# "Your personal account will be closed": the fake tax-office SMS scam that rides the tax calendar

> Every autumn, fake SMS messages from the DGFiP announce the closure of your personal tax account or a pending tax refund. Here's how these messages are timed to the real tax calendar, and the habits that keep you from ever clicking.

- Source: https://www.envoyer-sms-gratuit.com/en/blog/2026-10-03/arnaque-sms-faux-impots-remboursement-espace-particulier
- Published: 2026-10-03 (3 October 2026)
- Author: L'équipe Envoyer SMS Gratuit
- Language: en
- Categories: Guide
- Tags: Cybersécurité, SMS, France 2026, Guide, Protection des données, smartphone, Seniors

---
« DGFiP : votre espace Particulier sera cloture le 09/10 faute de verification d'identite. Un remboursement de 326,41 EUR reste en attente de validation : https://impots-espace-verification.net/particulier »

("DGFiP: your Personal account will be closed on 09/10 for lack of identity verification. A refund of EUR 326.41 is still awaiting validation.")

This one doesn't accuse you of anything. It doesn't threaten you with seizure, doesn't mention a tax audit, doesn't bring up any fine. It tells you two things at once: a small piece of administrative paperwork to sort out, and money waiting for you. It's a devastatingly effective combination, because it defuses suspicion with the lure of gain while still imposing a deadline.

And above all, this text arrives **at exactly the right moment**. Not in the middle of February, when nobody is thinking about their tax return. But in autumn, when assessment notices are landing in letterboxes, when the balance payments are being debited, when some households really are waiting for a transfer from the public treasury. The scammers aren't guessing your tax situation: they're playing on a public calendar that everyone goes through at the same time.

![Woman sitting and holding a mobile phone in a dark room lit by purple and red neon lights](/images/blog/2026-10-03-arnaque-sms-faux-impots-remboursement-espace-particulier/hero.jpg)

## Why the tax calendar is the scammers' best accomplice

Smishing works when the message lands in a window where it becomes plausible. And the French tax system offers very wide, perfectly predictable windows:

- **April–June**: the filing season, when everyone logs into their personal tax account;
- **July–August**: income tax assessment notices go online, and **refunds** are paid out to households that have had too much withheld at source;
- **September**: the balance is debited for those who still owe money, sometimes spread out until December;
- **October–November**: property tax notices, then payment deadlines, and for the taxpayers concerned, the **adjustment of the withholding tax rate** for the following year.

In other words, there is barely a single month of the year in which a text message mentioning a refund, a notice or a verification couldn't ring true. The scammer doesn't need to know whether it applies to you: out of 100,000 numbers blasted, several thousand people really are expecting something from the tax authorities.

The **Direction générale des Finances publiques** (DGFiP) regularly warns about these campaigns on its website **impots.gouv.fr**, and **Cybermalveillance.gouv.fr** ranks the impersonation of government bodies among the most frequent phishing scenarios. What all these warnings have in common is always the same point: the authorities never ask for your bank details or your login credentials by text message or email.

## The four variants circulating in 2026

### 1. The pending refund

The most widespread one. A precise amount, often between 150 and 800 euros — credible enough for an overpayment of withholding tax, never big enough to arouse suspicion. The link leads to a fake form using the colours of impots.gouv.fr, which asks for your tax number, your date of birth, then your **IBAN** and often your bank card number "to verify the identity of the account holder".

That's the tipping point: a refund is made **by bank transfer**, and a transfer never requires a card number. If you're asked for the 16 digits on your card in order to receive money, you're on a fraudulent site, full stop.

### 2. The closure or suspension of your personal account

The "gentle fear" variant. You're told your account will be deactivated for lack of verification. The goal is to harvest the **tax number + password** pair, which unlocks access to information of considerable value: income, household composition, address, downloadable assessment notices. Those notices are then reused to put together loan applications, fictitious rental files or full-blown identity theft.

### 3. The unpaid balance with a threat of surcharge

This one mimics a formal demand for payment. "Solde de 712 EUR non regle, majoration de 10 % appliquee sous 48h." ("Balance of EUR 712 unpaid, 10% surcharge applied within 48h.") The link leads to an online payment page, with the money going straight to an account controlled by the fraudsters, often via prepaid cards or e-money accounts opened with forged documents.

### 4. The fake adviser who calls back

The most expensive one. After an initial text message, a call follows, sometimes from a number displayed as starting with 09 or 01 that looks like a public finance office line. A very calm voice explains that fraud has been detected on your tax account and that your funds need to be "secured". The **Banque de France** in fact noted in 2026 an increase in so-called "manipulation" scams — those in which the victim makes the transfer themselves, convinced they are acting to protect themselves.

## The seven signs that give away a fake tax SMS

| Signal | What the real DGFiP does | What the fake SMS does |
|---|---|---|
| Link in the message | Never a link to a bank-detail entry form | Shortened link or lookalike domain |
| Domain | `impots.gouv.fr` only | `impots-verification.net`, `dgfip-particulier.com`… |
| Request for an IBAN | Done from within your authenticated account | Requested in an open form |
| Bank card | Never for a refund | Systematically requested |
| Deadline | Due dates announced weeks in advance | "24h", "48h", "tonight" |
| Spelling and accents | Proofread text, accents present | Missing accents, erratic capitalisation |
| Sender | Often a sender name, never a personal mobile number | Mobile number starting 06/07, or spoofed sender |

The absence of accents deserves a caveat: on its own, it is no longer a reliable criterion. Campaigns generated with AI tools now produce text in flawless French, with accents, correct syntax and even the right administrative vocabulary. Several specialist outlets documented this jump in quality for parcel delivery scams in 2026; it applies in exactly the same way to tax scams. The only criteria that don't age are **the address behind the link** and the **nature of the information being requested**.

## The thirty-second habit: never start from the SMS

The rule fits in one sentence: **you never verify a piece of information through the channel that delivered it**. If a text message tells you about a refund, you have no reason to click its link, nor to call the number it gives.

The clean procedure:

1. **Close the message.** Don't click, not even "just to see".
2. **Type** `impots.gouv.fr` **yourself** into your browser, or open the official "impots.gouv" app that you installed from your phone's app store.
3. **Log in** to your personal account. Every refund, every notice, every deadline appears there. If there's nothing, there's nothing.
4. **Report** the message to **33700**, France's national reporting service for unwanted text messages, simply by forwarding the SMS. You can also file a report on the **Phishing Initiative** platform or on **cybermalveillance.gouv.fr**.

If you often check your accounts and administrative documents on screen, a simple [phone stand](https://www.amazon.co.uk/s?k=support+smartphone+bureau&tag=ds0608-21) sitting on your desk makes a real difference: it forces you to look at the screen straight on, instead of reading a text at an angle, standing up, on the move — precisely the conditions in which people click without thinking.

![Woman in a red jumper sitting beside a snow-covered fir tree, looking at a smartphone in her hand](/images/blog/2026-10-03-arnaque-sms-faux-impots-remboursement-espace-particulier/body-1.jpg)

## Why so many people click anyway

It would be comforting to believe that only the most gullible fall for it. The facts say otherwise: the decisive factor is **context**, not intelligence.

- **You really are expecting a refund.** A couple who adjusted their withholding rate know a transfer is due. The text doesn't create the expectation, it confirms it.
- **You've just logged into the real site.** These campaigns are often sent out en masse during connection peaks. Receiving a "DGFiP" text an hour after visiting impots.gouv.fr creates a very powerful illusion of cause and effect.
- **Your message thread is contaminated.** If a genuine message from a public service has already arrived in a named thread, a fraudulent text spoofing the same sender name can slip in and appear right after the real ones. That's one of the perverse effects of alphanumeric sender IDs, which **Arcep** and the mobile operators are trying to rein in with a sender authentication mechanism.
- **You're reading on a small screen.** A truncated link, a hidden address bar, and the fraudulent domain becomes invisible. For anyone squinting at their phone, a pair of [reading glasses](https://www.amazon.co.uk/s?k=lunettes+de+lecture+loupe&tag=ds0608-21) within reach isn't a comfort detail: it's what lets you read the full URL before tapping it.

## If you clicked: the useful steps, in order

Having clicked doesn't mean having lost everything. What matters is **what you entered** and how fast you react.

1. **You entered nothing, you just opened the page.** The risk is low on an up-to-date phone. Close the tab, clear that site's history, and check that your system is properly updated.
2. **You entered your tax number and password.** Log in to the real site immediately and **change your password**. Use a unique, long password that resembles no other. If you struggle to remember several, a paper [password notebook](https://www.amazon.co.uk/s?k=carnet+mots+de+passe&tag=ds0608-21) kept at home is still far safer than one password reused everywhere.
3. **You gave out your bank details.** Call your bank without delay, block the card, ask for monitoring of the account. Blocking a card and disputing a transaction are rights: Article L. 133-18 of the French Monetary and Financial Code provides for the reimbursement of unauthorised transactions, except in cases of established gross negligence.
4. **You made a transfer.** Contact the bank within the hour if possible: a transfer can sometimes be recalled before it is finally executed. Then file a complaint.
5. **In every case**, report the scam on the Interior Ministry's **Thésée** platform, and keep screenshots of the text message and the website.

One detail that is often forgotten: if you downloaded a file from the fraudulent page, don't open it. Fake tax forms sometimes serve as an entry point for malicious apps, particularly on Android when installation from unknown sources has been allowed. Check that setting and leave it turned off.

## Protecting relatives who receive these texts without understanding how the system works

The genuinely vulnerable group here isn't inattentive taxpayers: it's people who have never used their online tax account. A non-taxable pensioner, someone who has always filed on paper, a young adult who has just completed their first return — all have in common that they don't know what a genuine communication from the tax office looks like.

Three useful conversations to have with them:

- **"The tax office will never ask for your bank card by text message."** Put that way, with no nuance, it's a rule that sticks and is always true.
- **"If a message rushes you, it's fake."** The DGFiP announces its dates weeks in advance, both on paper notices and online.
- **"Call me before you click, never after."** Appointing a family point of contact cuts the urgency dynamic dead.

For older people who want to stay reachable without browsing the internet, a [big-button mobile phone](https://www.amazon.co.uk/s?k=telephone+portable+senior+grosses+touches&tag=ds0608-21) with no browser mechanically solves the problem: a fraudulent text may well arrive, but the link has nowhere to open. And for those attached to their smartphone, a printed guide to digital security for seniors, left next to the phone, often works better than a long lecture.

## Key takeaways

> A tax-related text that rushes you, promises you a refund and asks for a bank card ticks all three warning signs on its own. Not one of those three elements appears in a genuine communication from the DGFiP.

The fake tax office SMS isn't a sophisticated scam. It's a **well-timed** one, borrowing from the tax calendar a credibility it doesn't have, and counting on the fact that nobody really knows how the authorities communicate. The answer is always the same, and it's free: close the message, go to impots.gouv.fr yourself, and forward the text to 33700. Thirty seconds, and the campaign falls flat — for you, and for the people after you, since every report feeds into the blocking of the sending numbers.

{/* image-sources: https://images.pexels.com/photos/7194619/pexels-photo-7194619.jpeg?auto=compress&cs=tinysrgb&dpr=2&h=650&w=940 https://images.pexels.com/photos/6113452/pexels-photo-6113452.jpeg?auto=compress&cs=tinysrgb&dpr=2&h=650&w=940 */}