Private loan phishing tricks you into filling in a fake credit form or clicking a link that imitates a bank, so criminals can capture your login details, validation codes and ID documents, then empty your accounts or open credit in your name.
The fake online loan simulator
Phishing often starts with a sponsored advert or comparison site promising a loan approved within 24 hours. The form asks for your online banking login, presented as an automatic income check, and that data goes straight to the fraudsters.
Cloned websites of authorised institutions
According to the ACPR, the French banking supervisor, around 70 % of sites added to its blacklist in the third quarter of 2024 impersonated licensed financial institutions. A slightly altered address, an extra hyphen or an odd extension can fool a hurried borrower.
The text message announcing a pre-approved loan
A text signed by a bank or credit company congratulates you on pre-approved financing and asks you to confirm your file through a shortened link. Forward the message to 33700, the French reporting service for spam calls and texts, then delete it.
The validation code, the main target
The fraudster poses as the lender's compliance department and asks you to read out the code received by text so the funds can be released. That code actually approves a payment, adds a payee or registers your card on the criminal's phone.
The fake bank adviser on the phone
The displayed number can mimic your branch through caller ID spoofing. The caller knows your name and IBAN, obtained through earlier phishing, and claims to be securing your loan; hang up and call your bank back on the number printed on your card.
Stolen ID documents, credit opened in your name
Passport copies, tax notices and proof of address sent to a fake lender are used to open accounts or revolving credit with real institutions. Our page on identity theft after a fake loan explains how to limit the damage.
Watermark every document you send
Before sending an identity document, even to a genuine organisation, add a watermark naming the recipient, the date and the purpose. Filigrane Facile, a free public service run by the French state, does this without keeping a copy of your files.
Emails dressed up as the Banque de France
Messages imitating the Banque de France, the AMF or a court claim that a loan is blocked or that a fine must be paid. These institutions never release private credit and never demand payment by email; forward such messages to PHAROS, the official reporting platform.
Spotting a trapped link before you click
Hover over the link to read the real address, and be wary of link shorteners and domains ending in .top, .xyz or .info that imitate a French bank. Type your bank's address yourself and check the full domain name in the browser bar.
Act within the hour if you entered your codes
Call your bank's card cancellation line, change your passwords and remove unknown payees. If your card was used, report the fraud on Perceval, the official card fraud service, then file a complaint. Our guide to reporting a private loan scam lists other steps.
Refunds: what banking law provides
The French Monetary and Financial Code in principle requires refunds for unauthorised transactions, unless the customer was grossly negligent. Banks often cite such negligence when a code was disclosed; a banking ombudsman or consumer association can challenge that refusal.
A genuine loan never starts with a link
A real loan between individuals is concluded with a signed contract and a transfer from an identifiable account, with no banking logins or text codes involved. To check who you are dealing with, follow our method to verify that a private lender is legitimate.
Securing a loan application against phishing
- Type the lender's web address yourself instead of following a link received by text, email or advert.
- Check the lender's authorisation on REGAFI or ORIAS and consult the ACPR blacklist before entering any data.
- Never share your online banking login, card PIN or a validation code received by text message.
- Add a dated watermark to every ID document you send and limit documents to what is strictly needed.
- Turn on your bank's alerts and watch your accounts for several weeks after any credit application.
- Report texts to 33700 and fraudulent websites on PHAROS, even when you have lost no money.
Financial consequences of a phishing attack
| Situation | Possible impact | Remedy |
|---|---|---|
| Fraudulent transfers from your account | Up to the available balance and transfer limit | Immediate stop, written claim, police complaint |
| Card payments after the card is registered on another phone | Up to the card limit | Perceval report and dispute with the bank |
| Credit opened with your stolen documents | Credit amount wrongly claimed from you | Identity theft complaint and dispute with the lender |
| Card cancellation and replacement fees | Depends on bank charges, indicative | Often negotiable with the branch |
| Reporting via 33700, PHAROS and Info Escroqueries | Free | Helps block numbers and websites |
Evidence to keep after a phishing attempt
- The original text or email, with the sender and full link
- Screenshots of the fake website and its address
- The bank statement showing the fraudulent transactions
- The Perceval report receipt in case of card fraud
- The complaint receipt from the police or gendarmerie
- A copy of the written claim sent to your bank
Common traps in loan phishing
- Entering your online banking login in a loan form presented as an automatic analysis of your income.
- Reading out a code received by text to a so-called adviser who says it is needed to release the financing.
- Clicking a shortened link in a text announcing a pre-approved loan you never applied for.
- Sending an unwatermarked passport copy to a lender met on a social network or messaging app.
- Waiting several days before alerting the bank, which reduces the chances of stopping fraudulent transfers.
Phishing and private loans: what victims ask
Must my bank refund me after phishing linked to a fake loan?
The principle is that unauthorised transactions are refunded, but the bank may refuse by citing gross negligence, particularly if you passed on a code. Challenge the decision in writing, then contact your bank's ombudsman; a consumer association can help you build your arguments.
How can I tell whether a pre-approved loan text is genuine?
A reputable lender does not offer pre-approved credit through a shortened link. Do not click; log in to your customer area by typing the usual address or call your branch. If in doubt, forward the text to 33700 and delete it.
What should I do if I sent my ID to a fake lender?
File a police complaint mentioning the risk of identity theft, keep the receipt and warn your bank. Watch your post for unknown credit agreements or subscriptions. If your identity card is misused, the complaint will let you dispute commitments made in your name.
Does loan phishing also target accounts outside France?
Yes, the same pattern hits customers of Belgian, Swiss, Canadian or Moroccan banks, with websites imitating local institutions. Reporting channels vary by country, so contact the local police and the relevant national financial authority.