Phone scams: how they happen, and how to get out of them
A fraudulent call almost always follows the same path: a number or a voice that reassures, an emergency, a ban on hanging up, then a “verification” the scammer controls. The answer takes two gestures: ask for the two words of the moment, and call back yourself on the saved number.
Updated on
One page per scam: Hi Mum scam · AI voice cloning · fake bank adviser · nineteen real cases (in French)
A real threat, growing every year
more scams in France in 2025, and 7% a year on average for ten years. The most effective pretext is still a loved one in trouble.
French Ministry of the Interior, SSMSI, first picture of 2025, 29 January 2026spoofed phone numbers reported to the French telecoms regulator in 2025, against 531 in 2023. The name on the screen can be your loved one's without it being them.
Arcep, January 2026in AI-related losses reported to the FBI in 2025. Cloned voices are already used for “distress calls” from a fake child or grandchild.
FBI, Internet Crime Report 2025lost by people over 60 in the United States in 2025, against 4.9 billion in 2024. They are the ones fake calls from loved ones target.
FBI, Internet Crime Report 2025Sources: French Ministry of the Interior, SSMSI, “Insecurity and crime in 2025: a first picture”; Arcep, statement of 29 January 2026; FBI, Internet Crime Report 2025; Banque de France, Observatory for the Security of Payment Means, statement of 27 January 2026 (on authenticated numbers). Figures as of 4 September 2026.
How does a fraudulent call unfold?
Fake bank adviser, fake grandchild, fake police officer: the pretext changes, the mechanics don't. Five phases, drawn from victims' testimonies and official alerts, each with the sentences you hear.
The opening: the number on the screen proves nothing
A number can be spoofed, including a loved one's: your phone then shows their name. Often the victim gives the first name herself (“Mary, is that you?”), and the scammer takes the identity just offered. And they already know things about you: name, address, bank, last card digits. All of it can be bought.
The staging: the voice, the accident, the supervisor
Three seconds of recording are enough to clone a voice (McAfee study “The Artificial Imposter”, 2023). A physical excuse covers the flaws: “I had an accident, my nose is broken”. Then you are passed to someone else, a “lawyer”, a “police officer”, a “fraud department manager”, who no longer has to imitate anyone.
The lock: don't hang up, don't tell anyone
As long as you stay on the line, you cannot check anything. Secrecy is demanded at the exact moment a third party would say no. The time spent becomes an argument (“we didn't spend thirty minutes not to finish”), and your caution is turned around: “it's precisely to protect you”, “don't you trust me?”.
The verification trap
The most devious: the scammer is the one who invites you to hang up and call your bank back. On a landline, they can hold the line and play a fake dial tone. The confirmation code arrives from the bank's real number, in the right message thread: they only have to make you read it out.
Afterwards: the second wave
Lists of victims are resold. About four in ten people who were scammed are scammed a second time while trying to get their money back (“our firm can recover your funds”), according to the AARP. Shame silences, and the family is not warned.
| What you are shown | What it proves | Why |
|---|---|---|
| The number on the screen, and the name that goes with it | Nothing | Number spoofing can display any number; Arcep, the French telecoms regulator, received 19,000 reports in 2025. |
| The voice | Nothing | Three seconds of recording are enough to clone it; “I had an accident” covers the flaws. |
| The first name, family details | Nothing | You often give them yourself; the rest can be read on social media. |
| Your file: name, address, bank, social security number | Nothing | All of it has leaked from public services and is resold. |
| The two modAmi words of the moment | Identity | Computed on both phones, never transmitted, renewed every ten minutes. |
What modAmi drew from it
- The name on the screen proves nothing: only the two words count, and the caller says them first.
- No proof by voice, photo or memory.
- “Don't hang up” is a reason to hang up; every call screen ends with that gesture.
- The callback is made from your phone, on the number in your address book, never on the one from the incoming call.
- After an attempt, the app warns you: they will call again, and the log keeps the trace.
What victims say, and what the app made of it
Before writing a single screen, we went through hundreds of sources: victims' forum threads, official alerts and campaigns from France, the United Kingdom and the United States, press testimonies. The tactics kept are those that appear in several independent sources. To each one, the path opposes the conduct these bodies recommend.
“Don't hang up. Stay on the line.”
As long as the line holds, no verification is possible. Every call screen ends with the same gesture: hang up yourself.
“Don't tell anyone.”
Secrecy is demanded at the exact moment a third party would say no. The app has you write it down, hang up, then check by another route: their saved number, someone who can see them.
“I had an accident, my voice sounds strange.”
The excuse covers the flaws of a cloned voice. The app accepts no proof by voice, photo or memory: the two words, or nothing.
“Hang up and call your bank back, right now.”
On a landline, the scammer can hold the line and play a fake dial tone. The callback is made from your phone, on the number from your address book.
“Let me put you through to my supervisor.”
The second speaker no longer has to imitate anyone. Someone calling “for” your loved one: write it down, hang up, check with the organisation through its official contact details.
“You are Mr X, at 12 Y Street, aren't you?”
Name, address, bank: all of that can be bought. Knowing your details proves nothing, and neither does the name showing on the screen. Only the two words count.
Sources consulted: Que Choisir forum (fake bank adviser, fake bailiff, landline scams), Cybermalveillance.gouv.fr, economie.gouv.fr, ARCEP, Banque de France, Action Fraud, Metropolitan Police and Take Five (United Kingdom), FBI, FCC, FTC and AARP (United States), Consumer Protection BC (Canada).
Your data is already out there
Since 2024, the big public-service databases have been leaking one after another. What got out cannot be taken back: you have to live with it, and draw the consequence.
What leaked
- France Travail (the French employment agency), March 2024. 43 million people registered over the last twenty years: name, first name, date of birth, social security number, France Travail identifier, postal and e-mail addresses, phone number. No passwords, no bank details.
- Health-insurance payment operators (Viamedis, Almerys), February 2024. More than 33 million insured people: name, first name, date of birth, social security number, name of the insurer and contract coverage.
- Pass'Sport (Ministry of Sports), December 2025. 3.5 million households according to the ministry, 6.4 million e-mail addresses listed by Have I Been Pwned: name, gender, postal address, phone, e-mail. Data that came from the family-benefits fund (CAF), the MSA and the Crous; no bank details, no passwords.
- Tax administration, 2026. From late January to mid-February, the national bank-account register (FICOBA), read with an agent's stolen credentials: 1.2 million accounts, bank details, identity and address of the holder. From June to August, the tax data of 678,000 individuals and businesses: reference income, family quotient, withholding rate, cadastral addresses and surface areas.
- Identity documents agency (ANTS), April 2026. 11.7 million accounts of the service that issues ID cards, passports and driving licences: login, title, surname, first names, e-mail, date of birth; sometimes postal address, place of birth, phone. No attachments, no biometric data.
The CNIL, the French data-protection authority, counted 6,167 data breaches in 2025, a record, including some forty that each affected more than a million people; one incident in two is a hack, and public administration, health and finance are the most targeted. The same year, the ANSSI, the national cybersecurity agency, handled 460 events of possible data leaks; ministries and local authorities account for one report in four.
What the hackers do with it
- They cross-reference. One line from the employment agency, one from family benefits, one from the tax office: put end to end, they give your name, your age, your address, your social security number, your bank and your situation.
- They resell. These files circulate in batches on specialised forums and are reused for years. A 2024 leak still feeds the calls of 2026.
- They call. The fake bank adviser, the fake tax or benefits agent starts by reciting your file: “You are Mr X, born on…, at 12 Y Street?” Each accurate detail buys the next one, which is false.
- They target. Texts and e-mails in your name, with your agency and your beneficiary number; a request to “update” your bank details; loans or subscriptions opened in your name.
To find out whether your e-mail address appears in a leak that has already been published: Have I Been Pwned, the reference register, free of charge. Not every leak is there: those of France Travail, the tax administration and the ANTS were not made public.
What that changes
Nothing that is known about you proves who is talking to you. Your name, your address, your social security number, your children's first names: all of it sits in a file, somewhere. Neither does the name showing on the screen: a number can be spoofed.
The two words, on the other hand, are in no file. They are born on your two phones, change every ten minutes and pass through no server. It is the one thing a stolen file does not contain.
Official sources: CNIL (France Travail and Viamedis/Almerys investigations, France Travail sanction of January 2026, 2025 annual report, statement on the tax-system hack), Ministry of the Interior (ANTS update of 21 April 2026), impots.gouv.fr and economie.gouv.fr (FICOBA, illegitimate accesses of August 2026), Ministry of Sports and Cnaf (Pass'Sport), ANSSI (2025 cyber-threat overview), Have I Been Pwned. Figures as of 4 September 2026.
Read also, on the publisher's site (in French): the tax office leak, what the attackers read in your file (August 2026) · your data is already out there (March 2026).
What to do, concretely?
During the call
Give nothing, write down what would need sorting out, hang up yourself, call back the saved number. The guide has you do it in order, and the app does it with you, screen by screen.
Before the call
Set up modAmi with your loved one, side by side, once. Then two shared words, renewed every ten minutes, that only the real caller can announce. Free for two loved ones.
After the call
Report it, even without a loss: in France, Info Escroqueries on 0 805 805 817 (free), Cybermalveillance.gouv.fr for guidance, and the online complaint. Warn your loved ones: scammers call again.