How can you recognize Smishing impots.gouv.fr — fake refund of 437 EUR?

TLDR

SMS impersonating DGFiP announces a tax refund of 137 487 EUR. The link redirects to impots gouv remboursement.fr (the real one: impots.gouv.fr). Information requested: tax number, IBAN, banking login, 3DS SMS code. Indicators: 1) DGFiP...

How it works

Red flags

Urgent pressure to click, pay, or share codes immediately.
A link or sender that does not match the official organization.
Requests for card data, passwords, OTPs, wallet signatures, or bank transfers.

What to do

1Indicators: 1) DGFiP NEVER sends SMS with links; 2) domain ends in .fr but with additional hyphens; 3) URL with a strange subdomain; 4) joint request for IBAN and banking login.
2WHAT TO DO: never click.
3IF YOU ARE A VICTIM: block your card (0892 705 705), change your bank password, report on Perceval and signal.conso.gouv.fr.

Source

cybermalveillance-gouv-fr

Source reviewed by Mythos Forensic Team

https://www.cybermalveillance.gouv.fr/tous-nos-contenus/fiches-reflexes/hameconnage-phishing

FAQ

Is Smishing impots.gouv.fr — fake refund of 437 EUR a real scam pattern?

Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.

What are the first warning signs?

Urgent pressure to click, pay, or share codes immediately.; A link or sender that does not match the official organization.; Requests for card data, passwords, OTPs, wallet signatures, or bank transfers.

What should I do first?

Indicators: 1) DGFiP NEVER sends SMS with links; 2) domain ends in .fr but with additional hyphens; 3) URL with a strange subdomain; 4) joint request for IBAN and banking login.; WHAT TO DO: never click.; IF YOU ARE A VICTIM: block your card (0892 705 705), change your bank password, report on Perceval and signal.conso.gouv.fr.

Can LegalAudit check my case?

Yes. Start a free chat and paste the message, link, sender, or payment details for triage.