Fake Tax Office Scams in France
Fraudsters impersonating the Direction Générale des Finances Publiques (DGFiP) steal payments and personal data from French taxpayers via phishing emails and fake tax portals.
Part of: Fake Tax Office Scams
Last reviewed: 1 June 2026
The Direction Générale des Finances Publiques (DGFiP) is one of the most impersonated institutions in French cybercrime. Phishing campaigns mimicking impots.gouv.fr surge around the French income-tax declaration period (April–June) and the September tax bill payment season, using fear of penalties to provoke hasty responses.
The national cybercrime platform Cybermalveillance.gouv.fr ranks tax-impersonation phishing among the top fraud categories reported by French citizens. Victims who enter their card details on spoofed tax-payment pages lose money directly, while those who submit identity documents face longer-term identity theft.
How this scam works on France
Phishing emails use the DGFiP logo, official fonts and mimicked addresses such as 'dgfip-finances.gouv.fr' (note the added hyphen). They inform the recipient of a small tax refund ('remboursement d'impôt') of €150–€400 and request card details to process the transfer.
SMS variants claim the recipient owes a modest sum and must pay via a link within 48 hours to avoid late-payment penalties. The landing page precisely replicates the impots.gouv.fr payment interface.
A newer variant targets micro-entrepreneurs and auto-entrepreneurs, impersonating the URSSAF social-contributions agency with demands for outstanding charges, exploiting the complexity of French self-employment tax administration.
Common red flags
- Email or SMS about a tax refund you were not expecting
- Sender domain is not impots.gouv.fr (or urssaf.fr for social charges)
- Request for card details to receive a refund — DGFiP credits bank accounts on file automatically
- Urgency: penalty for non-payment within 48 hours
- Link URL contains extra characters or hyphens not present in the official domain
- Request to confirm identity by providing numéro fiscal and carte d'identité
How to protect yourself
- Access your tax account only at impots.gouv.fr — type the address manually
- DGFiP processes refunds to your existing bank account and never requests card details
- Call DGFiP on 0809 401 401 to verify any unexpected communication
- Report phishing to signal.spam.fr and to cybermalveillance.gouv.fr
- Enable two-factor authentication on your impots.gouv.fr account
How to report it
- Cybermalveillance.gouv.fr — national cybercrime victim support and reporting
- Signal.spam.fr — dedicated French phishing SMS/email reporting
- Police Nationale: service-public.fr — 'dépôt de plainte en ligne'
Frequently asked questions
How does the real DGFiP contact French taxpayers?
DGFiP sends official notifications through your personal 'espace particulier' on impots.gouv.fr and by postal letter. It never requests card payments by email or SMS link.