"I clicked. I entered my card details. And then I waited to see what would happen."
It's the sentence that comes up most often in victims' accounts, and it's exactly what you should never do. In an SMS scam, the click is almost never the decisive moment. The decisive moment is the hours that follow: the hours when the money is still moving, when the traces still exist, when the bank hasn't yet received a stop order, and when the screenshots that will make all the difference at a police counter are still on the phone.
After three days, everything gets harder. The transaction has been debited, the fraudulent URL has been taken down, the sender number has been recycled, and the victim has to prove something that, forty-eight hours earlier, was simply there on the screen.
Here is the real timeline of the 72 hours following a fraudulent text message, and what's at stake at each stage.
Hour 0 to 1: shut off the tap before trying to understand
The first instinct shouldn't be to understand, it should be to stop the flow. Understanding takes hours; a fraudulent transfer sometimes takes less than ten minutes to leave your account.
If banking details were entered, you need to block the card immediately — through the banking app (most now offer card blocking in two taps), then by phone via the bank's 24/7 card-blocking service. As a last resort, France's interbank card-blocking line, 0 892 705 705, works for every French bank.
If a code received by SMS was shared, this is more serious than a leaked card number: the one-time code is precisely what validates a transaction with the bank. You must explicitly tell the adviser, because it changes how the incident is classified.
If online banking credentials were entered, change the password from another device and request a temporary block on online access.
If nothing was entered but the link was opened, the risk exists but remains lower: on an up-to-date smartphone, simply visiting a page isn't enough to compromise the device. The danger comes from app installations outside the official store — if an installation was accepted, uninstall it right away and review the device.
Simple rule: block first, think afterwards. No bank will hold it against you for blocking a card out of an abundance of caution.
Hour 1 to 3: build the evidence file while it still exists
This is the step almost everyone skips, and it's the one that decides whether you get refunded. A victim who turns up at the police station with a single sentence ("I got a text from my bank") has no case. A victim who turns up with seven timestamped screenshots does.
What to capture, in this order:
| Item | Why it matters |
|---|---|
| The full SMS, with the sender as displayed | Proves spoofing or identifies the number used |
| The entire message thread, scrolling back | Shows whether the fake message slipped in among genuine ones |
| The exact URL of the link (long press → copy) | Identifies the fraudulent domain before it's taken down |
| The fraudulent web page, if still accessible | Evidence of brand impersonation |
| Bank notifications received | Timestamps the disputed transactions |
| The account statement showing the debit | Basis for the refund claim |
| Call history, if a fake adviser phoned | Establishes the full sequence of events |
Two technical points that count.
Do not delete the text message. It's the most common emotional reflex — erasing the trace of your own embarrassment. Yet the original message, still sitting in your inbox, remains the strongest piece of evidence in the file. Capture it, and leave it where it is.
Back it up somewhere other than the phone. A device that breaks down, gets lost or has to be reset takes the whole file with it. Exporting the screenshots to separate storage, or onto a secure USB drive kept at home, puts the file out of harm's way. Advisers at Cybermalveillance.gouv.fr systematically recommend keeping a copy off the affected device.
Hour 3 to 12: three reports that do three different jobs
People often confuse "reporting" with "filing a complaint." These are three distinct procedures, with different effects. Doing all three takes less than thirty minutes.
33700: bringing down the campaign
33700 is the official platform for reporting spam and SMS fraud, run by the Association Française du Multimédia Mobile on behalf of French mobile operators. How it works: forward the fraudulent text to 33700, then reply to the automated message with the sender's number.
This report won't trigger any investigation into your personal case. What it does do is feed collective detection: above a certain volume of reports, the operator can block the sender number and have the domain name used in the link taken down. It's a gesture for everyone else, and it takes thirty seconds.
Perceval: disputing fraudulent card use
Perceval is the Gendarmerie Nationale's online service dedicated to bank card fraud, accessible via FranceConnect. It's for victims who still have their card in their possession — in other words, the overwhelming majority of smishing cases, where only the data was stolen.
A Perceval report generates a receipt. That document has real value: it supports your refund claim with the bank and feeds into national fraud statistics. It doesn't replace a police complaint, but it doesn't require one either.
Cybermalveillance.gouv.fr: getting guidance and documentation
France's national assistance scheme for victims of cybercrime offers an online pathway that asks the right questions and provides step-by-step guidance sheets. Especially useful when the situation is murky: several accounts affected, uncertainty about what was compromised, a work device involved.
Hour 12 to 48: filing a complaint, and doing it properly
Filing a complaint isn't optional when money has been debited: the bank will ask for it almost every time.
Where. At any police station or gendarmerie brigade, regardless of where you live. Refusing to take a complaint is illegal. If you hit a wall, the complaint can be sent directly to the public prosecutor at the relevant tribunal judiciaire, by registered post with acknowledgement of receipt.
Online pre-complaint. The online pre-complaint service lets you fill in the form in advance and reduce the counter visit to a signature. Handy, but be careful: it doesn't count as a complaint until it has been signed.
What to bring. ID, a bank statement showing the disputed transactions, printouts of the screenshots, the Perceval receipt if you already have it, and a written timeline of events — one page is enough, with dates and times. Officers handle cases like this every day; an organised file is registered faster and more thoroughly. A simple expanding document folder saves you from turning up with loose sheets and crumpled statements.
On the legal classification. Smishing falls under fraud (article 313-1 of the French penal code), often combined with the fraudulent collection of personal data and identity theft (article 226-4-1). It isn't up to the victim to classify the offence, but mentioning that the message impersonated a specific organisation (bank, health insurance fund, pension fund, delivery service) helps link your case to campaigns that have already been identified.
Hour 48 to 72: the refund claim, and the law behind it
This is the point victims know least about, and the one that weighs most heavily on the wallet.
The French monetary and financial code is clear: where the user reports an unauthorised payment transaction, the bank must refund immediately, and no later than the end of the first business day following the report (article L133-18). It can only refuse by demonstrating gross negligence on the customer's part — and the burden of proof lies with the bank, not with the customer proving their innocence.
This has been reinforced by Cour de cassation case law, which has repeatedly held that merely passing on a code received by SMS is not enough to establish gross negligence, particularly where the victim was put at ease by a message or call convincingly imitating their bank.
In practice:
- A written dispute, sent to the bank by registered post with acknowledgement of receipt, setting out the timeline, the transaction references and the supporting documents. The legal window to dispute is thirteen months.
- If refused, refer the matter to the banking ombudsman — a free service whose contact details appear on account statements and on the bank's website.
- If mediation fails, take it to court, possibly with the support of a consumer association. Cases published by Que Choisir show that a significant number of initial refusals are overturned at this stage.
One practical tip that's often overlooked: keep a paper copy of every letter sent, along with its acknowledgement of receipt. An archive box with a flap is enough to hold a complete file for however many months the procedure lasts.
The mistakes that sink a strong case
A few behaviours, all perfectly understandable, regularly ruin cases that should have succeeded.
Calling back the number that sent the text. At best, nothing comes of it. At worst, it restarts the script: the scammer then poses as the "fraud department" and gets what they didn't already have.
Waiting to see whether the money comes back on its own. It doesn't. And every day that passes weakens the argument that you reacted quickly.
Resetting the phone in a panic. Sometimes useful after a dubious installation, but disastrous if done before the evidence has been backed up.
Paying to "recover" lost money. Lists of victims circulate, and a second wave of approaches often arrives a few weeks later, under the guise of debt recovery or legal assistance. No legitimate organisation asks for an upfront payment to return stolen funds.
Saying nothing to those around you. Shame is the scammer's best ally. Reports from the Banque de France point to a steady rise in so-called "manipulation" scams, precisely because they exploit the victim's isolation.
Afterwards: closing the doors that were left open
Once the urgent part is handled, there's the clean-up. It takes an evening.
- Change the passwords of accounts linked to the email address involved, starting with the mailbox itself. A password manager stops you repeating the single-password mistake; for those who prefer paper, a password notebook kept out of sight is still infinitely safer than using the same password everywhere.
- Turn on two-factor authentication wherever possible, preferably through a dedicated app rather than by SMS. For sensitive accounts, a physical FIDO2 security key eliminates the entire category of intercepted-code attacks.
- Check recurring direct debits on the last three statements: some frauds settle in as discreet subscriptions of a few euros.
- Monitor your banking records: in cases of broader identity theft, you can exercise your right of access to the central cheque register and the FICP directly with the Banque de France.
- Tell the people around you what happened. It's the most effective prevention measure known, and the cheapest. Accessible books on home cybersecurity help get the message across to relatives who will never read an official information sheet.
The takeaway
An SMS scam is not a financial death sentence. French law protects victims of unauthorised transactions, the reporting mechanisms exist and are free, and banks often back down in the face of a documented case. But everything rests on a perishable commodity: the trace.
Block within the hour, capture within three hours, report within the day, file a complaint within two days, dispute in writing within three days. Followed in that order, this sequence turns a victim into a case file. And a case file, unlike a story, gets answers.
Useful numbers and services: 33700 (reporting fraudulent SMS), 0 892 705 705 (interbank card blocking), 17 (police emergency line), Perceval via FranceConnect, Cybermalveillance.gouv.fr, the French Interior Ministry's online pre-complaint service.
