"Hi, this is for Sophie's collection in the accounts team, her leaving do is Friday. We're only €200 short of the €600. Your share: €15 → cagnotte-solidaire-participation.fr"
Karim does in fact work with a Sophie. The amount is trivial. The tone is that of a colleague in a hurry. He clicks, enters his card details, confirms. Two days later, a €349 debit goes out to a foreign provider, then another €349 the following month.
There was no collection. There was a mobile number rented for two hours, a message sent to four thousand people, and a recurring payment form dressed up as a one-off contribution.
The charity scam is nothing new — it existed in the form of bogus street collections. What changed in 2026 is that it now travels through the most intimate and most credible channel there is: your text message thread.
Why generosity is a security flaw
Every smishing campaign exploits an emotion. The fake parcel plays on anticipation, the fake bank adviser on fear, the fake fine on guilt. The fake charity appeal plays on something far harder to neutralise: the desire to do good, and the shame of saying no.
Three mechanisms stack on top of one another.
1. The amount is deliberately tiny. €10, €15, €20. Below the threshold at which you'd take the time to check. That's the whole principle of the scam: it isn't the displayed sum that's stolen, it's the card number that's captured — and sometimes the authorisation for a recurring direct debit slipped in in pale lettering beneath the confirm button.
2. Refusing has a social cost. Faced with a fake bank message, saying no costs nothing. Faced with "the collection for Martine's son's funeral," hesitating makes you feel stingy. Scammers know this and calibrate their wording so that checking seems tactless.
3. The urgency is plausible. A collection has a natural closing date. A disaster appeal has an immediate purpose. Unlike "your account will be suspended within 24 hours," the countdown doesn't ring false.
A legitimate appeal for donations will never hold it against you for taking twenty-four hours to check. A scammer will.
The four dominant scenarios in 2026
The workplace or school-parents collection
This is the most effective format, because it is micro-targeted. Scammers harvest lists from data breaches: internal company directories, sports club mailing lists, parent groups. A single plausible first name is enough to tip vigilance over. No logos, no brands: just a familiar tone.
Typical signal: the message never says who is writing. "This is for the collection for…" with no signature. A colleague would tell you their name.
The fake appeal from a major charity
Croix-Rouge française, Restos du Cœur, Secours populaire, Fondation pour la recherche médicale, SPA: all of these names are imitated, usually a few days after a news event — a storm, a fire, a humanitarian crisis. The alphanumeric sender ID can display a charity's name, since that field isn't authenticated end to end and remains spoofable.
The Comité de la Charte / Don en Confiance certifies organisations in France that accept external scrutiny of their fundraising practices. Checking whether a charity appears on the list published on the Don en Confiance website takes thirty seconds and eliminates the vast majority of fakes.
The "local solidarity" text
"Collection for families affected in the local area, give what you can." This format thrives after a flood or a local fire. It's formidable because the recipient knows about the event: they've seen the pictures, they know it's real. It doesn't occur to them that only the appeal is fake.
A local council, a prefecture or a municipal social action centre doesn't organise donation drives by text message with card payment on an unknown website. Genuine collections go through the town hall, an identified charity, or an official platform announced on the council's website.
The donation "on behalf of someone close to you"
The cruellest variant: a message referring to an illness, a hospital stay or a death among people you know, sometimes fed by information genuinely posted on social media. The link leads to a fundraiser page mimicking the interface of a well-known platform.
How to tell a real fundraiser from a fake one
Legitimate French fundraising platforms (Leetchi, Le Pot Commun, HelloAsso for the charity sector, or the donation pages hosted by the charities themselves) share characteristics that copies reproduce badly.
| Element | Legitimate fundraiser | Fake fundraiser |
|---|---|---|
| Link domain | The platform's domain, with no added words | Platform name + hyphens + words ("-participation", "-solidaire", "-fr") |
| Organiser | Identity displayed, often with photo and history | First name only, or anonymous |
| Amount | Free, entered by the donor | Fixed amount, single button |
| Payment methods | Card + sometimes transfer, via a known provider | Card only, bare form |
| Tax receipt | Offered if the organisation qualifies | Absent, or "sent later" |
| Terms | Accessible T&Cs, complete legal notices | Dead links or empty pages |
The most reliable test is still the simplest: never go through the link in the text. Open your browser, type in the name of the platform or charity yourself, and look for the collection using their own search. A genuine public fundraiser can be found; a fake one exists only in the message.
On a laptop, hovering over a link to read the real address is instantaneous. On mobile it's the opposite: the URL is truncated, and the finger is faster than the eye. That's one of the reasons smishing pays better than email phishing. A phone stand sitting on your desk, forcing you to read the screen at a distance rather than scrolling on autopilot, changes more behaviour than you'd think.
The three payment traps to know about
The disguised recurring debit
This is the heart of the business model. You think you're paying €15 once; in reality you're authorising a subscription. The legal notice does exist — written in light grey, in 8-point type, under the button. Legally, it lets the operator defend itself; practically, nobody reads it.
Reflex: before confirming anything, look for the words "monthly," "recurring," "renewal," "until cancellation." If they appear anywhere, this is not a one-off donation.
Payment by gift card or crypto
No registered charity will ever ask for a donation in the form of prepaid cards, Neosurf/PCS vouchers or cryptocurrency transfers. It's the most binary marker there is: the moment it appears, the case is closed — it's a scam.
The instant transfer
Since instant bank transfers became widespread, scammers have been pushing this payment method because it is irrevocable in practice. A card payment leaves some chance of a chargeback; an instant transfer to a foreign account, almost none. If someone insists on a transfer rather than a card, it's never for your convenience.
What you can do in two minutes before giving
- Identify the real sender. If it's someone you know, call them on the number you already have saved — never the one in the text. Thirty seconds is enough.
- Check the charity. Consult the official website, the Journal officiel des associations, or the Don en Confiance list. A charity recognised as being of public utility is easy to verify.
- Examine the domain closely. Fake domains are almost always recent. A domain name created three days ago for a "national collection" makes no sense.
- Look for the tax receipt. A donation to a public-interest organisation entitles you to a tax reduction (66% of the amount, up to 20% of taxable income; 75% for organisations helping people in difficulty, according to the rules set out by the Direction générale des finances publiques). A legitimate organisation mentions it. A scammer avoids it.
- Pay from a source you chose yourself, not from a link someone sent you.
For people who give regularly, keeping a written record makes all the difference at tax time as well as in a dispute: a personal accounts notebook or a simple ring binder with dividers for receipts and confirmations makes it possible to spot immediately a debit that matches no donation you agreed to.
If the payment has already gone through
Time is the only factor that matters.
Immediately:
- Call your bank and ask for the card to be blocked. Use the number on the back of the card or in your banking app, never a number received by message.
- Explicitly request the blocking of any recurring direct debit mandate linked to the transaction. Blocking the card isn't always enough to stop a subscription that has already been authorised.
- Keep the text: don't delete it. Take a screenshot with the sender's number and the date visible.
Within 24 to 48 hours:
- Dispute the transaction. French monetary and financial law provides a right to reimbursement for unauthorised payment transactions; the Banque de France and the Fédération bancaire française regularly point out that the window for disputing is 13 months for a transaction within the European Economic Area. The sooner you act, the stronger your case.
- Report the message to 33700, the national number for reporting fraudulent texts: forward the text to 33700, then send the sender's number when prompted.
- File a report on cybermalveillance.gouv.fr, which points you to the appropriate steps, and on the PHAROS platform (internet-signalement.gouv.fr) for online content.
- File a complaint: police station, gendarmerie, or online via the THESEE service, dedicated to digital fraud.
In the following weeks:
Monitor your statements for at least three months. Fraudulent debits often start after a deliberate delay, so the victim doesn't make the connection. A handwritten spending log, kept near the post, remains more effective for many people than an app opened once a quarter.
Expect too, a few weeks later, a message offering to "recover your lost funds." That's the second stage of the rocket, and it specifically targets victims who have already been identified.
Protecting those most at risk
Fake donation campaigns primarily target two profiles: older people, statistically more generous and more often already donors, and people involved in charity networks, whose contact details circulate more widely.
A few concrete measures, without being patronising:
- Agree on a simple family rule: no donations by text, ever, whatever the cause. Donations go through a channel chosen in advance (annual direct debit, cheque, official website).
- Cap the payment card used day to day. Most banks let you lower the limit online in three clicks.
- Turn on filtering for unknown senders on the phone, available on both iOS and Android: messages from unsaved senders go into a separate tab, which breaks the reflex to tap.
- Document genuine commitments. A written list of the charities actually supported, kept in a document organiser with compartments along with the tax receipts, means you can answer "do I give to this organisation?" in a second.
For relatives who prefer paper, a practical guide to online scams, browsed at leisure, often goes down better than a demonstration on a screen. Reading gives you time to absorb; a demonstration puts you in the position of a pupil.
The key takeaways
Generosity is not a weakness, and being wary of a text doesn't make anyone less charitable. Genuine French charities overwhelmingly collect by post, by direct debit, through their website or during clearly identified campaigns — not via an anonymous text containing a link to click within the minute.
Three sentences are enough to sum up the defence:
- A donation is never triggered from a link received by text.
- A fixed amount and an irreversible payment are two alarm signals, not details.
- Checking before you give offends no one — and takes less time than disputing a debit.
If a message makes you uneasy without your being able to say why, that unease is often the most reliable piece of information in the message. Forward it to 33700, delete it, and give another way.
