Short answer: a gym is entitled to send you text messages about session reminders, cancelled classes or upcoming direct debits, because you gave it your number and a direct debit mandate when you signed up. These messages come from a short code starting with 3xxxx or from an alphanumeric sender, and they never ask you to pay via a link. The moment a "gym" text asks for a bank card, bank details or your login credentials to "reactivate your pass", it's a scam: don't click, and forward it to 33700.
Updated 17 October 2026.
Every autumn, gyms record their second membership peak of the year, after the January one. And every autumn, the same scenario plays out in people's inboxes: a member signs a contract on a Saturday, and within ten days their phone has collected five or six messages — welcome, access code, reminder about the strength-training class, confirmation of the first direct debit, invitation to refer a friend. Then a seventh: "Your payment has been declined. Your access will be suspended within 24h. Settle here: [link]".
That seventh message is the only fake one. It's also the most effective, because it arrives at exactly the moment when a new member is expecting a payment confirmation and doesn't yet know how their gym usually communicates.
Why does a gym send you so many text messages?
Because a gym membership is one of the few everyday contracts that combines three things: a mandatory mobile number, a SEPA direct debit mandate and an almost daily relationship.
When you sign up, you usually hand over:
- your surname, first name and date of birth (required for the medical certificate or health questionnaire);
- your mobile number, often used as your account ID in the gym's app;
- an IBAN and a SEPA direct debit mandate for the monthly subscription;
- sometimes a photo for your access pass.
From then on, the gym's management software knows how to send you:
| Type of text message | Typical sender | Does it ask for a payment? |
|---|---|---|
| Access code or temporary pass | 3xxxx short code or the brand name | No |
| Group class reminder or cancellation | Alphanumeric sender | No |
| Monthly direct debit confirmation | 3xxxx short code | No |
| Promotional follow-up (referrals, coaching, nutrition) | 3xxxx short code with STOP wording | No |
| Genuine arrears notice | Letter + email + phone call, rarely a text alone | Never via a link in a text |
The key takeaway: none of these legitimate messages asks you to enter a bank card from a link. A gym that spots a rejected direct debit will normally tell you by email, by letter, or at reception when your pass doesn't work — and you settle up on site or in your online account, not through a URL received by text.
If you can't work out who sent a message, our guide to decoding a short code or an alphanumeric sender explains how to trace it back to the sender.
How do you spot the fake "payment declined" text?
By four signals that nearly always appear together: urgency counted in hours, a deliberately small amount, a shortened link, and the absence of any detail the gym actually knows about you.
The messages seen since the start of the 2026 autumn season always follow the same frame:
"[BRAND]: your payment of €2.90 has failed. Without settlement within 24h, your membership will be terminated and administration fees applied."
Let's break down what doesn't add up:
- The amount is absurd. A gym membership costs between €20 and €50 a month; a rejection concerns the full instalment amount, not €2.90. That small figure isn't a mistake, it's a choice: it lowers your guard and gets you to enter your card without thinking. The same lever is at work in fake customs fee texts.
- The deadline is far too short. A gym membership contract allows several weeks to settle arrears, not 24 hours. No serious business terminates a membership in a single day.
- The message mentions neither your club nor your membership number. Real gyms sign their messages with the exact club name ("[Brand] Villeurbanne Gratte-Ciel"), because their customers use one specific site.
- The link doesn't point to the official domain. Fakes use URL shorteners or lookalike domains, with a hyphen or an exotic extension. Check the address without clicking: a long press on the link shows the full URL on both iOS and Android.
One last clue, often decisive: a rejected SEPA direct debit leaves a trace in your banking app. Open your bank, look at your transactions. If there's no rejection, the text is fake — and you didn't have to click to find out.
What about the text offering a coach, supplements or a "members-only deal"?
It's often legitimate, but it falls under commercial marketing: you can stop it with a single reply.
Gyms frequently outsource their campaigns to messaging providers, which is why the message arrives from a short code you don't recognise. In France, marketing by text requires the person's prior consent or an existing customer relationship, and every commercial message must offer a free and simple way to opt out: that is the long-standing position of the CNIL on commercial marketing.
In practice:
- Reply STOP to the short code that messaged you. The reply is free and not premium-rated.
- Wait for the acknowledgement (it arrives within a few seconds to a few minutes).
- If the messages continue beyond a few days, ask the gym in writing to remove your number from its marketing lists, invoking your right to object.
- If there's no response, you can file a complaint with the CNIL through its online complaint service.
Watch out for a useful nuance: replying STOP cuts off marketing, not service messages. You'll still receive class cancellations and access codes, and that's a good thing. How these lists work in full is set out in our article on the rules for SMS marketing in France.
On the other hand, never reply STOP to a fraudulent text: it confirms to the scammer that your number is active and read. A fake message is reported, not negotiated with.
Why are gym members an attractive target?
Because a gym member has, by definition, agreed to a recurring payment — so the scammer doesn't have to convince you to pay, only to pay somewhere else.
Three characteristics make the target profitable:
- Automatic payments feel routine. You already have an active SEPA mandate. A message about a direct debit doesn't surprise you.
- Turnover is huge. Gyms lose and recruit members massively from one month to the next: at any given moment, a large share of members are too new to know the club's usual communication channel.
- Member files get passed around. Between the management software, the mobile app, the SMS provider, the nutrition partner and the class booking platform, your number travels through several processors. One compromised link in the chain is enough for a list of numbers, complete with the brand name, to end up being exploited.
That's what explains the recurring unease: "this text knew the name of my gym". It isn't magic, it's data. We've detailed this leak mechanism in relation to delivery texts that know your name and address.
What should you actually do when the text arrives?
Three minutes are enough to settle it, without ever opening the link.
- Don't click. That's the only truly irreversible action.
- Check your bank to see whether a direct debit was rejected. No rejection = fake message.
- Check your online account or the gym's official app, opened from your home screen and not from the text: genuine unpaid amounts show up there.
- Call the club's reception on the number shown in your contract or on the shopfront, never the one in the message.
- Forward the message to 33700 (a free service, the official platform for reporting unwanted text messages, backed by the operators and Arcep). You'll receive a confirmation request: send back the sender's number, again to 33700. The handling process is explained in what happens to your report to 33700.
- Block the sender, then delete the message once the report has been sent.
If you've already entered your bank card, time matters more than anything: block the card with your bank, keep a screenshot of the text, and file a complaint. The full procedure is described in our guide to the 72 hours after clicking on a fraudulent text. The cybermalveillance.gouv.fr portal also offers an updated phishing quick-reference sheet.
Can you limit the flow of texts right from sign-up?
Yes, and that's the moment when you have the most leverage, because everything is decided on the membership form.
A few habits that cut the noise for good:
- Untick the partner boxes (nutrition, insurance, equipment shops): these are what feed future campaigns, often sent by third-party providers.
- Read the data protection notice: the gym must state who the data controller is and which processors your data is passed to.
- Give a secondary number for anything that isn't an emergency contact. An eSIM or a second line dedicated to businesses compartmentalises things effectively; the method is detailed in our article on a second number for everything that isn't your close circle.
- Save the club's official short code in your phone as soon as you get the first message, under a clear name ("Gym – official"). Any message coming from elsewhere immediately becomes suspicious.
- Turn down the app if you don't want it: many gyms accept a physical pass, which requires no notifications. A clip-on sports badge holder or a locker key wristband is enough to keep access without piling up accounts.
And for members who mainly receive session reminders: rather than relying on the club's texts, a paper training log or a sports watch with local alarms makes you self-sufficient. Fewer incoming notifications also means less surface area for a fake message. In the same spirit, a yoga strap with an exercise guide or a pair of adjustable dumbbells lets you keep making progress on days you skip the gym, without depending on the schedule pushed by the app.
Summary in six lines
- Texts about class reminders, access codes and payment confirmations are normal: you gave your number when you signed up.
- Commercial messages must include a free STOP option.
- No genuine gym text asks for a bank card via a link.
- A trivial amount and a 24-hour deadline are the two hallmarks of a fake.
- Always check in your bank and your online account, never from the link.
- Forward the fraudulent message to 33700, then block and delete.
Frequently asked questions
Can my gym terminate my membership by text?
It can inform you by text, but termination for non-payment follows the procedure set out in the contract, generally with a written formal notice and a deadline of several weeks. A text announcing termination "within 24h" with a payment link is a scam signal.
Why does the fake text know the name of my gym?
Either because it's targeting the customers of a very widespread brand en masse, or because a list of member numbers has leaked at a processor (app, booking platform, messaging provider). The brand name is therefore no proof of authenticity.
Does replying STOP stop all messages from the club?
No. STOP puts an end to commercial marketing, not to service messages linked to your contract (access codes, class cancellations, payment dates). That's the expected behaviour and it complies with CNIL rules.
I clicked and entered my card: what should I do first?
Immediately block the card with your bank, then change the password for the online account concerned. Keep a screenshot of the text and the link; it will be useful for the complaint and the report.
Are gym text messages premium-rated?
No. Incoming texts are always free in France, and replying STOP to a marketing short code is free. If a message asks you to send a keyword to a number presented as chargeable, be wary: that's not how a gym membership works.
