“TAX NOTIFICATION – REFUND” email promising €195: scam or real?

Have you received an email titled “NOTIFICATION D’IMPOTS – REMBOURSEMENT” (“tax notification – refund”) telling you that you are eligible for a €195 tax refund, with the French Republic logo and a link to “the steps to follow”? It is a scam. Neither the French tax administration nor the fines service works this way. Here is how to recognise it and what to do.

Is this tax refund email a scam?

Yes. This email comes neither from the French tax authority (DGFiP) nor from the fines service. The sender is noreply@servroutierre.site, a domain with no connection to any French administration. The “Steps to follow” button leads to a page hosted on Google Sites, then to a fake refund site designed to steal your personal and banking data.

The basic rule: the French tax administration only communicates through your personal space on impots.gouv.fr, and its emails come from @dgfip.finances.gouv.fr domains. The fines service uses amendes.gouv.fr. No official email comes from a domain like servroutierre.site.

The inconsistency that immediately gives the scam away

The most telling sign of this campaign is a blatant administrative inconsistency: the email mixes up taxes and fines, which are handled by two completely separate administrations.

Taxes are handled by the Directorate General of Public Finances (DGFiP), via impots.gouv.fr. Fines are handled by ANTAI (the national agency for automated processing of offences), via amendes.gouv.fr, which is a service for paying fines, not for refunds.

Yet this email combines both worlds with no consistency: the sender is called “Amendes.Gouv”, the subject mentions a “tax notification – refund”, the body is signed “Direction générale des Finances Publiques”, but the final page shows the “online fine payment service” and ends with “you have paid your parking fine”. A tax refund that goes through the fine payment service does not exist.

The scammers have clearly recycled a phishing kit designed for fines and grafted a tax refund pretext onto it, which is more attractive since it promises to give you money. When the sender, subject, content and landing page all refer to different things, it is a scam.

How does this scam work, step by step?

This campaign deploys a particularly elaborate attack chain, using several legitimate services as relays to get around protections.

Step 1: the email. The message uses the official amendes.gouv.fr logo (loaded directly from the real site) and the “République française” block. It promises a €195 refund within 10 working days, with a deadline to create a sense of positive urgency.

Step 2: Google Sites. The link first leads to a sites.google.com page, Google’s free website builder. Google links easily get past spam filters. The page displays a fake “Amendes.gouv” logo generated by artificial intelligence.

Step 3: the URL shortener. One more click goes through a hijacked legitimate French link shortener, which hides the real destination.

Step 4: the collection page. The victim lands on a fake site styled like amendes.gouv.fr, hosted in an Amazon S3 storage bucket. The site collects information in stages: first surname, first name, date of birth and phone number, then the IBAN (with validation requiring a French format starting with FR), then credit card details.

Step 5: exfiltration via Telegram. As in other recent campaigns, the data entered is sent in real time to a Telegram bot controlled by the scammers. Every piece of information is instantly forwarded to their messaging account.

Step 6: the fake SMS code and success page. A fake SMS code validation screen imitates a 3D Secure check, then a confirmation page says “Your refund will be made within 72 hours” to lull the victim, who does not immediately realise they have just handed over all their data.

A telling detail: the fake site is even monetised with ads, meaning the scammers earn advertising revenue from victims’ traffic on top of stealing their data.

What other signs confirm the fraud?

Beyond the taxes/fines inconsistency, several clues are visible to any recipient.

The email opens with “Bonjour ,” with no name, a sign of an untargeted mass mailing. The French text contains spelling mistakes. The sender’s address does not match any government domain. Above all, no administration asks for your IBAN or credit card by email to refund you: the tax office refunds automatically to the account it already has on file, with no action needed on your part.

How to check whether you really have a refund

Never click the link in a refund email. Log in directly to impots.gouv.fr by typing the address into your browser yourself, then check your personal space. Any real refund appears there, and it is paid automatically into the bank account the administration already knows, without you having to enter any IBAN.

If in doubt, contact your public finance centre using the official contact details available on impots.gouv.fr, never through a link or number in the email.

What to do if you entered your information

If you shared your bank or card details, act immediately: call your bank to block your card and report a risk of fraud. In France, any fraudulent debit or payment can be disputed, provided you report it quickly.

If you shared personal data (name, date of birth, phone number), stay alert to possible identity theft attempts or calls from fake bank advisers in the following weeks. Scammers often use this data for a second scam by phone. See our guide on what to do after a compromise and our tips to protect your personal data.

Report the email on Signal Spam and the scam on Cybermalveillance.gouv.fr. You can also report fraudulent emails impersonating the tax administration directly to the DGFiP.

Why are refund scams so effective?

Unlike scams that threaten you (blocked account, unpaid fine), the refund scam plays on a positive emotion: the prospect of receiving money. This approach disarms suspicion, because the victim feels like a beneficiary rather than a target.

It follows the same logic of impersonating a trusted brand as the other campaigns documented on safecode.fr, whether the fake Prime Video renewal, the fake bank alerts in the name of Société Générale or CIC. The rule never changes: an administration or a bank never asks for your bank details by email, whether to charge you or to refund you. To sharpen your vigilance, see our digital hygiene rules.

---

Tax refund email scam FAQ