Like millions of French people, you may have already received an SMS asking you to click on a link supposedly referring to the Social Security site to retrieve your new vital card.
Warning, this is a scam.
Particularly present since mid-December, it is one of the top 3 concerns of cybermalveillance.gouv.fr, generates dozens of daily reports and claims thousands of victims.
These phishing attempts aim to usurp your personal information and more specifically your bank details.
Once this data is in his possession, the fraudster can either resell it in the cybercriminal ecosystem, or use it to defraud you directly.
Explanations.
To discover
LIVE - The campaign is entering its home stretch
Macron-Le Pen debate: what to remember from the face-to-face for the 2022 presidential election
Taxes 2022: all about your tax return
A well-oiled modus operandi
The mandatory update of the vital card once a year is not necessarily part of the first reflexes of the French.
So when a phone number pretending to be Social Security contacts them to push them to do this renewal, many fall into the trap.
“
Your new vital card is available.
Please fill out the form in order to continue to be covered
”, can we read in a standard text message, followed by a fraudulent link.
The user, thinking well, gives his name, first name, address and bank details.
Read alsoFrauds: these professions forced to cooperate
But a few days later, even a few weeks or months, the scammer comes back to the charge, this time by telephone, pretending to be a trusted contact, often a bank adviser or an anti-fraud policeman.
"
With all the information previously filled in by the victim, the fraudster is able to know the personal information of his victim as well as the name of his bank, fueling the climate of trust he wishes to establish
", explains Jean-Jacques Latour, manager cybersecurity within the Public Interest Group Action against Cybermalevolence.
The cybercriminal can then take advantage of this trust to have operations confirmed by the victim, most often purchases of goods that he then resells.
“Most often, the cybercriminal calls his victim on Friday evening or on the weekend so that he cannot call his bank immediately.
»
Jean-Jacques Latour, cybersecurity manager at the Public Interest Group Action against Cybermalevolence
To appease their victims, cybercriminals spoof user information “
from above
”.
It starts with a surname, a first name, an address, then we gradually arrive at bank details, so as not to rush.
Added to this technique is the subject of the SMS, the vital card, which affects health and therefore catches the eye.
Even if fraud with the vital card has always existed, Jean-Jacques Latour observes an upsurge in cases of "
false advisers
since the summer of 2021. Since March 2021, the directive on the security of means of payment requires banks to request a code from their customer for any purchase made on the internet.
As the victim is the only one who knows this code, fraudsters are forced to call them directly to be able to scam them.
Read alsoPrepaid card scams take off
The cybercriminal also pays attention to the finer details, such as the times at which he calls his victim.
“Most often,
he calls on Friday evening or at the weekend so that she cannot call back her bank immediately
,” specifies Jean-Jacques Latour.
To make the call credible, the cybercriminal usually passes the call off as an emergency that must be dealt with quickly, by the bank's anti-fraud service, which is open 24 hours a day.
In short, everything is thought out to make the scam as credible as possible.
“If you receive an SMS about your vital card, flee”
To avoid being scammed, the first advice is to remember that health insurance never asks for the transmission, by email or SMS, of personal elements.
“
Only exchanges of information via the Ameli account are secure
”, specifies the health insurance.
“
The protocol must alert, we do not enter a renewal of vital card on the internet, but rather at a doctor or pharmacist.
If you receive an SMS about your vital card, flee
,” adds Jean-Jacques Latour.
If you have already given your details, consider a call from your "
banking adviser
on a night or weekend is extremely suspicious, and don't divulge any information if you are asked for codes.
Finally, if it is too late and the fraudster is in possession of a code that could confirm an internet transaction with your card, make an immediate opposition before it is used.