A rail discount email lands just as you are planning a trip. The offer looks familiar, the checkout opens smoothly, and the price seems worth a quick decision.
The fake SNCF discount email scam looks familiar at first. Its most costly turn may not appear until after the purchase seems finished.
Overview
A fake SNCF promotion starts the contact
Criminals sent emails advertising steep discounts on French rail cards and passes, then directed readers to sites styled to resemble SNCF Connect.
The genuine rail company was the impersonated brand, not the operator of those pages. Its known booking site is SNCF Connect.
The image above is a fictional reconstruction of the kind of email used. It is not a captured message from the campaign and contains only an example address.
The real investigation includes an authentic captured email, fake site, and payment page. We chose a text-focused reconstruction here to keep people out of the lead image.
Researchers documented two connected fraud stages
Group-IB’s May 2026 investigation traced the discount lure, lookalike domains, real payment-service checkout, and later calls from people pretending to be bank counselors.
After a victim paid for the fake offer, the caller claimed there had been fraud and presented themselves as the person who could stop it.
That call sought security codes, banking details, or actions that could authorize additional transactions. It exploited the victim’s awareness that something was already wrong.
This is not a complaint that a real travel company handled a booking poorly. It is documented brand impersonation followed by financial-account manipulation.
A legitimate payment processor does not vet the offer for you
Some observed checkouts opened on Stripe’s real payment infrastructure. That connection can make the transaction look safer than the seller behind it really is.
Stripe processes payments for many merchants. A real checkout page does not certify that a purported SNCF discount exists or that the merchant is SNCF.
- An unsolicited email promises an unusually cheap rail card.
- A lookalike site collects personal details and presents products.
- Payment may occur through a genuine third-party processor.
- A caller then poses as bank staff reacting to the initial fraud.
- The victim is pushed to share codes or approve another transaction.
The decisive point is the second contact: a bank employee does not need your approval code to cancel a fraud you did not initiate.
Why This Offer Arrives at a Plausible Time
The fake promotions were timed around French holiday travel periods, when families and frequent travelers are more likely to compare rail-card prices.
That timing makes the message feel like ordinary seasonal marketing. It also gives a short “flash sale” deadline a believable reason to exist.
Group-IB observed multiple domains using terms such as offers, advantages, and SNCF Connect. These are brand cues, not proof of ownership.
The investigation linked some recipient addresses to previously exposed data. That finding helps explain targeting, but does not establish the source for every email.
An email can mention a real product category, such as a rail discount card, while misrepresenting the price and where the purchase occurs.
Readers should not conclude that every promotion for rail cards is fraudulent. The risk is the surprise email routing to a non-official offer page.
If you are planning travel, the easiest independent check is to open SNCF Connect directly and look for the same card and price there.
Check the address before paying. An extra word or different ending after “sncf” can belong to a completely unrelated site.
Do not rely only on how polished the page looks. A copied header and familiar product names can be assembled faster than a legitimate customer service operation.
How the Fake SNCF Discount Email Scam Works
Step 1: The message promises a rail-card bargain
The initial lure advertises a large reduction on an SNCF-related rail card. It may say the offer is available for only a short time.
A recipient who has recently checked travel prices has a natural reason to notice. The message needs only a moment of credibility to win a click.
Group-IB captured French-language versions with a flash-sale presentation. The exact discount and sender address can change in the next campaign.
The sender address deserves inspection, but a plausible-looking address alone is insufficient. The destination and offer must also match the genuine site.
Step 2: The link opens a copied travel page
The landing page copies SNCF Connect navigation and rail-card categories. It may show annual card prices that look too good to pass up.
For a shopper, the page feels like a normal product catalog. The decisive difference lies in the web address and who controls the checkout.
Researchers observed several related domains over multiple travel periods. The fraud is not tied to one URL that a reader can memorize forever.
The page may collect a name, email address, and phone number before payment. Those details become useful when the operator makes the follow-up call.
Do not enter information just to compare prices. Open the genuine travel site in a separate browser tab and check the offer there instead.
Step 3: A genuine payment page handles a false sale
Some visitors are redirected to a Stripe checkout. The processor’s page can be genuine even while the preceding rail-card offer is fraudulent.
The captured checkout showed a rail-pass description and a euro charge. It is a record of the observed transaction path, not an endorsement of the seller.
That distinction matters for a dispute. Tell your issuer both where the payment was processed and what was falsely promised by the merchant.
A payment service may have abuse-reporting procedures, but there is no universal promise that it can return the money after a fraud report.
Do not dismiss a suspicious purchase because the address bar says stripe.com. The seller and its offer still need independent verification.
This is Group-IB’s authentic checkout capture. The payment processor was real; the purported discounted rail-card sale was the deceptive part.
Step 4: The fake bank counselor calls back
After the payment, a person calls claiming to be from the victim’s bank. They may say a fraudulent rail transaction has been detected.
The claim lands at a vulnerable moment. The victim may already suspect the discount site was fake and want immediate help.
The caller offers a path to stop or reverse the charge. In the documented reports, the instructions instead opened the door to more payments.
Knowing the earlier purchase does not authenticate the caller. The operator may know it because the fake checkout already collected the victim’s details.
Caller ID can also be spoofed. A number that looks local or bank-like should never replace a call you start from the banking app.
Step 5: A security action authorizes a new loss
The caller may ask the victim to reveal a bank code, add a recipient account, or approve an operation in the banking app.
Those actions can authorize a transfer, not cancel one. Read the bank’s on-screen description instead of following the caller’s explanation.
If the screen says you are adding a payee or approving a payment, stop. A real fraud investigation will not require you to make a new transfer.
Hang up and call the bank using its existing number. Do not use a number the caller sends afterward to prove their identity.
Even if the first charge is small, the second-stage request may be much larger. Treat the callback as a separate threat, not ordinary after-sales support.
Where the Real Brands Fit, and Where They Do Not
SNCF Connect sells real travel products. The investigated emails and lookalike domains borrowed its identity to lure customers elsewhere.
Stripe can host a genuine payment checkout for a merchant. That describes the processor’s role, not the truthfulness of a merchant’s claimed affiliation.
The bank is the next impersonated party. The caller’s knowledge of a transaction does not make them a bank employee.
This separation helps you describe the incident accurately. You encountered a fake SNCF promotion, paid a merchant, and received a suspicious bank call.
Those facts allow each real institution to investigate its relevant part without assuming one brand controlled the entire sequence.
It also clarifies why the first and second payments may have different dispute paths. Give the bank a timeline rather than only the last caller’s number.
Some victims may get the email and never receive a call. Others may receive the call without having paid. The documented pattern does not require every stage for every target.
The advice is still useful at either point: verify the offer independently and refuse any caller who asks you to approve a new banking action.
The Bank Call Is Not a Refund Shortcut
The caller’s story often begins with something true: a payment just occurred. That does not make the person describing it trustworthy.
A criminal who collected the shopper’s phone number can time the call perfectly. The contact may arrive while the purchase still feels fresh.
That timing is more persuasive than a generic fraud warning. It lets the caller appear to know private banking activity without accessing the bank.
Ask yourself what the requested action would do if the caller were lying. Entering a code could authorize a payment, not reverse the first charge.
A push notification from your bank is not an identity check for the caller. It is usually an authorization request for an action in your account.
Read the amount, recipient, and purpose on that screen. If they do not match something you personally initiated, deny the request.
Do not let the caller talk you through ignoring a warning in the app. The warning is there precisely because another person may be pressuring you.
The safest conversation with your bank starts after you have ended the suspicious call. Dial the number already saved in your app or on your card.
Tell the real representative whether you entered card data, approved a push prompt, disclosed a code, or added a new payee. Those are different exposures.
Also mention if you shared an IBAN. That number alone is not the same as giving someone a password, but it matters to the investigation.
If the supposed counselor asks you to move money into a “safe account,” decline. A genuine bank can restrict activity without instructing you to transfer funds elsewhere.
A second caller who claims to be the bank’s fraud supervisor should be treated the same way. Repeated calls do not create a verified identity.
Keep the original email while you report the case. The domain and message headers may help identify the campaign even after a lookalike site disappears.
Finally, check later statements for unfamiliar recurring charges. We have no evidence of a subscription in this campaign, but continued card misuse is possible.
What to Do if You Have Fallen Victim to This Scam
- Hang up on the supposed bank counselor. Call your bank through its app, card, or known website. Explain both the rail-card payment and the call.
- Ask the bank to review every affected transaction. Discuss a card dispute, transfer recall, and whether your card or online-banking credentials must be changed.
- Do not approve another prompt. A code or app confirmation may authorize a new payee or payment. Read what your bank app actually says.
- Change exposed passwords. If you created an account on the lookalike site, replace any reused password and review current bank sessions.
- Preserve the chronology. Save the email, destination address, checkout receipt, statement entry, caller number, and messages about security codes.
- Report the imitation. Notify SNCF through its official contact route and report the domain and sender to your email provider and appropriate fraud authority.
- Check whether software or permissions changed. Malwarebytes is relevant after a download; AdGuard can help reduce malicious-link exposure. Neither cancels a transfer.
- Watch for another callback. Fraudsters may pose as investigators or recovery agents. Keep future contact on channels you initiate yourself.
If you clicked but did not pay or provide details, close the site and check your browser for any granted notification permission.
If you paid but never got a call, tell the bank about the suspicious merchant now. Do not wait for the second stage to materialize.
If a caller persuaded you to add a recipient or approve a transfer, say exactly that to the bank. The wording can speed its response.
Frequently Asked Questions
Is SNCF selling the discounted card in this email?
The captured campaign impersonated SNCF. Check the offer on SNCF Connect through a site or app you opened independently.
Can a fraudulent sale really use Stripe?
Yes. A real payment processor can process a transaction for a deceptive merchant. Its presence does not validate the preceding offer.
Why does the caller know I bought a rail card?
The fake purchase may have supplied the operator with your name, phone number, and transaction context. That knowledge does not authenticate the caller.
Should I read a one-time bank code to cancel the charge?
No. End the call and contact your bank yourself. A code or approval may authorize a fresh action instead of canceling anything.
Do all recipients receive a fake bank call?
No. The investigation documents that second stage in victim reports, but it does not establish that every emailed person received the same call.
Can I rely on an abuse report for an automatic refund?
No. Report the merchant and speak with your card issuer or bank promptly about the applicable dispute process and evidence.
The Bottom Line
The fake SNCF discount email scam turns a believable rail-card offer into a payment, then uses a supposed bank rescue call to seek more.
The safest break is independent verification at both ends: open SNCF Connect yourself, and call your bank yourself if anything feels wrong.
