Spain's Agencia Tributaria has issued a public warning after a spike in fraudulent SMS messages falsely claiming to come from the tax authority. The messages tell recipients that “your tax return has been processed by the tax management authorities” and link to a website that mimics the official agency. Detected during the ongoing 2026 tax season, the campaign aims to trick users into sharing sensitive information.
The Agencia Tributaria says on its official site that it never requests sensitive personal or financial data, such as bank account or card numbers, via SMS or email. Nor does it send attachments containing invoice details or other sensitive documents through these channels. The agency urges recipients not to click links and to check their tax affairs only through the official Sede Electrónica. In an October 22 notice about renewing its electronic-headquarters certificate, the agency said users could continue accessing the Sede Electrónica as usual. Taxpayers should go directly to the official service instead of following links in messages.
These scams are not new. Cybercriminals have repeatedly exploited the annual tax campaign to deceive taxpayers, often using urgent language and requests for personal data to cause alarm. Warning signs include pressure to act immediately and requests for confidential information, especially when messages come from senders that do not match official contacts.
Maldita.es has previously reported on similar scams, including emails and SMS messages promising refunds or claiming there are issues with tax returns. The pattern remains consistent: urgent language paired with requests for sensitive data, often through links to fake websites. Recent legal disputes involving public officials have also drawn attention to the risks of misinformation and impersonation, including the case in which Compromís considered legal action against Vicent Mompó over disputed testimony.
Phishing campaigns targeting tax authorities recur across Europe, especially during tax filing periods. Cybersecurity experts echo the Agencia Tributaria's advice to use only official channels, check sender details and avoid unsolicited requests for personal information. Spain's tax agency maintains a dedicated section on its website with information about current scams and how to report them. The broader cybersecurity effort was also reflected at 20ENISE, held in León from October 21 to 23, 2026, where INCIBE reported participation by 190 companies and institutions. That figure measures event attendance, not the scale of this SMS campaign.
