Spotting fake bank, Correos, DGT and tax-office messages

Terms used

• INCIBE — INCIBE is Spain's national cybersecurity institute, which runs the 017 helpline for reporting online fraud.
• Cl@ve — Cl@ve is Spain's official digital identity system for logging in to government websites.
• Dirección Electrónica Habilitada Única (DEHú) — The DEHú is the single official online mailbox where Spanish authorities send you formal notices.
• DGT — The DGT is Spain's traffic authority, which issues driving licences and fines.
• Agencia Tributaria — The Agencia Tributaria is Spain's tax office.

Key rules

• Links: Genuine tax, traffic and Social Security offices do not ask you to pay or enter data through a link in a text or email.
• Bank codes: Never give anyone your PIN, password or SMS codes, and never install remote-access apps at a caller's request.
• Verify yourself: Type the official address into your browser or call the number on your card, never one in the message.
• Report: Report suspicious messages to INCIBE on 017.

The short version

Real organisations do not ask you to pay, log in or hand over codes through a link in a text or email. If a message pushes you to act fast, do not click. Go to the official site or app yourself, or phone a number you trust.

The messages you are most likely to get

The wording changes every few weeks, but the stories stay the same.

• Bank: your account is blocked, a suspicious payment was detected, or you must update your security data. A link leads to a fake login page.
• Correos: a parcel is held because of an unpaid small customs or delivery fee. A link asks you to pay by card.
• DGT: you have an unpaid fine or will lose licence points. You are urged to pay quickly at a reduced amount.
• Agencia Tributaria: a tax refund is pending or a notification is waiting. A link asks for your card details.
• Seguridad Social: a refund is pending, your pension is blocked, or there is an alert about your Cl@ve access.

For the current campaigns, see the warnings pages of INCIBE and its Oficina de Seguridad del Internauta (OSI).

Tell-tale signs

• Urgency or threats: a blocked account, a deadline, a fine that keeps rising.
• A link, especially a shortened one or an address that only resembles the real one. Unexpected attachments are also a warning sign.
• A sender address or number that does not match the organisation. Fake texts can even appear inside an existing SMS thread from the real sender.
• A request for passwords, PINs, full card numbers or the codes sent by SMS or your bank app.
• Generic greetings, spelling mistakes, odd logos.
• An offer that is too good, such as an unexpected refund or prize.

What your bank will never ask

Your bank will never ask, by SMS, email or phone, for your full PIN, online banking password, full card number with the security code, or one-time codes. It will never ask you to move money to a "safe account" or to install remote-access apps. It will not ask you to click a link to unblock your account. An SMS code is for authorising a payment, never for cancelling one.

If someone calls claiming to be your bank, hang up. Then call the number printed on your card or shown in the official app.

How genuine contact works

• Agencia Tributaria: sends notices by post or to your Dirección Electrónica Habilitada Única (DEHú) mailbox. It may text or email only to say a notice is waiting, with no link to pay.
• DGT: uses its Dirección Electrónica Vial and the Tablón Edictal de Sanciones. Genuine fines are paid on the DGT's electronic office.
• Seguridad Social: uses its electronic office, the Import@ss app and the Notifica system.

To check any message, type the official web address into your browser yourself. Log in with Cl@ve or a digital certificate and see whether the notice exists. You can also phone: 901 33 55 33 for the Agencia Tributaria and 901 16 65 65 for the Seguridad Social.

If you get a suspicious message

Do not click, reply or call back. Report it to INCIBE on 017. If you already entered card details or codes, call your bank straight away on the number on your card. The checklist, decision guide and FAQ below walk you through the checks.

Choosing between options

How do you confirm whether a message is genuine?

• Check on the official website: The message claims to be from the Agencia Tributaria, DGT or Seguridad Social.

• Phone the official helpline: You cannot log in or still doubt it.

• Call your bank on the number on your card or in its app: The message or caller claims to be your bank. Hang up and never use a number or link from the message.

• Ignore it and report it to INCIBE on 017: The message asks for passwords, PINs, full card numbers or codes, or presses you to click a link. Genuine entities do not ask for these by message.

Never use a link or number from the message itself: always go to the official site or number you find yourself.

Is this message or call real? A quick check before you act

• Stop and do not click, reply or call back. Urgency, threats, a blocked account or a fine that keeps rising are the first warning sign.

• Check the sender. Look for an address or number that does not match the organisation, or a message that appears inside an older SMS thread.

• Look at any link or attachment. Treat shortened links, web addresses that only resemble the real one and files you did not expect as unsafe.

• Check whether the message asks for passwords, PINs, full card numbers or the codes sent by SMS or your bank app. Genuine organisations never ask for these by message, so do not share them.

• Look for generic greetings, spelling mistakes, odd logos or an offer that is too good, such as an unexpected refund or prize.

• If a caller says they are from your bank, hang up and share no data or codes. Wait a minute or use a different phone, because scammers can keep the line open.

• Call the number printed on your card, shown in the bank's app or on its website, never one the caller gave you. Ask whether there is a real alert.

• If a relative writes from a new number, call the old number you know or another relative. Ask a personal question or a family code word, and ask for a voice note or video call before sending anything.

• If you already gave data or paid, tell your bank at once and report the case to the police. Report suspicious messages to INCIBE on 017.

What to watch out for

• Fake bank alerts: Texts or emails say your account is blocked, a suspicious payment was found or you must update security data, with a link to a fake login page. Do not click. Open your bank's app or type its address yourself, or call the number on your card.

• Fake Correos parcel fees: A message says a parcel is held because of a small unpaid customs or delivery fee and links to a card payment page. Do not pay through the link. Check the parcel by typing the Correos address into your browser.

• Fake DGT fines: A message claims you have an unpaid fine or lost licence points and offers a reduced amount if you pay quickly through a link. Ignore the link and check for any fine on the DGT's official website, typed in yourself.

• Fake tax refunds and Seguridad Social alerts: Messages promise a pending tax refund, a waiting notification, a blocked pension or a problem with your Cl@ve access, and ask for card details or logins.

Campaign details change every few weeks, so check current warnings with INCIBE or the Policía Nacional.

Frequently asked questions

Will the Agencia Tributaria ever text me a link to pay?

No, the Agencia Tributaria does not send a link to pay or enter card details by SMS or email. It may send a message only to say a notice is waiting in your Dirección Electrónica Habilitada Única (DEHú), the official electronic mailbox. Open that mailbox by typing the official address yourself.

Where do I pay a genuine DGT fine?

You pay a genuine DGT fine on the official website, the DGT's official website, which you should type in yourself. The DGT also uses its Dirección Electrónica Vial and the Tablón Edictal de Sanciones to notify fines. A text that offers a reduced amount through a link is a scam.

Would my bank ever ask me to install an app like AnyDesk?

No, your bank will never ask you to install remote-access apps such as AnyDesk or TeamViewer. It will also never ask you to move money to a safe account. If a caller asks for this, hang up and call the number on your card.

Can an SMS code be used to cancel a payment?

No, a code sent by SMS is only for authorising an operation, never for cancelling one. If someone asks you to read out a code to stop or cancel something, it is a scam. Do not share it and call your bank on the number in its app.

References

1. sede.dgt.gob.es