FRANCE CRYPTO SCAM ALERT

Banque de France crypto deepfake scam 2026: fake agents and AI videos of the Governor

A phone call from a "Banque de France agent" telling you to move your crypto somewhere safe. A video of Governor Villeroy de Galhau recommending a high-yield investment. Both are fake, and France's own central bank has now said so publicly.

SB

SafeBrowz Threat Research Security ResearchJune 28, 202611 min read

Why this scam is so effective in France

The Banque de France is the national central bank. The ACPR (Autorité de Contrôle Prudentiel et de Résolution) is the body that supervises French banks and insurers. For an ordinary saver, these are the most authoritative financial names in the country. So when a caller introduces themselves as a Banque de France agent, the instinct is to trust and comply, not to push back. That authority is exactly what the fraud weaponizes.

The crypto angle adds a second lever. Many French holders genuinely worry their wallets or exchange accounts could be frozen, hacked, or caught up in a regulatory issue. A scammer who "calls from the central bank" to help you "secure your crypto-assets before it is too late" is speaking directly to that anxiety. The story feels protective, not predatory, which is why people follow the instructions.

The third lever is the deepfake. In April 2026 the operation escalated from voices on the phone to faces on a screen. A video showing the Governor's own face, voice, and intonation recommending a "highly profitable" investment is far harder to dismiss than a cold call, because it appears to carry the personal endorsement of the most senior official at the central bank. It does not. Officials of the Banque de France never recommend any investment.

How the Banque de France impersonation scam works

The fraud runs along three connected tracks, and a single victim can be hit by all three in sequence.

The fake-agent call or email. The Banque de France said it was alerted by people who received emails, letters, or phone calls from individuals claiming to work for the bank and requesting financial information about their crypto-asset investments. The pretext varies: your funds are "at risk", there is a "compliance check" on your wallet, or you need to transfer assets to a "secure account" while an issue is resolved. The goal is to harvest your personal and financial data, or to get you to move crypto to an address the criminals control.

The deepfake video on social media. Fabricated videos circulate on social platforms showing Governor François Villeroy de Galhau, and in the same operation ACPR Secretary General Emmanuelle Assouan, promoting financial placements they would never endorse. The clips look like a news segment or an official statement. They funnel viewers toward a fraudulent investment site or a messaging contact.

The fraudulent platform and the follow-up. Once you land on the fake platform or reply, "advisors" contact you by phone or email. They promise large returns or large transfers, on the condition that you first pay fees, deposit funds, or carry out banking operations directly over the phone. The deposit grows on a fake dashboard. The moment you try to withdraw, the "tax" and "fee" demands begin, and the money is already gone.

The exact tells in the message

Once you have seen these moves, they are obvious. A real central bank does not behave like this.

• "Je vous appelle de la Banque de France pour sécuriser vos crypto-actifs" as the opening of a call. The bank does not phone individuals to manage their crypto.
• A named official "recommending" an investment in a video. No executive of the Banque de France or the ACPR ever recommends a specific site or product.
• A request for your bank details, card, or wallet seed phrase by phone or email. The Banque de France states it will never ask for your bank coordinates or sensitive personal information this way.
• Pressure to act before a deadline to "protect" your funds or before they are "blocked".
• A specific website pushed at you as the place to invest or to "verify" your account.

The wording sounds official because the scammers studied real institutional language. But the rhythm gives it away. A genuine Banque de France or ACPR communication is dry, never urgent, never personal about your portfolio, and never points you to a place to invest. The whole purpose of a regulator is supervision, not stock tips. The moment "the central bank" turns into a financial adviser, you are talking to a criminal.

What the Banque de France and ACPR actually said

This is the single most useful section to remember, because it comes straight from the source. On April 27, 2026 the Banque de France and the ACPR published a joint mise en garde covering two threats at once: the impersonation of their agents targeting crypto-asset holders, and the AI deepfake videos of their executives.

Rule 1: no executive recommends a product or a site. The official principle, in their words, is that "jamais un dirigeant de la Banque de France ou de l'ACPR ne recommandera un site ou un produit financier particulier" (no executive of the Banque de France or the ACPR will ever recommend a particular site or financial product). Any video, email, or call where a named official endorses an investment is fake by definition. This one rule defeats the deepfake.

Rule 2: the bank does not ask for your details by phone. The Banque de France stated it will never request your bank coordinates or sensitive personal information by telephone. So a "Banque de France agent" asking for your card, your access codes, or your wallet seed phrase is an impersonator, full stop.

Rule 3: a deepfake of the Governor is still a deepfake. The fabricated videos used the face, voice, and intonation of Governor François Villeroy de Galhau, and of ACPR Secretary General Emmanuelle Assouan, to promote "miraculous" or "highly profitable" placements. A realistic video is not proof. Photorealistic AI video of a public figure is now cheap to produce, and a known face saying the right thing is precisely the trick.

The real domains, styled so you can trust them

Memorize the genuine addresses and you can ignore every lookalike. The real, official domains in this space are:

• banque-france.fr - the Banque de France itself.
• acpr.banque-france.fr - the ACPR, which sits under the Banque de France.
• amf-france.org - the Autorité des Marchés Financiers (AMF), the markets regulator that publishes the investment blacklists.
• abe-infoservice.fr - Assurance Banque Épargne Info Service (ABE-IS), the public information service that hosts the ACPR and AMF blacklists in one place.

Type these yourself into a new browser tab. Do not click a link from a message or a video description to reach them. If a "central bank" site has a different TLD, a hyphen where a dot should be, or extra words bolted on, it is hostile. Note that abe-infoservice.fr is the same Assurance Banque Épargne service that powers ABE Info Service, the place to verify any platform a caller names.

Check any platform against the AMF and ACPR blacklists

France gives you a free, authoritative way to verify any investment site before you send a single euro, and it takes under two minutes. The AMF and ACPR maintain public blacklists of unauthorized actors and known scam sites in crypto-assets, Forex, atypical placements, and identity usurpation.

Where to check. The blacklists are published on the AMF website at amf-france.org (Espace épargnants, then Protéger son épargne, then Listes noires et mises en garde) and consolidated on Assurance Banque Épargne Info Service at abe-infoservice.fr (Prévention arnaques, then Listes noires des autorités). If the platform a "Banque de France agent" or a deepfake video pointed you to appears on a blacklist, the answer is settled.

The limit to understand. These lists are updated frequently but are explicitly not exhaustive. New fraudulent sites appear constantly, so a site being absent from the blacklist does NOT mean it is safe. Treat "not yet listed" as "not yet caught", not as "approved". A platform you have never heard of, pushed by an unsolicited call or video, deserves suspicion no matter what the list says.

How this differs from the faux conseiller bancaire scam

France has a closely related fraud worth distinguishing. In the faux conseiller bancaire scam, the criminal pretends to be an advisor from your own retail bank (your branch, your account) and walks you through "securing" your money in real time, often spoofing the bank's real phone number. That is a vishing attack built on the bank you already use.

The Banque de France and ACPR fraud is different in two ways. First, it impersonates the central bank and the regulator, not a high-street bank, which lends it even more authority. Second, it leans on AI deepfakes of named, recognizable officials to sell the lie on social media before any call is even made. Both end the same way, with your money or your crypto in the attacker's hands, and both are defeated by the same reflex: hang up and verify through the official channel yourself.

Red flags: how to spot it in 30 seconds

• A "regulator" or "central bank" recommends where to invest. They never do. This alone settles it.
• You are asked for bank details, card, codes, or a wallet seed phrase by phone or email. The Banque de France will not ask for these.
• A video of a famous official endorses a placement. Realistic video is not proof; AI deepfakes of public figures are common.
• The contact is unsolicited. You did not initiate it; they came to you.
• There is urgency or a deadline to "secure", "unblock", or "protect" your funds.
• You are told to move crypto to a "secure account" you do not control.
• The platform promises returns that sound too good and pressure builds when you try to withdraw.

Any one of these is enough to end the conversation. Two or more and you are looking at a confirmed fraud attempt.

What to do (the safe routine)

If you receive a call, email, or video claiming to come from the Banque de France or the ACPR, do not act on it and do not click anything in it. Hang up or close it. Open a new browser tab and type banque-france.fr or acpr.banque-france.fr yourself to confirm what the institution does and does not do. Then verify any platform a caller named against the blacklists on amf-france.org and abe-infoservice.fr.

If you are unsure whether an investment offer is legitimate, contact AMF Épargne Info Service, the AMF's free public helpline reachable through amf-france.org, or use the same Assurance Banque Épargne service at abe-infoservice.fr. Never share your wallet seed phrase, card numbers, or bank access codes with anyone who contacts you, regardless of how official they sound or look.

If a relative forwards you one of these deepfake videos asking "is this real?", the answer is no. A regulator endorsing an investment is fake by the institution's own published rule. Showing them this single principle protects them better than any block list.

What to do if you already sent money or crypto

Speed matters. The attacker may already be moving your funds.

1. Call your bank immediately to block the card or stop the transfer. Use the opposition hotline on the back of your physical card or inside your banking app.
2. Dispute unauthorized card transactions under PSD2. Article L133-18 of the Code Monétaire et Financier gives you up to 13 months to dispute, and banks must refund unauthorized card charges unless they prove gross negligence on your part.
3. Report to Cybermalveillance.gouv.fr. The official French cybercrime platform at cybermalveillance.gouv.fr gives you a written reference and next steps.
4. File a formal complaint (plainte) at your local commissariat or gendarmerie, or call 17 for the police. Bring screenshots of the message, the video, the platform URL, and any transfer receipts.
5. If you sent crypto, act fast and document everything. Note the wallet addresses and transaction hashes. Recovery is hard once crypto leaves your wallet, but the record matters for the report and for any exchange freeze.
6. Watch your accounts daily for 30 days. Some attackers wait before running larger fraud, hoping you have stopped monitoring.

If your bank refuses a card refund, you can escalate a complaint to the ACPR through acpr.banque-france.fr, which supervises French banks. For crypto-loss next steps, see our guide on what to do when your crypto seed phrase is stolen and the broader I got scammed, what to do now recovery checklist.

How to report the scam

Reporting protects the next victim. Each of these takes under two minutes.

• Fraudulent investment site or impersonation: report it and check the blacklist via AMF Épargne Info Service at amf-france.org, and via abe-infoservice.fr.
• Phishing emails and malicious links: report at cybermalveillance.gouv.fr under "Signaler une cybermalveillance".
• A crime in progress or money already sent: call 17 (police) and file a plainte at your local commissariat or gendarmerie.
• A deepfake video of an official: report it to the social platform hosting it, and flag the linked platform to the AMF via amf-france.org.

Updated June 28, 2026.

How SafeBrowz blocks this threat

The weakest point in this fraud is the link. A deepfake video, a fake-agent email, or an "advisor" message almost always ends with a URL to a fraudulent crypto or investment platform. That is where SafeBrowz steps in, on both the browser and the phone where these messages land.

SafeBrowz runs a 3-layer detection architecture: Local + APIs + AI.

• Layer 1 - Local detection: 60+ URL patterns plus 550+ brand-specific signatures (including impersonation patterns for financial-authority and crypto-platform lookalikes) and community whitelist/blacklist, all running directly in the extension and the Android app before the page renders. A lookalike domain dressed up as a regulator or a "secure" crypto portal triggers a block before the page can finish loading.
• Layer 2 - API checks: aggregates Google Safe Browsing, PhishTank, URLhaus, ScamAdviser, and 30+ scam TLDs for known-malicious investment and crypto-drainer domains, so a link already flagged elsewhere is stopped immediately.
• Layer 3 - AI deep scan (Premium): 100+ language content analysis recognizes fake investment-platform and credential-harvest pages, including French-language "secure your crypto-assets" funnels, and catches novel scam domains the moment they go live, even before they appear on any blocklist or any regulator blacklist.

The free SafeBrowz Android app applies the same engine to links you tap from a message, a social post, or a video description on your phone, where most deepfake-driven scams actually start. So when a "Banque de France agent" or a deepfake clip sends you to a platform, SafeBrowz checks the destination, not the convincing story.

Detection signatures come from threat-intelligence research and brand database analysis, not from user browsing data. No per-user browsing history stored.

Frequently asked questions