Fake tax website: spot phishing before you type
Last updated:
Phishing campaigns targeting tax administration promise refunds, fines due in 24 hours, or “regularization” via a link in email or SMS. The goal: steal credentials, bank details, or card numbers.
The only official domain (France)
For French taxpayers, the official site is impots.gouv.fr (.gouv.fr subdomains). Any .com, .info, extra hyphens, or homoglyphs are suspicious : even with HTTPS.
Common signals on clones
- Recently registered domain or foreign hosting while claiming to be “French administration”.
- Card payment for a “refund” (tax authorities do not work that way).
- Artificial urgency, penalty threats, attachments, or shortened links.
- Form asking for more data than the usual impots.gouv.fr login.
How to verify without clicking the link
- Type impots.gouv.fr yourself or use a saved bookmark.
- Compare the URL character by character (homoglyphs matter).
- When in doubt: do not log in; call your tax office using a number from impots.gouv.fr, not the message.
If you already entered information
- Change your impots.gouv.fr password from the real site.
- Alert your bank if IBAN or card data was submitted.
- Report via Pharos (internet-signalement.gouv.fr) and keep evidence.
What Resku does (honest scope)
The extension flags typosquatted domains, recent certificates, and pages mimicking public brands. It shows an explained score before typing. It does not replace impots.gouv.fr or tax advice : it reduces the risk of landing on the wrong page when you click.
Sources
- impots.gouv.fr : security and scam notices.
- Cybermalveillance.gouv.fr : tax phishing.
- Pharos : online reporting.
Frequently asked questions
What is the only official French tax website?
impots.gouv.fr, along with its .gouv.fr subdomains. Any other extension (.com, .info, .net), any extra hyphen and any spelling variation is fake, even when the page looks pixel-identical to the original and shows a valid security padlock in the address bar.
Does the tax office ever ask for card details to issue a refund?
Never. A tax refund is paid by bank transfer to the account already registered in your personal space. Any page asking for a card number, security code, or an SMS code to “release a refund” is fraudulent, without exception.
How can I verify a tax message without clicking the link?
Type impots.gouv.fr yourself in the address bar, or open your own bookmark. Log in to your personal space: any genuine request appears there. If in doubt, call your local tax office using a number found on the official site, never the one given in the message.
I entered my credentials on a fake site : what now?
Change your password immediately on the real impots.gouv.fr, and anywhere else you reused it. Alert your bank if bank details or a card were submitted. Report the page on Pharos and keep the evidence: screenshots, email headers, and the full URL.
A fake tax portal can look visually identical to the real site. Resku checks domain, certificate, and page signals before you enter anything.
Add to Chrome