Hacienda alerts of a new scam that impersonates the Agencia Tributaria and seeks to empty bank accounts

New alert for digital fraud in the middle of the Income Tax campaign. The National Cybersecurity Institute (INCIBE) has detected a massive smishing campaign that impersonates the Tax Agency with the aim of obtaining personal and banking data from thousands of users through fraudulent SMS messages.

The scam is presented under the lure of a supposed pending money refund. Cybercriminals send messages that appear to come from the AEAT and in which the user is notified of an urgent notification or an available refund. The text includes a link that directs to a fake website designed to imitate the official appearance of Hacienda.

According to INCIBE, the fraud seeks to generate a sense of urgency so that the victim acts quickly without checking the authenticity of the message. Once on the website, sensitive data such as account numbers, bank cards, personal keys, or access credentials are requested with the excuse of processing the supposed deposit.

Experts remind that there are several details that allow identifying this type of deception. One of the most important is the web address. While the Tax Agency only uses official domains ending in .gob.es or .es, in this campaign, links with endings such as .top or .click have been detected, very common on fraudulent pages created to last only a few hours or days.

In addition, messages often include spelling errors, poorly worded phrases, or unusual expressions in official communications. It is also striking that many SMS messages are generic and do not include personal data of the recipient, something uncommon in real public administration notifications.

From INCIBE, they insist that the Tax Agency never requests banking information, personal keys, or card numbers via SMS or emails. Nor does it send direct links to manage money refunds. All procedures related to the Income Tax declaration must be carried out exclusively through the official electronic headquarters.

Experts recommend that, faced with any suspicious message, users avoid clicking links or downloading attachments and contact their bank directly or the Tax Agency itself to verify the information. In case of having provided personal data or suffering strange movements in the bank account, they advise blocking cards and credentials as soon as possible, in addition to filing a complaint with the authorities.

Victims can claim before their banking entity through the customer service and, if they do not receive a satisfactory response, subsequently escalate the case before the Bank of Spain providing all documentation related to the fraud.