel-securite-conso.net, rappelconso-remboursement.fr, conso-securite-gouv.org: none of these domains belongs to the French state. French public services use .gouv.fr domains — RappelConso is hosted at rappel.conso.gouv.fr. Anything that imitates that without being on .gouv.fr is fake.
4. Be wary of the micro-payment. A simple rule with no exceptions: you never pay to be refunded. If a form asks you for €1, €1.50 or €2 in "verification fees", close the page.
5. Don't judge by the sender. The displayed name may be "RECALL", "SAFETY" or even the name of a well-known retailer. Spoofing the alphanumeric sender ID is still technically possible, even if the authentication mechanism introduced by French operators and overseen by Arcep has scaled the problem back since the anti-spoofing measures came into force.
6. Report it, in three seconds. Forward the message to 33700, the free reporting number for fraudulent SMS run by the Phone Marketing association on behalf of the operators. You can also file a report on the PHAROS platform (internet-signalement.gouv.fr) or use the step-by-step guides on Cybermalveillance.gouv.fr.
If you've already clicked and entered your details
Don't waste time blaming yourself: the order in which you act matters more than how quickly you feel remorse.
- Block your card immediately with your bank, via the app or the emergency number on the back of your card. Blocking the card takes priority over everything else.
- Check your digital wallets. In your phone's settings and in your banking app, look for a card added to a device you don't recognise, and remove it.
- Change the passwords of the accounts concerned if you have reused a login. A password manager makes this bearable, and a small paper password notebook kept at home remains an acceptable solution for those who find apps off-putting — provided it never leaves the house.
- File a complaint at a police station or gendarmerie, or online via the online fraud complaint system. This is often what determines whether the bank reimburses you.
- Invoke Article L133-18 of the French Monetary and Financial Code, which requires the bank to refund an unauthorised payment transaction, unless you have been grossly negligent. Where that line falls is debated, but it exists, and Cour de cassation rulings in recent years have tended to strengthen the position of victims of sophisticated impersonation.
Helping a relative who receives this kind of message
Fake recall campaigns willingly target older people, in whom administrative vocabulary still triggers a reflex of compliance. Three simple steps help far more than a long lecture:
- Turn on the phone's built-in spam filtering. Both iOS and Android offer to sort unknown senders and report junk messages; five minutes of settings is enough.
- Set a single, memorable rule: "before you click on anything in a text message, call me". One rule is worth more than ten detection criteria.
- Simplify everyday use. For a very elderly parent, a big-button mobile phone with no web browser removes the attack surface entirely: without a browser, a booby-trapped link leads nowhere. And a practical guide to digital scams left on the living-room table often has more effect than a phone conversation.
What this scam tells us about what's coming
The fake product recall marks a clear shift: scammers are no longer content to impersonate the government bodies that demand things from you. They now impersonate the ones that protect you. After fake health alerts, fake health insurance reimbursements and now fake safety recalls, the logic is the same — colonising the public systems that citizens trust.
The answer isn't to distrust everything, which is exhausting and ends up making you suspicious of genuine public services. It comes down to one sentence, which applies to just about every text message you'll receive this year: true information survives verification, a scam does not. Close the message, open the official site yourself, look for the information. If it exists, you'll find it. If it doesn't, you've just saved yourself €79.90 — and a great deal more.
