Phishing, texts and calls: the requests to refuse

Any message or call asking you for a password, a code received by text message, to install software or to make an urgent payment must be refused, even if it seems to come from Microsoft, the tax office, your management or your IT provider. These four requests are enough to spot most attempts.

Three common scenarios

The email. “Your Microsoft 365 mailbox is full”, “your password expires today”, “a tax refund is waiting for you”: the link leads to a fake login page that captures your username and password. Microsoft and the tax authorities never ask for your password by message.

The text message. A parcel held up, a fine, a business account “suspended”: the shortened link opens a fake website asking you to log in or pay. On a phone, the real address of the website is hard to read, which is what makes text messages so effective.

The call. Someone introduces themselves as IT support, the bank or management. They want you to install a remote-control tool, to give them the validation code you have just received, or to push a payment through. Urgency and secrecy are their two levers.

What has changed since 2025

In its overview of 11 March 2026, ANSSI notes that manipulation techniques now go beyond fake IT support. On the email side, Google, Yahoo and Microsoft now require domains that send large volumes of email to be authenticated (SPF, DKIM, DMARC): a properly configured domain is harder to spoof.

To check this week

Questions about your situation? Describe my needs

Sources consulted on 19 October 2026: Cybermalveillance.gouv.fr – Que faire en cas de phishing ou hameçonnage ? (updated on 7 May 2026); ANSSI – Panorama de la cybermenace 2025, published on 11 March 2026.
Article written by IT CyberWall.