Is the website served under HTTPS? For example the company website I manage in terms of web development sells electrical courses online and I've served it under HTTPS - https://www.electriciancourses4u.co.uk We've never heard of a policy like that and our courses go up to a few grand per person! If the HTTPS is there then I guess it seems legitimate, maybe it's like you said a new policy that's really strict in France? I would be careful though. If it happened to me personally I would refuse and try and purchase the gifts from a different website.