The trouble with a data breach does not always begin on the day of the attack.

Sometimes, it starts several weeks later.

A phone call.

A text message.

An email.

Someone who knows your name.

Your address.

Your tax identification number.

Your family situation.

Sometimes, even information about your income.

And naturally, you think:

"If they know all that, they must really be from the tax authorities."

That is exactly the trap.

Following the unauthorised access disclosed in August 2026, the French Directorate General of Public Finances (DGFiP) confirmed that certain personal and professional data had been accessed and extracted.

According to the administration, the affected information may include names, postal addresses, phone numbers, email addresses, tax identifiers, certain family and tax information, and details of exchanges with the DGFiP.

The DGFiP itself warns that this information can make fraud attempts far more convincing.

That is why it is important to recognise the most likely scenarios.

1. The Fake Tax Refund

This is probably the most obvious scenario.

You receive a text message or email:

"Following an adjustment to your tax file, a refund of €486.72 is available."

The amount is not necessarily huge.

And that is precisely what makes it believable.

The message invites you to click a link to "confirm your bank details".

The fake website then imitates impots.gouv.fr.

The logo.

Official colours.

Administrative language.

A convincing form.

The objective may be to steal:

• Your login credentials.
• Your bank card details.
• Your IBAN.
• A code received by SMS.

The rule is very simple:

The DGFiP never asks for confidential information by email, SMS or phone.

If you receive a message announcing a tax refund, do not click the link.

Type impots.gouv.fr into your browser yourself.

2. The Fake "Secure Your Account After the Cyberattack" Message

This one could be particularly effective.

The message says:

"Following the recent cyberattack targeting the DGFiP, a security verification of your account is mandatory."

Psychologically, everything fits.

You have heard about the attack.

Perhaps you even received a genuine letter from the DGFiP.

You know your data may have been affected.

So the fake message arrives in the perfect context.

It then suggests:

"Click here to secure your account."

That is exactly what you should not do.

The official FAQ explicitly advises users not to click any links in emails, text messages or online posts relating to this incident.

The right response is simple:

Close the message and open the official website yourself.

3. The Fake Bank Adviser Who Knows Your Real Information

This is probably one of the most dangerous scenarios.

Your phone rings.

Someone introduces themselves as your bank adviser.

They know your name.

They know your address.

They may also know enough personal information to make you feel reassured.

Then they announce:

"We have detected a suspicious transaction linked to the tax data breach."

Next, they ask you to:

• Confirm a code received by SMS.
• Move money to a "secure account".
• Add a new beneficiary.
• Install an application.
• Provide your login credentials.

At this point, hang up.

Do not engage in a discussion.

Then call your bank yourself using its usual number.

Cybermalveillance.gouv.fr reminds the public that a data breach can lead to fraudulent phone calls, scams and identity theft.

Knowing your personal information is no longer proof that the person speaking to you is legitimate.

4. The Fake Urgent Tax Audit

Another believable scenario:

"An inconsistency has been detected in your tax file. You must correct it within 48 hours to avoid a penalty."

The fraudster is playing on fear.

Nobody wants problems with the tax authorities.

The message may contain:

• Your real name.
• Your address.
• A tax reference.
• Family information.
• Very official-sounding administrative language.

Then comes the request:

"Please provide your supporting documents."

Or:

"Pay the following amount immediately."

Artificial urgency should always be treated as a warning sign.

Do not reply through the message you received.

Log into your tax account yourself or contact your local tax office directly.

5. The Fake Withholding Tax Update

Some compromised information may include a person's withholding tax rate.

This creates a particularly convincing scenario:

"Your withholding tax rate needs to be updated."

The fraudster then redirects you to a fake portal.

Or asks:

"To complete the change, please confirm your bank details."

The trap relies on genuine information.

You see your tax rate.

It looks correct.

So you trust the rest of the message.

But that is precisely why data breaches are dangerous: they allow fraudsters to combine real information with fraudulent instructions.

6. The Fake Request About a Property

Cadastral data was also accessed during the incidents involving the DGFiP.

This can be used to create messages concerning:

• Property tax.
• A property declaration.
• An inheritance.
• A cadastral adjustment.
• A change involving a home or property.

For example:

"An inconsistency has been detected in the declared floor area of your property. Please confirm the following information."

Once again, the accuracy of the message may make it appear official.

But knowing something accurate about your home does not prove the sender works for the DGFiP.

7. The Fake Anti-Fraud Support Service

This one is more subtle.

After a major data breach, some people will look for help.

Fraudsters know this.

So they may contact you while claiming to represent:

• A protection service.
• A company authorised by the tax administration.
• An identity recovery service.
• A supposed anti-fraud support team.

Their message is simple:

"Your identity appears in the DGFiP data breach. We can secure your information."

Then come the requests:

• Identity documents.
• Bank account details.
• Bank card information.
• Payment.
• Access to your computer.
• Installation of software.

The paradox is obvious.

You are trying to protect yourself after a data breach, yet you end up giving even more information to the fraudster.

The rule is straightforward:

Never hand over sensitive documents to someone who contacts you unexpectedly simply because they claim they want to protect you.

8. Attempted Identity Theft

In this scenario, the fraudster may not contact you at all.

Instead, they may use the information already available to impersonate you.

Cybermalveillance.gouv.fr defines identity theft as the fraudulent use of personal information that identifies someone.

The first warning signs may include:

• A letter concerning a contract you never signed.
• An unknown bank account.
• A loan you never applied for.
• Unusual login notifications.
• An organisation contacting you about a transaction you do not recognise.

Cybermalveillance.gouv.fr points out that it is often impossible to discover identity theft before a concrete warning sign appears.

If it happens, preserve the evidence, immediately contact the organisation concerned and follow the official identity theft procedures.

9. The Fake Employer or HR Department

Personal information from a data breach does not necessarily have to be used on its own.

It can be combined with information available elsewhere:

LinkedIn, social media, commercial databases, previous breaches and professional websites.

An attacker may therefore know:

Where you work.

What your position is.

Who manages your company.

They may then send you a message:

"Hello, we need to update your HR records concerning your withholding tax."

Or:

"Please send us your latest tax assessment notice."

For a business, this technique can be particularly dangerous when it targets human resources or accounting teams.

The internal rule should be clear:

Any unusual request for tax or banking documents must be verified through another communication channel.

10. The Scam That Arrives Six Months Later

This may be the most important one.

After a few weeks, the story disappears from the news.

People become less vigilant.

But the data does not disappear.

A stolen database can be:

Copied.

Resold.

Exchanged.

Combined with information from other breaches.

Reused months or even years later.

Cybermalveillance.gouv.fr explains that exposed data can be resold to other cybercriminals, who may then use it for scams or other malicious activities.

So do not think:

"It has been two months. I am no longer at risk."

The risk may simply take a different form.

The Most Important Change in How We Think

After a breach like the one affecting the DGFiP, we need to abandon an old habit.

That habit is thinking:

"They know my information, so they must be legitimate."

That assumption is no longer reliable.

A fraudster may know:

Your name.

Your address.

Your phone number.

Your email address.

Certain tax information.

Details about your family situation.

And still be a fraudster.

The new rule is:

Do not verify someone's identity based on what they know about you. Verify them through an independent communication channel.

Someone calls claiming to be from your bank?

Hang up and call the bank yourself.

Someone writes on behalf of the tax authorities?

Close the email and go directly to impots.gouv.fr.

Someone asks for an SMS verification code?

Do not share it.

Someone demands immediate action?

Stop for a few minutes.

This is what we call taking back control of the communication channel.

What Should You Do If You Receive One of These Messages?

Do not panic.

But do not continue the conversation either.

1. Stop Clicking

Do not click any links.

Do not download any attachments.

2. Keep the Evidence

Cybermalveillance.gouv.fr recommends keeping messages, URLs and screenshots when fraud is suspected.

3. Verify Independently

Contact the organisation using its official contact details.

Never use the contact details provided in the suspicious message.

4. If You Have Shared a Password

Change it immediately.

And change it on any other services where you reused the same password.

5. If You Have Shared Banking Information

Contact your bank immediately.

6. If Fraud Has Actually Occurred

The French Ministry of the Economy recommends preserving evidence, reporting the attempted fraud and filing a police complaint when fraud has occurred.

The THÉSÉE platform can be used in certain cases to report the incident online.

The 10-Second Test

Whenever you receive a sensitive phone call, text message or email, ask yourself three questions:

Did this person contact me unexpectedly?

Are they asking me to do something urgently?

Are they asking for a password, a code, money or an unusual action?

If the answer is yes:

Stop the conversation and contact the organisation yourself through its official channel.

This simple habit can prevent many of the scams described in this article.

Conclusion

The DGFiP data breach does not mean everyone affected will become a victim of fraud.

There is no reason to live in fear.

But we do need to change one habit.

Personal information that we once used to recognise someone can now end up in the hands of fraudsters.

A highly detailed message is not necessarily authentic.

A caller who knows your address is not necessarily from your bank.

An email containing accurate tax information is not necessarily from the DGFiP.

After major data breaches, trust must be established differently.

The rule becomes very simple:

Never trust someone just because they know accurate information about you.

Close the message.

Hang up.

Then take control by contacting the organisation through its official channel.

It is less spectacular than an antivirus.

But against modern fraud, it is one of the most effective habits you can develop.

Quick Checklist

• I do not click links relating to the DGFiP data breach.
• I type impots.gouv.fr into my browser myself.
• I never share a code received by SMS.
• I never move money at the request of someone who calls me.
• I hang up when a request is urgent or unusual.
• I call my bank or the tax authorities myself.
• I keep evidence of attempted fraud.
• I watch for signs of identity theft.
• I remain vigilant even several months after the breach.