Ready-to-use templates
Everyday letters and messages, sorted by topic: expand the one you need. Copy in one click, download, or receive by email. Nothing to install, nothing to pay.
Hacked account
Send right awayWarn my circle about a hacked accountA short copy-paste message for when one of your accounts (email, social media, messaging) has been hacked, to keep your contacts from falling for a scam in your name.
Hello, My [social media / messaging / email] account has been hacked. If you receive an unusual message from me (a request for money or a code, a strange link, an "urgent" tone...), do not click on anything, do not reply and do not forward it to anyone: it was not me. I am in the process of regaining control of my account. As a precaution, please disregard any messages received since [approximate date]. If you have any doubt about a message that seems to come from me, contact me directly by another means (phone, text) to check. Thank you, and sorry for the disruption, [First name]
Send it from a safe channel (another account, a text) if the hacked account is no longer yours. Do not include any link: that is exactly what people should be wary of.
What you should know
- A hacked account is used first to scam your circle ("I have a problem, can you lend me...") then to pivot to other accounts.
- Do not include any link in the message: that is precisely what people should be wary of.
- Warn first the people most likely to react: family, colleagues, frequent contacts.
What next? Once the account is recovered (password changed, two-factor authentication enabled, sessions closed), a short message can reassure your contacts. To take everything back in hand, see the "Generate an action plan" tool.
Bank fraud
Bank / fraudDispute an unauthorized bank transactionA letter or message to your bank to report a transaction you did not authorize (payment, direct debit, withdrawal) and request a refund.
Subject: Dispute of unauthorized transactions and request for refund [Your first and last name] [Your address] Account / card concerned: [reference] For the attention of the customer service of [bank name] In [city], on [date] Dear Sir or Madam, I note on my account one or more transactions that I did not authorize and that I formally dispute: - [date]: [description] for [amount] - [date]: [description] for [amount] I did not share my credentials with anyone and did not approve these transactions. I blocked the card on [date] (reference: [card-blocking number, if applicable]). In accordance with the regulations applicable to unauthorized payment transactions, I request the refund of these amounts and the restoration of my account to the state it would have been in without these transactions. Please confirm in writing that my request has been received and the action taken. Yours faithfully, [First name Last name] [Signature]
First block the card by phone, then send this written request (registered mail or via your online area's messaging) to keep a record. Report it quickly: the time limits for disputing are limited.
What you should know
- For an unauthorized payment transaction, your bank must in principle refund you immediately, unless it suspects fraud on your part.
- The time limit to dispute an unauthorized transaction is in principle 13 months (70 days if the beneficiary is located outside the European Economic Area).
- After you block the card, you are no longer liable; before that, your share stays capped at 50 EUR, except in cases of gross negligence.
- Attach the statement, the card-blocking reference and a screenshot of the disputed transactions.
What next? If refused or unanswered, refer the matter free of charge to your bank's mediator, then possibly to a court. For online fraud, file a complaint via the THESEE service on service-public.fr.
Identity & reputation
Identity theftReport identity theftTo report to an organization (bank, telecom operator, government body, online store) that someone is using your identity, and to request the blocking or cancellation of what has been done in your name.
Subject: Report of identity theft and request for blocking [Your first and last name] [Your address] [Your email / phone] For the attention of [organization name] In [city], on [date] Dear Sir or Madam, I am informing you that someone is using my identity without my knowledge. I have observed the following: - [e.g.: an account, contract or order opened in my name that I did not take out] - [date and details] I never took out or authorized these steps. I ask you to: - block or cancel without delay [the account / contract / order concerned]; - take no action (payment, delivery, debt collection) concerning me without verifying my identity; - provide me with the information you hold about this fraudulent application. I filed a complaint on [date] (copy attached or to follow). Please confirm in writing the measures taken. Yours faithfully, [First name Last name] [Signature]
Also file a complaint: attaching a copy of the complaint strongly supports the request. You can get free support from cybermalveillance.gouv.fr.
What you should know
- Identity theft is a criminal offense (article 226-4-1 of the French Criminal Code): file a complaint, it strongly supports your steps.
- You can get free support from cybermalveillance.gouv.fr.
- Request the blocking or cancellation in writing, and confirmation of the measures taken; keep all exchanges.
- If a loan has been taken out in your name, also inform the lender and, in case of an unjustified listing, the Banque de France.
What next? If the organization does not block it or does not respond, follow up by registered mail and report the situation (DGCCRF, the relevant mediator). In case of an unjustified banking listing, request its removal from the Banque de France.
Right to be forgottenHave a search result about my name removedA request to a search engine (Google, Bing...) to stop showing a result about you when someone searches your name, when the information is outdated, excessive or harmful to your privacy.
Subject: Request for de-referencing of content concerning me [Your first and last name] [Your email] For the attention of the data protection service of [search engine] In [city], on [date] Dear Sir or Madam, I request that you de-reference the following result or results, which appear when searching for my first and last name: - URL: [full address of the page] - Search concerned: "[your first and last name]" This content harms me for the following reason or reasons: - [e.g.: outdated, inaccurate or excessive information, relating to my private life, an old closed case...] Under the right to de-referencing, I request that you remove these links from the search results associated with my identity, and that you confirm your decision to me. Please find attached an ID document to allow my request to be processed. Yours faithfully, [First name Last name]
The search engine can refuse if the information remains in the public interest. In case of a refusal you consider unjustified, you can refer the matter to the CNIL. De-referencing removes the link from the results, not the source page (for that, contact the site).
What you should know
- De-referencing removes the link from the results associated with your name; it does not erase the source page (for that, contact the site).
- The search engine weighs your privacy against the public's interest in the information: it can refuse (public figure, recent judicial information...).
- State each URL and the precise reason for the harm: the better argued the request, the better its chances of success.
- De-referencing may apply only to the European versions of the search engine.
What next? In case of a refusal you consider unjustified, refer the matter to the CNIL (online complaint), which can ask the search engine to re-examine your request.
Your data (GDPR)
GDPR / ErasureHave my personal data deletedAn email or letter to ask an organization to erase the data it holds about you (right to erasure, article 17 of the GDPR).
Subject: Request for erasure of my personal data (article 17 of the GDPR) [Your first and last name] [Your address] [Your email / phone] For the attention of the data controller of [organization name] In [city], on [date] Dear Sir or Madam, Pursuant to article 17 of the General Data Protection Regulation (GDPR), I request that you erase all the personal data concerning me that you hold. To allow my file to be identified: - First and last name: [...] - Email address associated with the account: [...] - Customer reference / file number (if applicable): [...] I also ask you: - to confirm in writing the effective deletion of this data; - to pass this request on to any processor or recipient to whom this data may have been disclosed. You have in principle one month to respond. Failing a satisfactory response, I reserve the right to refer the matter to the CNIL. Yours faithfully, [First name Last name] [Signature]
Preferably send it by email with acknowledgment of receipt, or by registered mail for important requests. Without a satisfactory response within one month, you can refer the matter to the CNIL (cnil.fr).
What you should know
- The right to erasure (article 17 of the GDPR) is not absolute: it can be refused if the data remains necessary (legal retention obligation, ongoing contract, dispute...).
- The organization must respond within one month, extendable by two months for complex requests, informing you of this.
- The process is free: you cannot be charged for exercising your rights, unless the request is manifestly excessive.
- Attach an ID document only if the organization needs it to identify you.
What next? Without a satisfactory response within one month, refer the matter to the CNIL (online complaint on cnil.fr). You can also seek compensation before a court.
GDPR / AccessFind out what data an organization holds about meAn email or letter to ask an organization for the list of personal data it holds about you, its origin and its recipients (right of access, article 15 of the GDPR).
Subject: Request for access to my personal data (article 15 of the GDPR) [Your first and last name] [Your address] [Your email / phone] For the attention of the data controller of [organization name] In [city], on [date] Dear Sir or Madam, Pursuant to article 15 of the General Data Protection Regulation (GDPR), I request that you provide me with: - all the personal data concerning me that you hold; - the purposes for which it is used; - its origin, where it was not collected from me; - the recipients or categories of recipients to whom it is disclosed; - the expected retention period. Please send me a copy on a durable medium (email or letter). To allow my file to be identified: - First and last name: [...] - Email address associated with the account: [...] - Customer reference (if applicable): [...] You have in principle one month to respond. Failing that, I reserve the right to refer the matter to the CNIL. Yours faithfully, [First name Last name] [Signature]
The organization has in principle one month to respond and must provide you with a copy. Without a response, you can refer the matter to the CNIL (cnil.fr).
What you should know
- The organization must provide you with a copy of your data, free of charge, within one month (extendable by two months if the request is complex).
- It must also state the purposes, the recipients, the retention period and the origin of the data.
- An ID document can only be requested in case of reasonable doubt about your identity.
- The right of access often prepares a request for rectification (article 16) or erasure (article 17).
What next? Without a response within one month, refer the matter to the CNIL. If the data is inaccurate, send a request for rectification; if unnecessary, a request for erasure.
These templates are generic starting points, not personalised legal advice. For a sensitive case, get proper support. On the right to erasure, see also the CNIL in the glossary.
Don't miss the next analysis