Fraud by Manipulation in France: +34% in 2025, €516 Million Diverted

Trust, but verify. A fake advisor on the line, a reassuring tone, and a transfer that goes out before you even hang up. The Observatory of Payment Means Security, linked to the Bank of France, has just published its annual report. The verdict will not surprise those who closely follow crypto scams: psychological manipulation now far exceeds pure technical hacking. Key points of this article:

• Fraud by manipulation in France reached €516 million in 2025, accounting for over 40% of total payment fraud.
• Young adults aged 20-24, often perceived as tech-savvy, experienced the highest victimization rate in scams.

According to the OSMP report published on September 7 to mark its anniversary, fraud by manipulation, which involves convincing the victim to provide sensitive information or to validate a transaction themselves, surged by 34% in 2025 to reach €516 million. It now represents over 40% of the total amount of payment fraud in France, a total that climbs to €1.24 billion across all categories. The only relative consolation is that the number of fraudulent transactions decreased by 8% during the same period. Scammers strike less often, but harder with each attempt.

The scenario of the fake bank advisor, who calls impersonating a real institution to push a victim to validate a "security" transfer, alone accounts for €376 million. This scheme closely resembles the scams involving fake Coinbase advisors that wreaked havoc in the crypto ecosystem, except that the target here is in the millions of bank customers rather than digital wallet holders.

Another insight that challenges the usual clichés about fraud, reported by franceinfo: it is not seniors who are most exposed, contrary to the naive grandparent image on the phone. The 20-24 age group shows the highest victimization rate, with 9.6 victims per 1,000 inhabitants.

A generation born with a smartphone in hand, yet still vulnerable to scenarios designed to create urgency and short-circuit reflection. The common thread with the fake Coinbase advisor scams, which siphoned off $65 million in just two months last year, is no coincidence: the same psychological triggers, the same artificially created sense of urgency, only the targeted financial product changes.

Ironically, never have fraud detection tools been so sophisticated. Banks are investing heavily in artificial intelligence to spot suspicious patterns in real-time, a focus that Visa has recently bet big on by acquiring BioCatch for $2.4 billion.

But psychological manipulation precisely bypasses this type of technical barrier: when it is the victim themselves who validates the operation, willingly and from their own device, no detection algorithm can truly oppose it. The weak link remains, and will remain, human.

The lesson extends far beyond traditional banking. Any financial institution, including those managing cryptocurrencies, faces the same dilemma: the stronger the technical authentication, the more fraudsters retreat to social engineering to circumvent it. A useful reminder at a time when more and more French people juggle between traditional bank accounts and crypto wallets, with, in both cases, one reflex that truly protects: never validate a transaction under the pressure of a call you did not initiate yourself.

On February 21, 2025, the exchange Bybit suffers the largest heist in crypto history: $1.5 billion vanished in minutes from its cold wallet. No smart contract flaw, no guessed password. Investigators point to the North Korean group Lazarus, and the flaw lies with a service provider, not with Bybit itself.

The hackers compromise the computer of a developer at Safe{Wallet}, the multi-signature tool used by the exchange to validate its internal transfers, and inject malicious code into its interface. When the authorized signers of Bybit connect to approve a routine transfer, all they see on the screen is perfectly normal. What their hardware wallet actually makes them sign, once the technical data is decoded, is something entirely different: a takeover of the contract to a hacker's address.

The signers validate, convinced they are executing a standard operation they initiated themselves. Neither their hardware key nor their security procedure has been technically compromised: it is the information presented to them that was false. The same mechanism as the fake bank advisor who gets their victim to sign a transfer, on the scale of an exchange managing billions rather than that of an individual. Proof that psychological manipulation does not stop at individuals' bank accounts: it also targets those who are supposed to be the best protected.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.