FranceConnect lets people identify themselves to many French services without creating another account. Criminals can copy its appearance, so users must verify the requested service, page address and selected identity provider before signing in.
Quick answer
A sponsored result or visually convincing page may still be fraudulent. Logos and text are easy to copy; the exact address and the place where the journey began are stronger signals than appearance.
Why this trap works
A normal journey starts on the website of the service you intend to use. You choose FranceConnect and then an identity provider you already know. A request delivered through a text, email or advertisement is not legitimate merely because it shows the FranceConnect logo.
The safest method is to slow down, leave the channel creating pressure and return through a known source. An independent check usually takes far less time than recovering an account or disputing a payment.
Step-by-step checks
-
Start from the official address of the public service, typed manually or saved as a trusted bookmark.
-
When in doubt, check whether the service is described in official FranceConnect help or the service’s own documentation.
-
Before entering a username, read the complete domain. The word FranceConnect placed somewhere in an address proves nothing.
-
Choose the identity provider yourself. No caller or message should tell you to reveal a password or one-time code.
-
Read which information will be shared before confirming and stop if the context does not match your request.
-
Review the login alert afterwards. If you did not initiate the access, follow the official security process immediately.
-
On a shared computer, sign out of both the service and identity provider, and remove downloaded files containing personal data.
The point people miss
A sponsored result or visually convincing page may still be fraudulent. Logos and text are easy to copy; the exact address and the place where the journey began are stronger signals than appearance.
Do not decide from one signal alone. A padlock, logo, sender name or top search position can all be copied. Combine the address, context, request and an official channel found independently.
What to do after a click, entry or payment
If you entered credentials on a suspicious page, change the identity provider password from its official site. Enable multi-factor authentication, review sessions, preserve the fake address and use FranceConnect support for an alert you do not recognize.
Act first on what can still be blocked: a session, password, card or payment. Document the incident afterwards. Do not delete messages or logs before preserving useful evidence.
Frequently asked questions
Does FranceConnect know my password?
The password is entered with the chosen identity provider. Never disclose it through a call, message or unexpected form.
Does an alert always mean the account was hacked?
Not necessarily, but an alert you cannot explain should be handled immediately through the official security process.
Can I sign in from a text-message link?
It is safer to close the message and start again from the official website of the service you intended to use.
Official sources and update policy
This article prioritizes public or institutional sources. Interfaces and procedures can change, so verify the relevant service’s current instructions before a sensitive action.
What FranceConnect changes — and what it does not
FranceConnect reduces the need to create a separate username for each participating service, but it does not remove the need to inspect the service you are entering. The identity provider confirms who you are; the destination service remains responsible for the procedure and its decision. Read the destination name and the information requested before approving the exchange.
A login alert is useful only when it is reviewed. Keep notifications enabled, compare the time and service with your own action, and respond through official help when something is unfamiliar. Never let a caller turn an alert into a request for a password, one-time code or money transfer.