French Smishing Campaign Uses Fake Social Security Portal

Figure 1: An example of an inbound smishing message, received on 14 October.

Figure 2: An example of a phishing page masquerading as the portal for the website for Sécurité Sociale

Figure 3: Example of a phishing page targeting customers of the Caisse d’Epargne bank

Once the landing page is accessed, the victim is served with a form asking for personal information, such as email addresses and passwords. The fraudulent websites also ask for financial information, purportedly to allow for the payment of taxes or late fees. If the victim fills out those forms, their bank accounts will be immediately charged. Some time later, when tax season comes, the victims’s Ameli login will be used to make fraudulent tax claims and receive tax rebates on an attacker-controlled bank account.

Figure 4: Most commonly used words in the domain names

Figure 5: The number of dedicated hosting IPs used by the actors, per country

The landing pages are of good quality and, to the unsuspecting eye, visually indistinguishable from the legitimate login pages. Some phishing pages ask for credit card information, purportedly to pay taxes or resolve an unsuccessful payment to a legitimate service. Using Ameli, one can log in to a variety of government portals, including the tax office and the portal for government subsidies. This has led the government of France to temporarily cut off access from it.² Nevertheless, we consider this attack as more likely to be financially motivated rather than political, because it has targeted multiple sectors – government, financial, energy and communication – in several countries.