Xamoz is a streaming site that offers movies and series without a broadcasting license. The platform requires visitors to create an account and, in some cases, to provide banking details to access the content. This data collection on an unregistered site poses real security issues, both for the credit card and for the personal information submitted during registration.
Collection of banking data on a site without legal framework: what it implies
An unauthorized streaming site does not comply with any regulatory obligations regarding data protection. Unlike a platform registered with the CNIL, Xamoz offers no guarantees regarding the storage, encryption, or deletion of the information entered by its users.
When a payment form appears on this type of site, there is no assurance that the transaction goes through a secure payment provider. Card details (number, expiration date, security code) can be stored in plain text on unprotected servers, accessible to third parties or sold on parallel markets.
The problem is not limited to credit cards. The email address, the password chosen during registration, and sometimes the phone number constitute a set of exploitable data. If the same password is used on other services (email, online banking, social networks), a leak from Xamoz can compromise multiple accounts at once. This mechanism has a name: credential stuffing, which involves automatically testing stolen username/password combinations on other platforms.
Several analyses published online corroborate these findings. By consulting reviews about the xamoz site, users have reported unauthorized withdrawals after registration.
Fraud by manipulation rather than direct card hacking
Content that addresses online payment security often focuses on card number theft. The reality of banking fraud has changed in recent years.
According to the report from the Payment Security Observatory (Banque de France), commented on by several specialized media in 2026, transfer fraud has surpassed card fraud in amount. Transfer fraud significantly increased between 2024 and 2025, while card fraud decreased during the same period.
This means that the risk posed by a site like Xamoz does not stop at card number theft. The personal data collected (name, email, phone) serves as the basis for more elaborate manipulation scenarios.
The fake bank advisor scenario
A fraudster who has your name, email, and the fact that you have an active bank account can contact you pretending to be your bank. The classic pretext: “suspicious activity detected” on your account, requiring urgent action.
The goal is no longer to hack your card but to get you to validate a transfer yourself or to provide an authentication code received via SMS. This type of fraud, known as manipulation fraud, surged significantly in 2025 according to Les Échos and Boursorama.
- The fraudster uses real personal data to gain your trust (full name, presumed bank, last digits of the card).
- They create a sense of urgency: imminent account suspension, ongoing fraud attempt.
- They request a specific action: validate a transaction on the mobile app, provide a code received via SMS, or make a “security” transfer.
No bank ever asks to validate a transaction by phone in an incoming call context. This reflex is enough to block the majority of these attempts.
DNS blocking and ARCOM list: check a site’s status before paying
Illegal streaming sites like Xamoz are regularly subject to blocking ordered by ARCOM (formerly Hadopi). These blocks go through internet service providers, which redirect DNS requests to a warning page.
A site subject to a DNS block by ARCOM has no commercial legitimacy. Entering payment data there amounts to providing banking information to an operator that violates French intellectual property law and has no reason to comply with the General Data Protection Regulation.
To check if a site is on the list of blocked domains, several methods exist:
- Test access to the site from a mobile network and a fixed network: if the site is inaccessible with one operator but accessible via a VPN, it is likely blocked.
- Search for the site name in ARCOM’s public decisions.
- Consult reputation assessment tools (ScamAdviser, URLVoid) that aggregate reports.
The fact that a site circumvents a block (changing domain name, mirrors) is itself an indicator of risk. A legitimate service does not change address to evade a court ruling.
Reacting after entering data on Xamoz
If banking details have been provided on this type of site, the first action is to block the card. The interbank server dedicated to oppositions is accessible at all times, and a registration number is issued to keep a dated record of the process.
Changing the password used during registration on Xamoz is the second priority, especially if this password is shared with other services. Activating strong authentication (validation via mobile app or biometrics) on online banking and email reduces the risk of unauthorized access, even in the event of a credential leak.
Monitoring bank statements for several weeks remains necessary. Fraudulent withdrawals do not always appear immediately: some operators first test small amounts before attempting larger transactions. Reporting on the Perceval platform of the Ministry of the Interior allows for documenting the fraud and feeding ongoing investigations.
The apparent free nature of a streaming service always hides an economic model. When this model relies on the collection of personal and banking data without any legal framework, the real cost to the user far exceeds the price of a subscription to an authorized platform.
