Table of Contents
Fraudulent SMS pretending to be Chronopost are among the most widespread campaigns in France and Europe. Their effectiveness relies on an extremely precise message format, designed to closely resemble a legitimate parcel tracking notification. Behind this apparent simplicity lies a well-oiled mechanism, based on a standardized SMS structure, a short formulation, and a concealed redirection to fraudulent pages. Identifying this format allows for immediate detection of these messages before any interaction.
The observed campaigns almost all use an identical message scheme, designed to be read quickly and provoke immediate action. The SMS begins with a direct mention of the carrier, often in the form Chronopost:, followed by a short sentence mentioning a delivery problem.
Example of a frequently noted structure:
Chronopost your parcel cannot be delivered today please reschedule delivery via the link below
This format avoids any complex punctuation and removes accents to ensure maximum compatibility with all phones. The message then contains a shortened URL or a domain imitating Chronopost, often placed at the end of the sentence to capture visual attention. Analyses show that more than 78% of victims click on the link within 10 seconds, proving the effectiveness of this construction.
The central point of these SMS lies in the progressive redirection. The displayed link seems harmless, sometimes close to the official domain, but it actually redirects to several intermediate servers before reaching a fake parcel tracking page. This page faithfully mimics the Chronopost interface, with logo, colors, and input fields.
Network flow studies show that these redirections often use two to three relays, complicating automatic blocking by operators. In more than 60% of cases, the final page requests either personal information or a symbolic payment of less than 3 euros, presented as redelivery fees. This low amount reduces suspicion and increases the validation rate.
Despite their realism, these SMS present recurring signs. The first is the lack of personalization: no name, no real parcel number. Authentic Chronopost messages almost always include an identifier or reference. Fraudulent SMS use a deliberately vague formulation, applicable to any recipient.
Another revealing element: artificial urgency. The messages often indicate an action to be taken quickly, without specifying a real date. Analyses show that more than 90% of these SMS contain an immediate action verb like confirm, reschedule, or validate, combined with a unique redirection. This repetition makes them easier to recognize when one knows the format.
The success of these campaigns relies on a simple psychological factor: the majority of users regularly expect parcels. By using a short, familiar, and visually credible format, fraudsters exploit this anticipation without raising immediate suspicion. Figures show that during peak e-commerce activity, the click-through rate can exceed 35%, a very high level for a fraudulent message.
Moreover, the SMS format benefits from greater trust compared to emails, often perceived as more exposed to scams. As long as this model remains effective, it continues to be recycled, with only slight variations in domain or formulation, explaining its longevity.