"HEALTH INSURER: your new 2027 direct-billing card is available. Download it before 31/10 to avoid any interruption in your coverage: espace-adherent-tp[.]net"
Sylvie, 54, an administrative assistant in Chambéry, received this message on a Tuesday morning. Three days earlier she had in fact received a genuine letter from her health insurer about changes to her premiums. The text arrived at just the right moment, with just the right vocabulary, and it asked for nothing more than "downloading a card". She entered her name, her date of birth, her social security number and her IBAN "to verify the premium direct debit". Six days later, a €480 debit left her account for an unknown organisation, and her social security number was circulating in a file that had been sold on.
What makes this scam effective isn't fear. It's ordinary admin: at this time of year, a health insurer writing to you is nothing out of the ordinary. The fake text doesn't create an event — it slips inside an event that already exists.
Why autumn is the perfect season for impersonating a health insurer
The health contract calendar is public and entirely predictable
In France, the vast majority of supplementary health insurance contracts run on the calendar year: expiry on 31 December, premium increases announced in the autumn, a new direct-billing card sent out in December or January. The Chatel law also requires providers to inform policyholders of their cancellation deadline before expiry, which concentrates all this correspondence between September and November.
The result: between 1 October and 31 January, millions of people in France genuinely do receive messages from their health insurer. Renewal notices, proof of coverage, a new card, SEPA mandate reminders, "update your member account". The scammer doesn't need to guess which provider you use: all they have to do is write "HEALTH INSURER" or "YOUR SUPPLEMENTARY HEALTH COVER" and let the recipient fill in the blank with the name of their own.
Almost everyone is covered, so almost everyone is a target
Supplementary health cover applies to virtually the entire population: employees through compulsory group contracts, retirees on individual policies, civil servants, self-employed workers, recipients of the Complémentaire santé solidaire. In other words, a "health insurer" text sent at random hits a relevant target in nearly 100% of cases — whereas a fake text from a phone company or a bank often names the wrong brand.
The direct-billing card is an object nobody can really describe
Ask the people around you what a direct-billing card looks like, who issues it, and what happens if you don't have one. The answers are vague. We know it's used at the pharmacy, that it has an expiry date, that there's a number on it. That's exactly the kind of poorly understood administrative object that smishing thrives on: recipients can't spot the inconsistency, because they have no clear reference point in mind.
What the fake text is really after
Unlike the fake parcel delivery text, which wants your card number, the fake health insurer text is after a broader haul — and often one that's more profitable to resell.
| Data requested | Stated pretext | Actual use |
|---|---|---|
| Name, date of birth, address | "Member identification" | Building a credible profile for the scams that follow |
| Social security number | "Verification of your entitlements" | Benefit fraud, medical identity theft |
| IBAN + mandate signature | "Confirmation of your premium direct debit" | Recurring fraudulent SEPA direct debits |
| Member account credentials | "Access to your card" | Diverting reimbursements, changing bank details |
| Bank card number | "€1.90 reissue fee" | Hidden subscription or card testing |
The most underestimated detail is the SEPA direct debit mandate. Many victims believe scammers need their bank card to take money from them. An IBAN, a name and an electronic signature are enough to set up a direct debit that will go through on the account without raising any particular alarm, especially if the payment description looks like that of a health organisation. The right to a refund does exist — more on that below — but you still have to spot the line on your statement.
Your social security number, the data you can't change
A bank card can be blocked in ten minutes. Your social security number, on the other hand, is assigned for life. It allows a scammer to look legitimate in the next text message, to attempt identity fraud with social security bodies, or simply to increase the value of your record on stolen data markets. That's why the French health insurance system reminds users on ameli.fr that it never asks for bank details or social security numbers by text or email.
The seven signs that give away a fake health insurer text
1. The insurer isn't named, or is named incorrectly
Your provider knows its own name and uses it. A message saying "your health insurer", "your supplementary health cover" or "member services" without ever naming the brand is abnormal. Conversely, also beware of names that are almost right: "Harmonie Mutuelles", "MGEN Service", "Mutuelle Générale de France" — one letter, a plural, an extra word.
2. A short, invented deadline
"Before 31/10", "within 48 hours", "otherwise your coverage will be interrupted". No health insurer suspends your entitlements because you haven't downloaded a file. Entitlements depend on your premium being paid, not on a click.
3. A domain that doesn't belong to the provider
Fake links adopt plausible forms: espace-adherent-tp.net, mutuelle-carte2027.info, tierspayant-fr.top. Look at what comes immediately before the first /: that's the only domain that counts. If it isn't the site you know, the rest of the address is irrelevant.
4. Fees, however tiny
"€1.90 reissue fee", "€2.50 contribution towards postage". A health insurer doesn't charge you to send your card via a link in a text. The small amount is never the point: it's there to obtain sixteen digits.
5. A form asking for more than it needs
To download a document, a member account asks for a username and a password. Not your IBAN, not your social security number, not a photo of your carte Vitale, not a selfie with your ID.
6. A tone that talks about "interrupted coverage"
The threat is always the same: you'll no longer be reimbursed, the pharmacist will refuse the card, your file will be closed. This anxiety-inducing register is an almost systematic marker.
7. A sender using an 06/07 number or a foreign number
French organisations use short codes or an alphanumeric sender name. An "official" message sent from an 07 or a +212 number should be dismissed immediately. Be careful, though: sender name spoofing exists, so a credible sender proves nothing — it's a negative clue, not a positive guarantee.
The only verification method that works
It fits into a single sentence: never verify a piece of information through the channel that delivered it.
- Close the text without clicking.
- Take out your current direct-billing card, or your latest paper renewal notice.
- Call the number printed on it, or open your insurer's official app that you installed yourself.
- Simply ask: "is there anything I need to do about my policy?"
This check takes three minutes and neutralises the entire scam, however sophisticated it may be. For people who don't like hunting for their paperwork, a ring binder with dividers dedicated to health documents and kept near the phone makes a real difference: you're far more willing to check when the information is within easy reach.
Two habits that reduce your attack surface
- Save your insurer's real number in your contacts, under a clear name. An identified incoming call is reassuring; an unknown one raises questions.
- Write down your policy's renewal date somewhere stable. A family wall planner or a simple hardback notebook will do: once you know your policy renews on 31 December, a text talking about a suspension on 15 October instantly loses all credibility.
You filled in the form: what to do next
Timing matters enormously. Here's the order of priorities.
Within the hour
- If you gave out an IBAN: call your bank, ask for account monitoring and for a blacklist of payees to be registered on your SEPA mandate. Specify that no new mandate should be accepted.
- If you gave out a bank card number: block the card immediately via your bank's app or the French interbank card-blocking service (0 892 705 705).
- If you entered credentials: change the password for the member account concerned, and for any other account where you used the same one. This is the moment when a password manager stops being a gadget and becomes useful: it lets you know exactly where the compromised password was reused.
- Check your bank details in your member account: the classic manoeuvre is to replace your IBAN with the scammer's in order to divert your reimbursements.
Within 48 hours
- Report the message by forwarding it to 33700, the official platform for reporting fraudulent text messages, operated with French mobile networks.
- Report the collection site to Phishing Initiative and report the incident on cybermalveillance.gouv.fr, which offers step-by-step assistance.
- Notify your health insurer: providers keep lists of ongoing campaigns and alert their members.
- File a police report, online or at a station. Some avenues of redress depend on it.
In the following weeks
- Reread your bank statements line by line for three months. For unauthorised SEPA direct debits, the French Monetary and Financial Code gives you the right to a refund upon dispute within 13 months (8 weeks without any particular justification for a disputed direct debit). The faster you act, the simpler the process.
- If your social security number was handed over, keep an eye on the statements in your ameli account and report any consultation or dispensing you don't recognise.
- Expect a second wave: victims get called back by fake "anti-fraud departments" or fake advisers. That follow-up call is the logical next step in the scam, not a coincidence.
The special case of company group policies
If your health cover comes through your employer, you're doubly exposed. First, because you often know neither the provider's exact name nor the terms of the contract — HR handles it. Second, because scammers exploit that distance: "Your employer has changed your health cover, please confirm your details".
The rule stays the same, via another channel: no change to a group policy is ever confirmed by text message. You check with your HR department or with the administrator named in the information notice you were given when you were hired. Many employees have never read it; digging it out once a year takes ten minutes and saves a lot of doubt.
Protecting a relative who struggles with these messages
The people most affected are those who receive a lot of health-related post: retirees on individual policies, people with long-term conditions, carers managing a parent's file. For them, three simple steps are often enough:
- Install the insurer's official app for them, and agree that no link received by text will ever be opened.
- Set up a "second voice" rule: any message asking for personal data triggers a call to a trusted third party before any action is taken.
- Provide a comfortable way to read — an adjustable phone stand or a lighted magnifier genuinely helps in reading a web address in full, which is the prerequisite for spotting a fake domain.
Key takeaways
- Health policy renewal season (October → January) is a structural peak for fake health insurer texts.
- The scam isn't primarily after your bank card but a set of data: social security number, IBAN, login credentials.
- No health organisation asks for this information by text, nor charges for sending a direct-billing card.
- Verification always happens outside the text message: the number printed on your card, an app you installed yourself.
- If you clicked: block your card or your mandate within the hour, report to 33700, file a police report, then monitor your statements for three months.
A fake health insurer text isn't recognisable by its clumsiness — the 2026 campaigns are clean, well written and perfectly timed to the calendar. It's recognisable by one thing: it asks you to act inside its own link. The moment you step outside that link, the scam loses all its power.
