news
French police issue warnings over fake tax letter and QR code
Letters direct recipients to fake tax website and ask for personal details, including vital cryptocurrency password
French police are issuing warnings over a new scam ‘tax’ letter containing a QR code that seeks to harvest personal data and potentially steal digital funds.
The letter purports to be from the Direction générale des Finances publiques (DGFiP, French tax authorities), using the official logo of the service and the typical layout of an official DGFiP letter.
It asks recipients to scan a QR code included on the letter, which sends them to an official-looking – but fake – website designed to steal the user’s personal information.
This can include their numéro fiscal (tax number) and password for the tax website.
This information can then be used by hackers to try and log into your personal space and take even more information (although two-factor authentication provides additional security against this) or be used to gain the victim’s trust in a follow-up scam, for example calling them and posing as a tax official or bank advisor.
Scammers are targeting holders of cryptocurrency with the letter, and the website also asks for the user’s ‘recovery phrase’ (phrase de récupération, sometimes called a seed phrase).
This is a sequence that allows cryptocurrency holders to regain access to their wallet, and can be used by scammers to transfer funds away.
The letter states this is required as the DGFiP is arranging a new list of all cryptocurrency wallets in France, with fines for not doing so. This is incorrect, and no such plans have been announced.
An example of the letter, shared by the Police Nationale, can be seen in the social media post below.
Despite looking official, there are some small typos that confirm the letter is fake.
How to avoid the scam
Official advice against such scams is to contact the tax authorities directly, to confirm if the information is genuine.
This includes heading directly to the tax website – not using the QR code – logging into your personal space, and using the secure messaging system (or checking for an online message in your personal space).
Even if websites look genuine, check their URL (website address) matches the official government website.
Government websites typically end in .gouv.fr – many scam websites use this as part of the URL, but do not end in this.
You can also call the authorities to confirm a letter is genuine. Again, use the official number and not any information from the letter.
Never share your personal information, including tax details and cryptocurrency wallet information, with anyone.
Tax authorities, banks, etc, will not ask you for your personal information over the phone or in an email/text.
If you have entered your cryptocurrency information on the website, official advice is to immediately open a new wallet and transfer all of your funds to it, change your tax website password, and file the issue with local police or gendarmes.
