The message knew my first name and family details.

These details are often public: social media, announcements, directories, or a relative's already-compromised messaging account. An accurate detail is not proof of identity — only a voice, on a number you already knew, is.

What should I do with the number the attacker used?

Block it and report the conversation in the app, which has a dedicated feature for this. Take a screenshot before blocking: it's useful for a police report.

Impersonating a relative by message

In plain terms

A message from an unknown number: "it's me, I got a new number." Followed by an urgent bill to pay on their behalf. The person always refuses to call — for good reason: it isn't your relative.

Definition

Impersonating a relative is a message received on a messaging app, presented as coming from a family member who supposedly changed their number, asking you to pay an amount on their behalf.

How it works

The message arrives from an unknown number and opens with an explanation that justifies both the unknown number and the urgency: "it's mom, I broke my phone, here's my new number." A concrete request follows — a bill to pay before tonight, a transfer to make because the new phone doesn't have banking-app access yet. The scenario is built so every question already has an answer ready, and to make a phone call impossible: the attacker explains the microphone is broken, or that they're in a meeting. That's exactly the element that identifies the attack, because calling is the only verification that works.

Warning signs

Message from an unknown number claiming to be a relative who changed numbers
Request for money within the first exchanges
Refusal or inability to take a voice call, under a technical pretext
Banking details shared in the conversation, in a third party's name
Insistence on urgency and discretion

How to verify

Call the person on their old number, the one already in your contacts. If they don't answer, call another family member. Never confirm a number change from the new number itself — that amounts to asking the stranger to confirm they really are your relative.

What to do

Don't make any payment before hearing the person's voice directly. A genuine request will survive ten minutes of verification.

If it already happened

Contact your bank immediately: a recent transfer can sometimes be recalled. Keep the conversation and the IBAN shared, then file a police report. Warn the impersonated relative, since the same messages are often sent to several people around them.

Test yourself

"It's me, I got a new number" — followed by an urgent bill to pay.

Start the simulation

Frequently asked questions

The message knew my first name and family details.: These details are often public: social media, announcements, directories, or a relative's already-compromised messaging account. An accurate detail is not proof of identity — only a voice, on a number you already knew, is.
What should I do with the number the attacker used?: Block it and report the conversation in the app, which has a dedicated feature for this. Take a screenshot before blocking: it's useful for a police report.

Official sources

Cybermalveillance.gouv.fr — Assistance and reporting (French government cybersecurity assistance service)

This article is part of the Social engineering family. Last updated: 2026-08-31.