"HELLO, your device (order RP-77421) has been received and valued at 189 EUR. Confirm your bank details to release the transfer within 48h: https://reprise-mobile-validation.net/rp77421"
This one doesn't threaten you with anything. No fine, no closed account, no parcel stuck in customs. Quite the opposite: it brings you good news. That old phone, the one you slipped into a box ten days ago, is worth €189, and the money is on its way. Only one piece of paperwork is left: providing the IBAN the money should be paid into.
And that is exactly why this text message works better than most others. The most profitable scams are not the ones that frighten you. They are the ones that land at the precise moment you are expecting a message of that kind, with content that matches, line for line, what you were waiting for.
Why phone trade-ins have become prime hunting ground
In just a few years, selling on your old smartphone has become a mass reflex. Trade-in credit from your carrier when you upgrade, the manufacturer's buy-back programme, platforms specialising in refurbished devices, automated kiosks in shopping centres, store vouchers in supermarkets: the channels have multiplied, and each one works to its own rules.
Ask yourself honestly. If you shipped a device two weeks ago, can you say off the top of your head:
- the exact name of the company buying it (often a middleman you'd never heard of before the checkout process);
- the order number assigned to your shipment;
- the amount finally agreed after inspection, which almost always differs from the online estimate;
- the timeframe announced for payment, and by what means: bank transfer, store voucher, credit on your bill, PayPal;
- the email address or number the platform communicates from?
In the vast majority of cases, no. And it is precisely that information gap the fraudster steps in to fill. They don't need to know which platform you sent your device to. They blast their message to tens of thousands of numbers, knowing that a small fraction of recipients are, at that very moment, in the perfect window of expectation.
Refurbished devices have another peculiarity: they are virtuous and well regarded. We talk about them in terms of the circular economy, ecology, common sense. The result: suspicion drops. Nobody thinks "careful, mobile phone buy-backs are dodgy".
Anatomy of the message
Three main variants are in circulation, and they don't share the same end goal.
1. The IBAN request "to release the transfer"
This is the most direct one. The link leads to a convincingly branded form asking for your first name, surname, address, then your full IBAN and sometimes proof of identity "for anti-money-laundering compliance".
Many victims reassure themselves with logical but mistaken reasoning: "an IBAN can only be used to receive money". In reality, an IBAN combined with your name, your address and a copy of your ID makes for a very complete identity-theft kit. It can be used to attempt fraudulent SEPA direct debits, to open accounts or subscriptions in your name, and above all to build a social engineering file that will make a later call from "your bank" sound utterly credible.
2. The fake "additional charge" or "overpayment"
A more devious variant: you're told the device arrived with a more damaged screen than declared, that an "advance" has already been paid to you by mistake, and that a €3.90 processing fee needs to be settled. The small amount disarms your suspicion. What matters isn't the €3.90: it's entering your card number on the payment page, often followed by a hijacked 3-D Secure verification request.
3. The fake "problem identifying your shipment"
Here you're told the parcel has indeed arrived but the device is locked and that you need to "disable the protection" or provide your Apple or Google account credentials so the inspection can be completed. The goal: taking over an entire online account. This is by far the most damaging version, because that account often holds photos, contacts, backups and payment methods.
No legitimate buy-back platform will ever ask you, by text message or email, for your Apple, Google or Samsung account credentials. Unlocking is done by you, before shipping, from your own settings.
The giveaway signals
Fake trade-in text messages share a set of almost unchanging markers.
| Signal | What a genuine platform does | What the scam does |
|---|---|---|
| Sender | Short brand name or consistent number, message traceable in your customer account | Mobile number starting 06/07, foreign number, or approximate sender name |
| Link | The brand's official domain, sometimes no link at all | Cobbled-together domain: reprise-mobile-validation.net, rachat-mon-tel-fr.com |
| Bank details | Already entered when you placed the order, in your customer account | Demanded urgently via an external form |
| Tone | Informative, no countdown | "within 48h", "final reminder", "order cancelled without a reply" |
| Amount | Matches your estimate, itemised in an inspection report | Round, flattering, often higher than you hoped for |
| Spelling | Accents present, clean formatting | Missing accents, odd capitals, spaces before full stops |
Missing accents are a recurring clue, but don't rely on it blindly: smishing kits are becoming more professional and more and more messages are written in flawless French. Cybermalveillance.gouv.fr regularly points this out in its guidance on SMS phishing: the only genuinely reliable test is checking through a channel you choose yourself.
The habit to build once and for all
It comes down to one sentence: never check a message from within the message.
- Don't click. Not even "just to see what it looks like".
- Open your order history. Not the link in the text: your original confirmation email, or the platform's app that you installed yourself.
- Compare the order number. If it doesn't match exactly, case closed.
- Check the parcel tracking with the carrier, on their own website. If the device is still in transit, no inspection can have taken place.
- Call customer service on the number shown on your invoice, never the one given in the text message.
- Report the message to 33700 (free, the official service run by French carriers) by forwarding the text, then sending the sender's number when prompted. You can also file a report on the Pharos platform.
If you're helping an elderly relative through this kind of process, print these six steps out and tuck the sheet wherever they keep their paperwork. A good old paper notebook sitting by the landline is still the most effective tool for jotting down, at the moment of shipping, the company's name, the order number and the quoted amount. Three handwritten lines are enough to defuse the whole scam, because they plug the information gap.
Before you ship: preparing the device is already protecting yourself
A large share of scams of this type only land because the trade-in was poorly prepared. A few steps, taken in the right order, render the fake text message harmless.
Back up, then disconnect
- Make a full backup. A portable external hard drive lets you keep a local copy of your photos and documents independent of the cloud — precisely useful on the day an account gets compromised.
- Sign out of your Apple, Google or Samsung account and turn off device location. That's your responsibility, not the buyer's. A phone still tied to your account is unusable for the workshop, and it's the perfect pretext for fake "unlocking" messages.
- Deactivate the eSIM or remove the physical SIM card, along with the memory card.
- Perform a factory reset, then switch the device back on to check it boots to the initial setup screen.
Document its actual condition
The fake "additional charge" relies on uncertainty: you can't prove what condition the device was in when it left. Photograph it from every angle, screen on, before packing. Note the IMEI, visible in the settings or on the original box.
For shipping, a correctly sized padded bubble mailer and proper cushioning will prevent damage in transit — which would be a genuine reason for a lower valuation. Keep the carrier's proof of posting until the payment actually lands.
Protect the phone you're keeping
One detail often goes unnoticed: trade-in value depends above all on the condition of the screen and the health of the battery. On the device you've just bought, a tempered glass protector fitted on day one and a rugged shockproof case radically change the valuation you'll get two or three years later. It's both economical and, indirectly, a form of protection: fewer breakdowns, fewer repair visits, fewer windows of anxiety for a fraudster to slip into.
If you've already replied
Don't panic, but be methodical. The order matters.
You gave out an IBAN. Alert your bank, ask for the account to be monitored and, depending on the circumstances, for an authorised list of SEPA direct debits to be set up. Check your statements every week for two months: fraudulent debits are often small amounts tested before a larger operation. An unauthorised SEPA direct debit can be disputed with your bank within 13 months (8 weeks with no particular justification needed): that's a right set out in European regulations, as the Banque de France reminds us.
You entered a bank card. Block the card immediately, then request a refund. The European Payment Services Directive (PSD2) and Article L.133-18 of the French Monetary and Financial Code establish the principle that unauthorised transactions must be refunded.
You handed over account credentials. Change the password from another device, revoke active sessions, enable strong two-factor authentication. Prefer an authenticator app or a physical security key over a simple SMS code, which is vulnerable to SIM swapping.
In every case. File a police report, even if nothing has been debited: banks and insurers often require one. Report the number to 33700 and keep a screenshot of the text message with its date.
What this scam tells us about the others
The fake trade-in text message is not an isolated oddity. It illustrates a mechanism found across every family of smishing: the fraudster doesn't create a situation, they invite themselves into an existing one. The parcel you're waiting for, the repair under way, the switch to a new carrier, the sale of a car, the end of a tenancy. Every time a process involves several parties, vague timeframes and a payment to come, a window opens.
Hence a simple rule to pass on to those around you, including the people least comfortable with technology: a message that promises you money and asks for banking information in the same text is, in every case, to be ignored. Money genuinely owed to you will arrive anyway, without you having to click on anything. For relatives who want to shrink their exposure, a large-button mobile phone with no web browser simply removes any possibility of clicking a booby-trapped link — a pragmatic option when use is limited to calls and texts.
Refurbished devices are a good idea. So is selling on your old one. All it takes is keeping three pieces of information written down somewhere and never checking a message from within the message itself. Two habits, and this entire family of scams collapses.
