Smart guys have decided to steal France Connect identifiers on the pretext of carrying out an investigation into the Covid-19. By phone or email, they pretend to be civil servants by asking for the vaccination status of their victim, or by promising compensation. Their goal: your personal data.
Not very secure with France Connect
Facilitating online access to several public administration platforms (taxes, health, allowances fund, etc.) with a single username and password to remember, such was the project of the State’s Interministerial Digital Department French, which set up the France Connect service a few years ago. It was first criticized for being invasive and monopolistic; it is now for its security breaches, which open the door to our personal data to the unscrupulous.
Read also: France Connect: moving towards Chinese-style social credit?
From the Ministry of Health to CPF training
They pose as an official of the Ministry of Health, or for a service of the ANSM, and approach their victims by telephone. There they pretend to want to know their vaccination status, or promise rights to Covid compensation. These scammers manage to deceive their interlocutors into believing that they already have information about them, such as the first digits of their health insurance account (easy to guess).
Once in confidence, victims sometimes give up their codes, as detailed on the Mac Generation site. With this, the scammer can reset the email address and password of all public services related to France Connect. But that’s not all. To turn France Connect credentials into loot, scammers use access to public service accounts to register their victims for fake training through their training account (CPF). On the other side, they are obviously the ones who pocket.