Hornetsecurity: retailer and bank callback tech-support scam uses Onoff numbers
Hornetsecurity found 150,000+ messages posing as Darty, BUT, Cdiscount and French bank alerts that push people to call fake 'support' numbers; the retailers and banks are impersonated.
- First reported
- Reports
- 1
Source: hornetsecurity.com · published
What happened
Hornetsecurity's Threat Intelligence Lab reported on 15 October 2026 a callback tech-support scam that sends messages impersonating retailers (including Darty, BUT and Cdiscount) and banks (including messages styled as Société Générale and Banque Populaire alerts). The messages claim expensive purchases or suspicious bank transfers and urge recipients to call a phone number given in the message. Between 18 September and 2 October 2026, Hornetsecurity identified more than 150,000 such messages and recorded over 40 callback numbers, which its checks associated with the Onoff virtual-number service; Hornetsecurity says this association does not identify the users of the lines or attribute the campaign to Onoff. In the calls it examined, operators asked for the caller's name and the transaction reference, repeated details from the message, and then sent a file by MMS. Hornetsecurity published the callback numbers it identified as malicious as indicators of compromise, including 0189629302. The impersonated retailers and banks are not involved. Verify transactions only through official bank or retailer channels, not numbers given in a message.
How the scam works
Two pretexts lead to the same phone call. Fake purchase confirmations or invoices mention expensive items such as smartphones, games consoles, tablets and gift cards, described as approved, being prepared or already paid, and tell the recipient to call customer service if they don't recognise the purchase. Fake bank alerts report a login from a new device, sometimes from an unusual location, followed by a pending transfer of thousands of euros.
Display names such as "Customer Service", "Bank" or "Epay" do not match the impersonated organisations' official domains. On the phone, operators ask for the caller's name and the transaction reference, repeat details from the message to sound credible, and follow a script. Hornetsecurity says the likely motive is financial: getting the victim to pay, disclose banking details or authentication codes, or grant access to their device. It could not retrieve the file sent by MMS, so its role is unknown.
Source
Hornetsecurity, "Tech Support Scam: Fake Orders and Banking Alerts" (October 15, 2026).
Red flags
- An unexpected order confirmation or bank alert telling you to call a number to cancel it.
- A login alert from a 'new device' followed by a large pending transfer.
- Sender names like "Customer Service" or "Bank" without the company's real domain.
- A caller who asks for your transaction reference and then sends you a file.
If you were targeted
- 1Don't call the number in the message.
- 2Check the transaction in your banking app or through the retailer's or bank's official contact details, found independently.
- 3Never share authentication codes or install software at a caller's request.
- 4Report suspicious texts to 33700 (in France) or your carrier's spam reporting service.