# "Your bank card is on its way, confirm your PIN": the fake card renewal scam

> A text message announces that a new bank card has been sent and asks you to "confirm" your PIN or hand your old card to a courier. A full breakdown of this scam and the habits that neutralise it.

- Source: https://www.envoyer-sms-gratuit.com/en/blog/2026-10-10/arnaque-sms-faux-colis-douane-livreur-numero-personnel
- Published: 2026-10-10 (10 October 2026)
- Author: L'équipe Envoyer SMS Gratuit
- Language: en
- Categories: Guide
- Tags: Cybersécurité, SMS, Seniors, France 2026, Guide, smartphone

---
"Your new bank card has been issued. To finalise delivery, please confirm your PIN." The message lands one morning, somewhere between an appointment reminder and a supermarket promotion. It looks administrative, almost boring. That is exactly what makes it work: renewing a bank card is a mundane event, one that nobody really tracks in their calendar.

This scam holds a special place in the smishing family. It doesn't stop at stealing online credentials: in its most advanced version, it ends with a visit from a fake courier at your home, who leaves with your real card and your PIN. Here's a step-by-step breakdown.

![Young woman in a beige trench coat checking her white smartphone in the street, in front of a flight of steps](/images/blog/2026-10-10-arnaque-sms-faux-colis-douane-livreur-numero-personnel/hero.jpg)

## Why card renewal is the perfect pretext

A bank card is valid for two to four years depending on the bank. Its replacement therefore arrives at a moment you haven't noted down, without any action on your part, and sometimes with a separate letter for the PIN. Three ideal ingredients for a fraudster:

- **You're not expecting anything, but you don't find it abnormal either.** A text message about a card being dispatched raises no particular suspicion.
- **Banking vocabulary is opaque.** "Card issuance", "made available", "activating the medium": technical terms that sound genuine.
- **The expiry date is printed on your card.** If the fraudster has a leaked database or has already tricked you into entering your details on a fake site, they can line their message up with a plausible deadline.

On top of that comes a detail that throws many victims off balance: the text message often arrives in the **same message thread** as genuine messages from the bank. That's sender [spoofing](/blog/2025-12-20/sms-spoofing-numero-ecran-mensonge), a technique that allows any sender name to be displayed. Your phone then files the fake message right next to the real transfer confirmation codes. No visual clue warns you.

> A text message that appears in the "MY BANK" conversation is not necessarily sent by your bank. The alphanumeric sender ID is simply a text field, not proof of identity.

## The three variations of the scenario

### Variation 1: "Confirm your PIN"

The link in the message leads to a page in the bank's colours. You're asked for your username, your password, and then — this is the heart of the trap — your **four-digit PIN**, supposedly to "validate the card's association". No bank ever asks for that code online, by phone or by text. Ever. It's the one secret you share with nobody, not even your account adviser.

Within minutes, your credentials are used to set up an online payment. A fake adviser then calls you to "block a suspicious transaction" and gets you to read out the code received by text. We covered that mechanism in detail in our article on [verification codes read out over the phone](/blog/2026-02-10/ne-communiquez-jamais-ce-code).

### Variation 2: "Send back your old card"

Rarer, but far more costly. After the text message and a phone call, a "courier appointed by the security department" turns up at your home within the hour, sometimes within fifteen minutes. He collects the old card "for secure destruction", in an envelope, and asks you to write the PIN on an enclosed slip of paper or to tell him out loud "for verification".

The card isn't destroyed: within half an hour it's being used for cash machine withdrawals and in-store purchases. The French national police and several banking federations regularly warn about this modus operandi, sometimes called the "fake courier scam" or "fake bank official fraud". No French institution ever sends a courier to collect a card from your home.

### Variation 3: "Secure delivery fee to be paid"

Here, no PIN is requested: simply "€2.90 for registered delivery". A trivial sum, designed to set off no mental alarm. The real loot is the payment form: full card number, expiry date, security code. The small charge also serves to test whether the card is active before a series of much larger transactions. It's the same mechanism as [the overpayment refund scam](/blog/2026-03-05/faux-remboursement-payer-pour-etre-rembourse).

## The signs that give away a fake text message

None of these clues is decisive on its own, but taken together they leave no doubt.

| Signal | What a real bank does | What the fraudster does |
|---|---|---|
| PIN | Never asks for it, under any circumstances | Demands it to "activate" or "verify" |
| Link in the message | Extremely rare, and never to a card entry form | Shortened link, lookalike domain |
| Urgency | Gives you weeks, follows up by post | 24- or 48-hour countdown |
| Home visit | Doesn't exist for collecting a card | Courier "from the security department" |
| Fallback channel | Points you to your branch or the app | Gives you a number to call back |

Also look at **the link's domain**, in full, up to the first slash. Fraudsters rely on addresses such as `banque-securite-client.com` or endless subdomains that push the real name off the screen. On a small screen, that truncation is lethal; many readers do better by reading sensitive messages on a larger screen, or by keeping a [LED magnifying glass](https://www.amazon.co.uk/s?k=loupe+grossissante+LED+lecture&tag=ds0608-21) within reach to re-read an address printed in tiny characters.

![Young woman in a pink tank top holding a smartphone in her hand, outdoors, blurred background](/images/blog/2026-10-10-arnaque-sms-faux-colis-douane-livreur-numero-personnel/body-1.jpg)

## The golden rule: hang up and call back yourself

The whole structure of the scam rests on one thing: keeping you inside **their** communication channel. The link they send, the number they give, the person who calls you back.

The countermeasure is absolutely simple:

1. **Never use the link or the number provided.** Even if they look correct.
2. **Open your banking app** or type your bank's address by hand. Any genuinely pending transaction will show up there.
3. **Call the number printed on the back of your card** or your branch's number, noted on a paper statement.
4. **Take your time.** No legitimate banking decision hinges on ten minutes.

For people who aren't used to navigating an app, it helps to write down, once and for all, the branch number and the card-cancellation hotline on a card, tucked inside an [RFID-blocking card holder](https://www.amazon.co.uk/s?k=porte-cartes+blocage+RFID&tag=ds0608-21) kept in the wallet. The habit then becomes mechanical: you read the card, you dial, you don't click.

## If a "courier" rings your doorbell

This situation deserves its own protocol, because it puts your physical safety at stake as much as your money.

- **Don't open the door.** Speak through the door or the intercom.
- **Never hand over a bank card, a cheque, cash or jewellery** to anyone whose visit you didn't arrange yourself.
- **Ask for time**: "I'm calling my bank and I'll get back to you." A fraudster will insist; a genuine professional doesn't exist in this scenario.
- **Note everything down**: time, description, vehicle, registration plate if visible.
- **Call the police** (17 in France) if the person insists or refuses to leave.

For elderly people living alone, a [digital door viewer with a screen](https://www.amazon.co.uk/s?k=judas+numerique+ecran+porte&tag=ds0608-21) makes this check far less stressful: you can see who's ringing without going near the door, and describe the individual accurately afterwards. It's a modest piece of equipment that changes the dynamics of a doorstep approach. Our additional advice can be found in the guide [protecting older people from text message scams](/blog/2026-01-10/proteger-seniors-arnaques-sms).

## What to do if you've already handed something over

The decisive factor is timing. The first few hours matter more than everything else put together.

### In the first few minutes

**Block your card.** From your banking app (the instant card-freeze function), then by phone with your bank. The **French interbank card-cancellation service can be reached on 0 892 705 705**, available 24/7 if you can't get through to your own institution.

**Change your banking credentials** from a clean device, not from the link you received.

**Stop answering any call claiming to be from your bank.** Fraudsters often call back, sometimes posing as the fraud department, to extract one last code.

### Within 24 hours

**File a complaint** at a police station or gendarmerie, or submit a pre-complaint online on the French Interior Ministry's portal. Filing a complaint is almost always a prerequisite for reimbursement.

**Dispute the transactions in writing** with your bank. The French Monetary and Financial Code (articles L.133-18 onwards) provides for the reimbursement of unauthorised payment transactions. Be careful: if the bank establishes **gross negligence** — notably voluntarily disclosing your PIN — it can refuse. Hence the importance of describing precisely the manipulation you were subjected to, the number spoofing, the fake adviser, the urgency scenario.

**Report the message.** Forward the fraudulent text to **33700**, France's national SMS spam reporting service, run by the French operators. Also report the site address on the **Phishing Initiative** platform and the overall case on **cybermalveillance.gouv.fr**, the national assistance scheme for victims of cybercrime. Our article [reporting a fraudulent text message](/blog/2026-01-20/signaler-sms-frauduleux-33700-indemnisation) walks through the whole process.

### In the days that follow

- Monitor your statements over several weeks: some debits appear with a delay.
- If your credentials were reused elsewhere, change them. A [paper password notebook](https://www.amazon.co.uk/s?k=carnet+mots+de+passe+papier&tag=ds0608-21), kept in a locked drawer, remains an acceptable solution for anyone who refuses digital managers — and in any case far better than using the same password everywhere.
- If a dispute with your bank drags on, refer the matter to the institution's **banking ombudsman**, and then if necessary to the **ACPR** (the French prudential supervision and resolution authority).

![Person in a beanie and scarf checking their smartphone in the dark, face lit by the screen](/images/blog/2026-10-10-arnaque-sms-faux-colis-douane-livreur-numero-personnel/body-2.jpg)

## Three habits that close the door for good

**Know your card's expiry date.** It's printed on the card. If a text message announces a renewal when your card is still valid for another eighteen months, doubt kicks in immediately. Note that date in your diary and the question is settled for three years.

**Turn on payment notifications in your banking app.** Every transaction triggers an alert on your phone. A fraudulent withdrawal becomes visible within seconds instead of weeks. It's the most effective free measure in existence.

**Separate your uses.** A current account with a modest limit for everyday purchases, and savings in another account not linked to the card. The maximum loss is then capped by design. For those who mainly pay online, the single-use virtual cards offered by most French banks add a useful layer.

And for contactless payments on public transport or in crowded places, an [anti-RFID bank card sleeve](https://www.amazon.co.uk/s?k=etui+anti+RFID+carte+bancaire&tag=ds0608-21) limits remote reading — a marginal risk compared with smishing, but the habit costs next to nothing.

## What this scam tells us about the 2026 landscape

For several quarters now, the Banque de France has recorded a **rise in manipulation-based fraud**, where the victim carries out the transaction themselves after being deceived, at the expense of purely technical fraud. That's exactly the register of the fake card renewal: no hacking, no malware, just a credible scenario and time pressure.

Detection tools are improving in parallel: the message-analysis systems built into Android and iOS phones are getting better and better at flagging dubious links, and French operators filter out a growing share of these campaigns. But those filters can't see the phone call that follows, or the courier at the door. The last link in the chain is still human.

The good news is that the defence fits into a single sentence, one you can pass on to anyone in ten seconds: **nobody, ever, asks for your PIN, and nobody comes to your home to collect your card.** Repeat it to your parents, your grandparents, your children opening their first account. It's worth all the software in the world.

If you need to warn someone quickly about an ongoing campaign, a short, factual text message often works better than a long phone call. You can [send one free of charge from our homepage](/), with no sign-up — a few words along the lines of "If you get a text about your bank card, don't click, call me" can save someone a very bad quarter of an hour.

{/* image-sources: https://images.pexels.com/photos/7394/pexels-photo.jpg?auto=compress&cs=tinysrgb&dpr=2&h=650&w=940 https://images.pexels.com/photos/3605/person-woman-apple-iphone.jpg?auto=compress&cs=tinysrgb&dpr=2&h=650&w=940 https://images.pexels.com/photos/296654/pexels-photo-296654.jpeg?auto=compress&cs=tinysrgb&dpr=2&h=650&w=940 */}