"Your new bank card has been issued. To finalise delivery, please confirm your PIN." The message lands one morning, somewhere between an appointment reminder and a supermarket promotion. It looks administrative, almost boring. That is exactly what makes it work: renewing a bank card is a mundane event, one that nobody really tracks in their calendar.
This scam holds a special place in the smishing family. It doesn't stop at stealing online credentials: in its most advanced version, it ends with a visit from a fake courier at your home, who leaves with your real card and your PIN. Here's a step-by-step breakdown.
Why card renewal is the perfect pretext
A bank card is valid for two to four years depending on the bank. Its replacement therefore arrives at a moment you haven't noted down, without any action on your part, and sometimes with a separate letter for the PIN. Three ideal ingredients for a fraudster:
- You're not expecting anything, but you don't find it abnormal either. A text message about a card being dispatched raises no particular suspicion.
- Banking vocabulary is opaque. "Card issuance", "made available", "activating the medium": technical terms that sound genuine.
- The expiry date is printed on your card. If the fraudster has a leaked database or has already tricked you into entering your details on a fake site, they can line their message up with a plausible deadline.
On top of that comes a detail that throws many victims off balance: the text message often arrives in the same message thread as genuine messages from the bank. That's sender spoofing, a technique that allows any sender name to be displayed. Your phone then files the fake message right next to the real transfer confirmation codes. No visual clue warns you.
A text message that appears in the "MY BANK" conversation is not necessarily sent by your bank. The alphanumeric sender ID is simply a text field, not proof of identity.
The three variations of the scenario
Variation 1: "Confirm your PIN"
The link in the message leads to a page in the bank's colours. You're asked for your username, your password, and then — this is the heart of the trap — your four-digit PIN, supposedly to "validate the card's association". No bank ever asks for that code online, by phone or by text. Ever. It's the one secret you share with nobody, not even your account adviser.
Within minutes, your credentials are used to set up an online payment. A fake adviser then calls you to "block a suspicious transaction" and gets you to read out the code received by text. We covered that mechanism in detail in our article on verification codes read out over the phone.
Variation 2: "Send back your old card"
Rarer, but far more costly. After the text message and a phone call, a "courier appointed by the security department" turns up at your home within the hour, sometimes within fifteen minutes. He collects the old card "for secure destruction", in an envelope, and asks you to write the PIN on an enclosed slip of paper or to tell him out loud "for verification".
The card isn't destroyed: within half an hour it's being used for cash machine withdrawals and in-store purchases. The French national police and several banking federations regularly warn about this modus operandi, sometimes called the "fake courier scam" or "fake bank official fraud". No French institution ever sends a courier to collect a card from your home.
Variation 3: "Secure delivery fee to be paid"
Here, no PIN is requested: simply "€2.90 for registered delivery". A trivial sum, designed to set off no mental alarm. The real loot is the payment form: full card number, expiry date, security code. The small charge also serves to test whether the card is active before a series of much larger transactions. It's the same mechanism as the overpayment refund scam.
The signs that give away a fake text message
None of these clues is decisive on its own, but taken together they leave no doubt.
| Signal | What a real bank does | What the fraudster does |
|---|---|---|
| PIN | Never asks for it, under any circumstances | Demands it to "activate" or "verify" |
| Link in the message | Extremely rare, and never to a card entry form | Shortened link, lookalike domain |
| Urgency | Gives you weeks, follows up by post | 24- or 48-hour countdown |
| Home visit | Doesn't exist for collecting a card | Courier "from the security department" |
| Fallback channel | Points you to your branch or the app | Gives you a number to call back |
Also look at the link's domain, in full, up to the first slash. Fraudsters rely on addresses such as banque-securite-client.com or endless subdomains that push the real name off the screen. On a small screen, that truncation is lethal; many readers do better by reading sensitive messages on a larger screen, or by keeping a LED magnifying glass within reach to re-read an address printed in tiny characters.
The golden rule: hang up and call back yourself
The whole structure of the scam rests on one thing: keeping you inside their communication channel. The link they send, the number they give, the person who calls you back.
The countermeasure is absolutely simple:
- Never use the link or the number provided. Even if they look correct.
- Open your banking app or type your bank's address by hand. Any genuinely pending transaction will show up there.
- Call the number printed on the back of your card or your branch's number, noted on a paper statement.
- Take your time. No legitimate banking decision hinges on ten minutes.
For people who aren't used to navigating an app, it helps to write down, once and for all, the branch number and the card-cancellation hotline on a card, tucked inside an RFID-blocking card holder kept in the wallet. The habit then becomes mechanical: you read the card, you dial, you don't click.
If a "courier" rings your doorbell
This situation deserves its own protocol, because it puts your physical safety at stake as much as your money.
- Don't open the door. Speak through the door or the intercom.
- Never hand over a bank card, a cheque, cash or jewellery to anyone whose visit you didn't arrange yourself.
- Ask for time: "I'm calling my bank and I'll get back to you." A fraudster will insist; a genuine professional doesn't exist in this scenario.
- Note everything down: time, description, vehicle, registration plate if visible.
- Call the police (17 in France) if the person insists or refuses to leave.
For elderly people living alone, a digital door viewer with a screen makes this check far less stressful: you can see who's ringing without going near the door, and describe the individual accurately afterwards. It's a modest piece of equipment that changes the dynamics of a doorstep approach. Our additional advice can be found in the guide protecting older people from text message scams.
What to do if you've already handed something over
The decisive factor is timing. The first few hours matter more than everything else put together.
In the first few minutes
Block your card. From your banking app (the instant card-freeze function), then by phone with your bank. The French interbank card-cancellation service can be reached on 0 892 705 705, available 24/7 if you can't get through to your own institution.
Change your banking credentials from a clean device, not from the link you received.
Stop answering any call claiming to be from your bank. Fraudsters often call back, sometimes posing as the fraud department, to extract one last code.
Within 24 hours
File a complaint at a police station or gendarmerie, or submit a pre-complaint online on the French Interior Ministry's portal. Filing a complaint is almost always a prerequisite for reimbursement.
Dispute the transactions in writing with your bank. The French Monetary and Financial Code (articles L.133-18 onwards) provides for the reimbursement of unauthorised payment transactions. Be careful: if the bank establishes gross negligence — notably voluntarily disclosing your PIN — it can refuse. Hence the importance of describing precisely the manipulation you were subjected to, the number spoofing, the fake adviser, the urgency scenario.
Report the message. Forward the fraudulent text to 33700, France's national SMS spam reporting service, run by the French operators. Also report the site address on the Phishing Initiative platform and the overall case on cybermalveillance.gouv.fr, the national assistance scheme for victims of cybercrime. Our article reporting a fraudulent text message walks through the whole process.
In the days that follow
- Monitor your statements over several weeks: some debits appear with a delay.
- If your credentials were reused elsewhere, change them. A paper password notebook, kept in a locked drawer, remains an acceptable solution for anyone who refuses digital managers — and in any case far better than using the same password everywhere.
- If a dispute with your bank drags on, refer the matter to the institution's banking ombudsman, and then if necessary to the ACPR (the French prudential supervision and resolution authority).
Three habits that close the door for good
Know your card's expiry date. It's printed on the card. If a text message announces a renewal when your card is still valid for another eighteen months, doubt kicks in immediately. Note that date in your diary and the question is settled for three years.
Turn on payment notifications in your banking app. Every transaction triggers an alert on your phone. A fraudulent withdrawal becomes visible within seconds instead of weeks. It's the most effective free measure in existence.
Separate your uses. A current account with a modest limit for everyday purchases, and savings in another account not linked to the card. The maximum loss is then capped by design. For those who mainly pay online, the single-use virtual cards offered by most French banks add a useful layer.
And for contactless payments on public transport or in crowded places, an anti-RFID bank card sleeve limits remote reading — a marginal risk compared with smishing, but the habit costs next to nothing.
What this scam tells us about the 2026 landscape
For several quarters now, the Banque de France has recorded a rise in manipulation-based fraud, where the victim carries out the transaction themselves after being deceived, at the expense of purely technical fraud. That's exactly the register of the fake card renewal: no hacking, no malware, just a credible scenario and time pressure.
Detection tools are improving in parallel: the message-analysis systems built into Android and iOS phones are getting better and better at flagging dubious links, and French operators filter out a growing share of these campaigns. But those filters can't see the phone call that follows, or the courier at the door. The last link in the chain is still human.
The good news is that the defence fits into a single sentence, one you can pass on to anyone in ten seconds: nobody, ever, asks for your PIN, and nobody comes to your home to collect your card. Repeat it to your parents, your grandparents, your children opening their first account. It's worth all the software in the world.
If you need to warn someone quickly about an ongoing campaign, a short, factual text message often works better than a long phone call. You can send one free of charge from our homepage, with no sign-up — a few words along the lines of "If you get a text about your bank card, don't click, call me" can save someone a very bad quarter of an hour.
