Suspicious link: how to spot a text or e-mail scam

Module 1

Understanding link scams in 5 minutes

Phishing: how it works

Phishing means pretending to be a trusted organisation, such as the post office, the health insurance service, the tax office or your bank, to push you into clicking a link. The link leads to a fake site, a perfect copy of the real one, which asks for your bank card, your passwords or your personal details.

When the message comes by text, it is called smishing (from “SMS” and “phishing”). It has become very common: a text message is almost always opened, on a small screen where the full address behind a link is hard to read.

Fraudsters send thousands of messages at once, at random. So receiving a fake text doesn't mean your data has been stolen: simply don't act on it.

The most common scams in France

• The fake parcel: “Your parcel could not be delivered, pay €1.99 in fees.” The aim is to get your bank card details.
• Fake health insurance (Ameli): “Your Carte Vitale is expiring, order the new one.” The French health card is never renewed through a link sent by text.
• The fake fine from ANTAI, the French traffic fines agency: “Unpaid fine notice, €35.” Real fines arrive by post, or by e-mail if you asked for it, and are paid only on antai.gouv.fr or amendes.gouv.fr.
• The fake tax refund: the tax office pays refunds automatically into your account, without asking you for anything by text.
• CPF, the personal training account: “Your training rights are about to expire.” Your rights don't vanish overnight.
• The fake bank adviser: after a text, a call, sometimes showing your bank's real number, asks you to “approve a transaction in order to cancel it”. Your bank will never ask you that.

Reading a web address

A web address reads like this: https://www.ameli.fr/assure. The site's real name is the part that ends just before the first slash “/”: the name and its extension, here ameli.fr.

Fraudsters play with everything to the left of it. In https://www.ameli.fr.securite-compte.example/connexion, “ameli.fr” is just window dressing: the real site is securite-compte.example. Likewise, impots-gouv-remboursement.example has nothing to do with the tax office: French government sites always end in .gouv.fr.

Other traps: an almost identical name (arneli-fr.example, where “rn” imitates “m”), a shortened link that hides the destination, or a fake name placed before an “@”. And the little padlock? It only means the connection is encrypted, not that the site is honest: most scam sites have one too.

Warning signs

A booby-trapped message almost always ticks several of these boxes:

• Urgency: “final reminder”, “within 24 hours”, “your account will be suspended”.
• A small amount to pay: €1.99 postage, a €35 fine. It looks harmless, but its real purpose is to get your card.
• A link to open to pay, confirm or “update” your details.
• An unusual sender: an ordinary mobile number, an e-mail address unrelated to the organisation.
• An impersonal message: “Hello” or “Dear customer”, without your name, sometimes with mistakes.

Trap sites have their own signs too: a site name created a few days ago, a cheap extension, a page hosted on a free service, or a form that asks for your bank card straight away. That is exactly what the tool checks for you.

Good habits, and what to do if you clicked

Faced with a dubious message: don't click, don't reply, and check for yourself by opening the official app or typing the site's address. If in doubt, call the organisation on a number you already know, never the one in the message. Never pass on a code received by text: it is used to approve a payment or a login.

If you have already given information:

• bank card: have it blocked by your bank straight away, then keep an eye on your accounts;
• password: change it everywhere you used it;
• keep the message and screenshots, then report it to the police.

In France, free help is available on cybermalveillance.gouv.fr and from Info Escroqueries on 0 805 805 817 (free call).

Key takeawayThe real site is the name just before the first “/”. No serious organisation asks for your card or password through a link sent to you: when in doubt, use the official app or website.

Words to know

Phishing

A scam that imitates a well-known organisation to make you hand over personal or banking details on a fake site.

Smishing

Phishing by text message, for example the fake “parcel on hold” text.

Domain name

A site's real name, just before the first slash “/” in the address, for example ameli.fr.

Shortened link

A short address provided by a service such as bit.ly, which hides where the link really goes.

Redirect

Automatically sending one address on to another, sometimes used to hide the final destination.

HTTPS and padlock

A sign that the connection is encrypted. It protects what you type, but doesn't prove the site is honest.

33700

A free French number to which you forward unwanted or fraudulent texts and calls received in France.

Module 2

Checking a suspicious link step by step

Open the tool

Module 3

Practical cases

The fake parcel text

Jeanne receives: “Your parcel could not be delivered: a fee of EUR 1.99 must be paid before tomorrow at laposte-suivi-colis-fr.example”. Yet she isn't expecting any parcel.

She copies the text and pastes it into the tool. Red verdict: the highlighted real name of the site is laposte-suivi-colis-fr.example, not laposte.fr. In our example, the site imitates La Poste and has only existed for a few days. Jeanne forwards the text to 33700, then deletes it.

The fake tax refund by e-mail

An e-mail in the tax office's colours tells Bernard he is due a refund of €347.50, to be “confirmed” at impots-gouv-remboursement.example/dossier.

The tool flags a fake government site: “gouv” is in the address, but the name doesn't end in .gouv.fr. Bernard reports the e-mail on signal-spam.fr. To check his tax situation, he logs in to his own account on impots.gouv.fr, typing the address himself.

Already clicked, already paid

Before he knew about the tool, Michel paid a €35 “fine” through a link received by text. The next day, he realises his mistake.

He immediately calls his bank to have his card blocked, keeps the text and a screenshot of the page, then reports it to the police. He forwards the text to 33700 and gets guidance from cybermalveillance.gouv.fr. Over the following weeks, he keeps a close eye on his statements: fraudsters often try a second payment.

Common mistakes

• Clicking “just to see”: opening the link can be enough to tell fraudsters that your number is active.
• Trusting the padlock: most scam sites also have an address starting with https.
• Reading the address from left to right: the site's real name is the one just before the first “/”.
• Calling back the number given in the message: call the organisation on a number you already know.
• Giving a code received by text to an “adviser”: that code is used to approve a payment or a login.

The essentials

• No serious organisation asks for your bank card or password through a link sent by text or e-mail.
• Urgency, a small amount to pay and a link to open: this trio gives away most scams.
• The real site is the name just before the first “/”; French government sites end in .gouv.fr.
• The tool checks the link without your device connecting to it, but a green verdict is not a guarantee.
• In France: texts to 33700, e-mails to signal-spam.fr, help on cybermalveillance.gouv.fr.

Test yourself

A few questions to check that everything is clear.