Protecting your everyday payments. 6 chapters and a final quiz.

Chapter 1. Payment fraud in France: the big picture.

Every year, the Observatoire de la sécurité des moyens de paiement (OSMP), France's payment security watchdog hosted by the Banque de France, publishes the official snapshot of fraud. Its findings cut two ways. Payments have never been more secure technically (EMV chips, strong authentication, tokenization), yet fraud remains massive because it has changed targets. Fraudsters no longer attack the card; they attack the person holding it. This is called social engineering: getting you, through pressure or trickery, to do yourself what no hacker could do in your place.

Paying in a store with chip and PIN has become almost impossible to defeat. Fraud has shifted to remote payments and above all to manipulating the victim (fake advisors, fake websites, fake bank details). Checks, although they are disappearing, are paradoxically still the most defrauded payment method relative to the amounts they carry. Here is the map of the threats we will defuse one by one.

Chapter 2. Phishing and the fake bank advisor: the scam of the century.

Three words, one playbook: phishing (by email), smishing (by text), and vishing (by phone, voice phishing). The bait imitates a legitimate sender: a delivery company, the tax office, the national health insurance fund, or a bank. It steers you to a fake site where you type in your own card details or login credentials. That data feeds the second, far more dangerous phase: the call from the fake bank advisor.

CHRONOPOST: your package N.FR2941X is on hold.
Customs fee required (EUR 1.45) within 24h:
https://chronopost-parcel-tracking-fr.info

AMELI NOTICE: your new Vitale health card is ready.
Update your information:
https://ameli-card-renewal-secu.com

=> Red flags: made-up domain, believable micro-amount,
   countdown, subtle typos. A real organization
   NEVER sends a payment link by text.

A few hours or days after you enter your details on the fake site, your phone rings. The screen shows your bank's real number, thanks to a technique called spoofing, which uses software that can display any number the caller chooses. The “advisor” is calm and professional, knows your name, and sometimes knows your recent transactions (harvested through the phishing). He reports suspicious payments “in progress” and offers to help you block them. The trap closes.

Regulators are fighting back too. Since October 1, 2024, French telecom operators must block calls that spoof a French landline or mobile number. The system, created by the 2020 Naegelen law, relies on a number authentication mechanism called MAN. Spoofing is declining, but fraudsters are already working around it with foreign numbers and messaging apps. In the courts, the Cour de cassation ruled on October 23, 2024 (Cass. com., No. 23-16.267). A victim of a fake advisor calling from the bank's displayed number was not grossly negligent, because this setup “lowers the vigilance” of the user, so the bank must refund.

• Hang up as soon as an “advisor” mentions fraud in progress and asks you to act: a real fraud team blocks first and explains later.
• Call back yourself on the official number printed on the back of your card or on your statement, never on a number the caller gives you.
• Never approve a notification that you did not trigger with a purchase you are making right now.
• Never share a code received by text, even with someone who claims to work for your bank.
• Forward fraudulent texts to 33700, France's national reporting number, then delete them.
• Read the notification text before approving: the amount, the merchant, and sometimes the device are spelled out in black and white.

Chapter 3. Skimming, theft, and in-person fraud.

“Physical” fraud has not disappeared; it has become rarer and more professional. Skimming means tampering with an ATM or payment terminal to copy the card's magnetic stripe, while a pinhole camera or fake keypad captures the PIN. The stolen data is used to make cloned cards for use in countries where the magnetic stripe still works. In France, the EMV chip makes a clone useless in stores, but your PIN remains valuable to thieves.

Contactless actually has one of the lowest fraud rates of any payment method: about 0.01% of amounts according to the OSMP, five times lower than the card average. The €50 per-transaction cap (in effect since May 11, 2020) and regular PIN prompts make a stolen card hardly worth exploiting. And blocking a card now takes two taps in the app.

• Before inserting your card, give the ATM's card reader a gentle tug: a poorly attached skimmer will come loose.
• Shield your PIN with your free hand, every time, even when you are alone.
• Turn down any help from a stranger at the ATM; if the machine keeps your card, stay at the machine and call your bank right away.
• At a restaurant or store, never let your card out of your sight: the terminal comes to you, not the other way around.
• Turn on instant notifications in your app: you spot an unknown debit within seconds, not at the end of the month.

Chapter 4. Setting up your card: limits, virtual cards, and 3-D Secure.

The best protection is free and sits in your banking app's settings. A well-configured card automatically limits the damage from fraud. A low limit, contactless kept under control, and a virtual card for unfamiliar sites turn a potential loss of several thousand euros into an incident of a few dozen euros.

3-D Secure: the bodyguard for your online purchases

Since the second Payment Services Directive (PSD2), most online payments require strong customer authentication (SCA). The cardholder proves their identity with two factors out of three: something you know (a code), something you have (a registered phone), and something you are (biometrics). In practice, you approve the payment in your banking app or with biometrics at checkout, through a protocol called 3-D Secure (version 2). Here is what happens behind the scenes.

Some payments go through without any approval, because PSD2 provides for exemptions: amounts under €30 (within certain cumulative limits) and transactions the bank's analysis rates as low risk (Transaction Risk Analysis). Add merchants you have put on a trusted list and recurring subscriptions where only the first payment is authenticated. So a missing 3DS step is not abnormal, but a payment you authenticated yourself is much harder to dispute. Never approve blindly.

Mobile wallets: paying without ever showing your card

Apple Pay, Google Pay, and bank wallets rely on tokenization. Your real card number is never sent to the merchant; a device-specific token replaces it. Every payment requires your biometrics, and if a merchant suffers a data breach, your real card number stays hidden. On security alone, paying with your phone is now safer than handing over your physical card.

Chapter 5. Unknown debit or transfer fraud: the step-by-step procedure.

A debit you don't recognize appears on your account. Don't panic. European law and the French Monetary and Financial Code set out a detailed procedure that is highly protective of consumers, provided you act in the right order and on time. Before disputing, first rule out an obscure merchant descriptor: the company's legal name often differs from its brand name. A forgotten subscription or a purchase by a family member allowed to use the card also explains many unrecognized debits.

For cards, once you have been refunded, your bank goes after the merchant's bank through the chargeback process of the Visa, Mastercard, or Cartes Bancaires (CB) networks, CB being France's domestic card scheme. The loss is passed down the chain, usually to the merchant that accepted the fraudulent payment. You don't have to wait for the outcome of this interbank battle to get your money back.

Subject: Dispute of unauthorized transaction(s) -
         refund request (Art. L. 133-18 CMF)

Dear Sir or Madam,

I have found the following transaction(s) on my account
No. [...], which I neither initiated nor authorized:

- [date] - [description] - [amount] EUR

Under Articles L. 133-18 and L. 133-24 of the French
Monetary and Financial Code, I request an immediate refund
of these amounts, no later than the end of the first
business day following this report, and that my account
be restored to its prior state (including resulting fees
and overdraft interest).

I blocked my card on [date] at [time]
(reference: [...]).

Sincerely,

[Last name, first name, address, date, signature]

Chapter 6. Protecting your family: parents, teens, and yourself.

Fraudsters target first the people who are less comfortable with digital tools or more deferential to authority: our parents and grandparents for the fake bank advisor scam, our teenagers for classified-ad and gaming scams. Protecting your family means combining tools (the right settings on the right products) with a family script rehearsed in advance. Under stress, people don't think; they recite.

• 33700: forward scam texts and report fraudulent calls (free).
• Info Escroqueries: 0 805 805 817 (the national police's toll-free fraud line, Monday to Friday).
• cybermalveillance.gouv.fr: diagnosis and help after a hack or phishing attack.
• Perceval (service-public.fr): report card fraud online when you still have your card.
• THESEE: file an online police report for internet scams (fake sellers, blackmail, fake tech support).

One last piece of advice: talk openly about fraud with the people around you. Shame is the scammers' best ally, because many victims say nothing and miss out on remedies that actually work. Telling your family about an attempted fraud inoculates everyone, and the next time the “advisor” calls, someone will recognize the script by the second sentence.