Antiphishing.biz

This screenshot shows a phishing page impersonating Crédit Mutuel de Bretagne, a French bank. The page threatens a “temporary ban on all debit operations” to pressure victims into providing sensitive personal and banking information.

Threat Analysis: Crédit Mutuel de Bretagne Phishing – Full Identity & Banking Credential Harvesting

How it works:
The victim receives a phishing email, SMS, or other message claiming a security alert or account restriction. The link leads to this page, which mimics the bank’s client space. The victim is asked to provide:

• First and last name
• Email address
• Identifiant CMB (online banking username)
• Mot de passe CMB (password)
• Phone number
• Date of birth
• Department of birth

A threat is displayed: ignoring the notice will result in a temporary ban on all debit operations – a classic fear tactic.

The goal:
The attacker collects:

• Online banking credentials (identifier and password)
• Full personal identity information (name, DOB, birth department, phone, email)
• Enough data to potentially answer security questions or commit identity theft

With this information, the attacker can:

• Log into the victim’s Crédit Mutuel online banking account
• Authorize fraudulent transfers or payments
• Use personal details for identity fraud or to impersonate the victim

Red flags to watch for:

• Suspicious URL: The page is hosted on a subdomain of dynadot.com (a domain registrar), not on creditmutuel.fr or an official Crédit Mutuel domain.
• Threat of immediate consequences: The warning of a “temporary ban on all debit operations” is a fear tactic to pressure victims into acting without thinking.
• Excessive data requests: A legitimate bank login does not ask for full name, email, phone, date of birth, and department of birth all on the same page. This is a clear sign of a phishing kit designed to harvest as much personal data as possible.
• Unsolicited login request: Crédit Mutuel does not send links requiring customers to log in to avoid account restrictions.
• Poor design / generic layout: The page lacks the full branding, security notices, and two‑factor authentication features of the real Crédit Mutuel portal.

What to do if you encounter this:

• Do not enter any personal or banking information.
• If you are a Crédit Mutuel customer, always access your account by typing the official website URL directly (e.g., creditmutuel.fr or your regional branch’s domain).
• If you have already entered your credentials, contact Crédit Mutuel immediately to change your password and secure your account.
• Report the phishing page to Crédit Mutuel’s fraud team.

Protective measures:

• Bookmark the official Crédit Mutuel login page and use that bookmark.
• Use a password manager – it will autofill only on legitimate domains.
• Enable two‑factor authentication on your bank account if available.
• Never provide your date of birth, phone number, and banking credentials in response to a threat‑based message.
• Be suspicious of any unsolicited message that threatens account restrictions and asks you to log in via a link.

This screenshot shows a phishing page impersonating the official French tax website (impots.gouv.fr) . The page claims the victim needs to “confirm their bank card details” to receive a tax refund – a classic pretext to steal full credit card information.

Threat Analysis: French Tax Refund Phishing – Card Data Harvesting

How it works:
The victim receives a phishing email, SMS, or other message claiming they are eligible for a tax refund. The link leads to this page, which mimics the official French tax portal (impots.gouv.fr). The page asks the victim to provide:

• Cardholder name (as printed on the card)
• Expiration date (MM/AAAA)
• Full card number
• Visual cryptogram (CVV)

A button labelled “Valider mon remboursement” (Confirm my refund) submits the data to the attacker.

The goal:
The attacker collects full credit/debit card details to make fraudulent purchases, clone the card, or sell the information. No tax refund exists – the entire offer is fabricated.

Red flags to watch for:

• Suspicious URL: The page is hosted on a domain that is not impots.gouv.fr. The official French tax website uses only government domains.
• Request for full card details for a refund: Legitimate tax refunds are deposited directly to the bank account the tax authorities already have on file – they never ask for your card number, expiration date, or CVV.
• “Cryptogramme visuel” (CVV) request: No legitimate tax authority asks for your card security code.
• Poor design / missing official elements: While the page copies the official logo and footer, the layout and the specific request for card details are not part of the real tax refund process.
• Unsolicited refund notification: The French tax authorities (DGFiP) do not send unsolicited emails with links to claim refunds. Any such message is a scam.

What to do if you encounter this:

• Do not enter any card or personal information.
• If you are a French taxpayer, always access your tax account by typing impots.gouv.fr directly into your browser.
• If you have already entered card details, contact your bank immediately to block the card and dispute any unauthorized charges.
• Report the phishing page to the French tax authorities via their official reporting form.

Protective measures:

• Never click links in unsolicited messages claiming a tax refund.
• Always type the official government URL directly into your browser.
• Never provide your card CVV or expiration date to “receive” a refund – refunds do not require this information.
• Enable two‑factor authentication on your bank account and email.
• Be suspicious of any message that creates urgency and asks for sensitive financial information.