FRANCE PHISHING GUIDE

Fake Police nationale and gendarmerie email accusation scam in France 2026: is the "72-hour arrest" warrant real?

An email lands with the Police nationale logo. It accuses you of serious online offenses and gives you 72 hours to reply before "arrest". It is terrifying by design. It is also a mass-sent scam, and you are not the only person who received it.

SB

SafeBrowz Threat Research Security ResearchJune 28, 20269 min read

You are not the person it targets, and that matters

If you received this email and your stomach dropped, read this first. The message is engineered to trigger panic, shame and silence. It names crimes so serious that most people are too frightened and too embarrassed to talk to anyone about it, which is exactly the reaction the sender wants. That silence is the scam's main weapon.

Here is the truth that breaks the spell: this is not a personal accusation. It is a template, blasted out to thousands of email addresses harvested from old data breaches and leaked mailing lists. The sender has no case file, no warrant, and usually does not even know your name. They are gambling that out of thousands of recipients, a handful will be scared enough to reply or pay. You being innocent is not in question, because there is no investigation. There is only a mail-merge.

So before anything else: you have done nothing wrong by receiving it, and you owe this email no response. Sit with that for a second, then read on for how to confirm it and shut it down.

What Cybermalveillance.gouv.fr actually says

Cybermalveillance.gouv.fr is the official French government platform for assisting victims of cybercrime. On 18 June 2026 it renewed its public alert about email campaigns usurping the identity of the Police nationale and related bodies. According to that alert, the fraudulent messages:

• Display official logos and impersonate real services, including the Police nationale (the Brigade de Protection des Mineurs and the Direction Centrale de la Police Judiciaire), the Gendarmerie nationale, Europol, Interpol, the Ministère de la Justice, and OFMIN (the French office against violence to minors).
• Accuse the recipient of extremely serious offenses such as child pornography, paedophilia, exhibitionism and sexual trafficking.
• Reference a fake "mandat d'arrêt" (arrest warrant) and threaten to register you as a "délinquant sexuel" (sex offender).
• Demand a response within 72 hours, and threaten to publicize the accusation to your family and the media if you stay silent.

Cybermalveillance.gouv.fr is unambiguous: this is an attempted scam designed to frighten you into paying. The campaign has run in waves since 2020, and the June 2026 update reflects that it is still active and still evolving.

How the scam actually works

The mechanics are simpler than the email looks. There are two common variants, and both rely on fear rather than any technical trick.

The reply-and-pay version. The email instructs you to respond directly, usually to a free webmail address, to "explain yourself" or "regularize your situation" before the 72-hour deadline. The moment you reply, you have confirmed your address is live and that you are scared. A human scammer then takes over the conversation, escalates the threats, and steers you toward a payment, often framed as a "fine", "caution" or "settlement" to make the case disappear. Payment is typically requested by bank transfer, gift cards or crypto, which are hard to reverse.

The attachment or link version. Some variants attach a fake "convocation" PDF on official-looking letterhead, or include a link to a page styled like a police or justice portal asking you to enter personal details or pay online. The attachment may also carry malware. The page may sit on a throwaway lookalike domain or a free hosting subdomain rather than a real .gouv.fr address.

Either way, the engine is the same: a serious accusation, a countdown, and a demand. Real criminal procedure has none of those three things in an email.

The exact phrases the scam uses

Once you have seen these, they jump out of any inbox. Real French police and justice communications do not write like this.

• "Mandat d'arrêt à votre encontre" with a deadline attached
• "Vous disposez de 72 heures pour répondre" before "prosecution"
• "Pédopornographie, pédophilie, exhibitionnisme, cyber pornographie" listed as charges
• "Vous serez fiché comme délinquant sexuel" as a threat
• "Faute de réponse, votre dossier sera transmis aux médias et à votre entourage"

The wording feels official because the scammers copied real logos and bureaucratic vocabulary, but the rhythm is wrong. Real administrative French is dry, precise and patient. It does not threaten you with the media, it does not run a 72-hour countdown, and it does not mix a criminal accusation with a payment demand in the same breath.

How a real French police summons works

This is the section to memorize. Knowing how the real process looks makes every fake one obvious.

The police do not accuse you of a crime by email. A genuine criminal investigation does not begin with a mass email warning you to reply within three days. If the gendarmerie or police needs to question you, you receive a formal "convocation" by official channels, typically a registered paper letter or a phone call from an identifiable local unit, inviting you to a specific brigade or commissariat. You are never asked to pay a "fine" to avoid arrest. In France, criminal fines are decided by a court, not settled by email.

Real government email comes from a .gouv.fr address. Authentic communications from the Ministère de l'Intérieur and its services use official domains such as @interieur.gouv.fr. Cybermalveillance.gouv.fr notes that the scam emails instead come from ordinary free-webmail addresses. A police "brigade" writing to you from a Gmail, Outlook or Proton address is the single clearest tell that the message is fake.

A logo proves nothing. Anyone can copy the Marianne emblem, the Police nationale crest or an Interpol header into an email. Genuine authority is shown by the channel and the procedure, not by the picture at the top.

Red flags: how to spot it in 30 seconds

• The sender address is a free webmail, not @interieur.gouv.fr. Look at the full address, not the display name "Police Nationale".
• It accuses you of a crime by email. Real police do not open a case in your inbox.
• There is a 72-hour countdown. Criminal procedure does not work on a three-day reply timer.
• It demands money or a reply to "avoid arrest". French fines are set by courts, never settled by email payment.
• It threatens to expose you to your family or the media. That is extortion language, not police language.
• The body is mixed together. Multiple agencies (Police, Europol, Interpol, Justice) are name-dropped at once to look overwhelming.
• A link or attachment asks for personal data or payment. No real summons collects payment through a web form.

Any single one of these is enough to throw the email out. The combination of a free-webmail sender plus a payment demand plus a countdown is a confirmed extortion scam.

What to do (the safe routine)

The correct response is mostly about what NOT to do. Keep it simple.

1. Do not reply. Not even to deny the accusation. A reply confirms your address is active and that you are reachable, which invites a human scammer to escalate.
2. Do not pay anything. There is no fine, no caution and no settlement. Paying does not make it stop, it marks you as a paying target.
3. Do not click links or open attachments. If you want to be sure a link is hostile, paste it into the checker above instead of opening it.
4. Keep the evidence, then report. Take a screenshot or save the email before deleting, so you can report it.
5. Tell someone you trust. The scam relies on shame and isolation. Saying it out loud to a partner, friend or a victim-support line drains its power immediately.
6. Delete it. Once reported, remove it from your inbox so it stops haunting you.

How to report it in France

Reporting protects the next person who receives the same template. Each of these takes only a couple of minutes.

• Report the content to Pharos: the official police reporting portal for illegal online content and scams is internet-signalement.gouv.fr. This is the right channel for a fraudulent email impersonating the police.
• Get help and report at Cybermalveillance.gouv.fr: the national platform cybermalveillance.gouv.fr assists victims of cybercrime and publishes updated alerts on this exact campaign.
• Forward spam SMS or related texts to 33700: the free national short code for nuisance and scam SMS, if the threat also reached you by text.
• Call Info Escroqueries on 0 805 805 817: a free government line (open Monday to Friday) that advises victims of fraud and scams.
• Call the police on 17 if you feel in immediate danger, or file a formal complaint (plainte) at your local commissariat or gendarmerie if you paid or shared personal information.
• Reach France Victimes on 116 006 for free, confidential victim support seven days a week if the email has left you shaken.

For young people facing online harassment, threats or sextortion-style pressure, the national helpline 3018 offers free and confidential support.

What if I already replied or paid?

First, breathe. This happens to careful people, because the email is built to bypass careful thinking. You can still act.

1. Stop the conversation now. Do not send a further reply or payment. The threats will escalate as long as you respond, and they collapse when you go silent.
2. If you paid by card or transfer, call your bank immediately and ask to block and dispute the transaction. The sooner you act, the better the chance of a reversal.
3. File a plainte at your local commissariat or gendarmerie, bringing screenshots of the email, the sender address, any link or attachment, and any payment receipt.
4. Report it at internet-signalement.gouv.fr and seek guidance at cybermalveillance.gouv.fr.
5. Lean on support. Call France Victimes on 116 006. There is no judgment here, only next steps.

How SafeBrowz detects this threat

SafeBrowz runs a 3-layer detection architecture: Local + APIs + AI. The email itself arrives in your inbox, but the moment it tries to send you to a link or "portal", that is where SafeBrowz steps in, on both the browser extension and the Android app.

• Layer 1 - Local detection: 60+ URL patterns and 550+ brand signatures (including French government impersonation patterns) run directly in the extension before the page renders. A fake "police" or "justice" portal on a lookalike or free-hosting domain trips the local engine before it can load.
• Layer 2 - API checks: aggregates Google Safe Browsing, PhishTank, URLhaus and scam-TLD intelligence to catch links already flagged as malicious in extortion and phishing waves.
• Layer 3 - AI deep scan: content analysis in French and 100+ other languages recognizes government-portal mimicry (Marianne and Police nationale styling, official header bars) and credential or payment-harvest pages, and catches brand-new variants the moment they go live, even before any blocklist lists them.

On the Android app, the same engine scans links you open or paste, so a "convocation" link in an email gets a verdict before you trust it. The extension does the same in Chrome, Firefox and Edge.

Detection signatures come from threat-intelligence research and brand database analysis, not from user browsing data. No per-user browsing history stored.

Frequently asked questions