Scam Radar

How can you recognize FinanzOnline Phishing — Fake Tax Refund in Austria?

Published

TLDR

Email or SMS imitates FinanzOnline (Austrian Federal Ministry of Finance) and announces a tax refund of EUR 137–687. Link leads to finanzonline rueckzahlung.at (genuine: finanzonline.bmf.gv.at). Requests SVNR (social insurance number),...

How it works

Email or SMS imitates FinanzOnline (Austrian Federal Ministry of Finance) and announces a tax refund of EUR 137–687. Link leads to finanzonline rueckzahlung.at (genuine: finanzonline.bmf.gv.at). Requests SVNR (social insurance number),...

Red flags

  • Urgent pressure to click, pay, or share codes immediately.
  • A link or sender that does not match the official organization.
  • Requests for card data, passwords, OTPs, wallet signatures, or bank transfers.

What to do

  1. 1Indicators: 1) FinanzOnline never sends emails with clickable links; 2) domain is not .gv.at; 3) SVNR and IBAN requested simultaneously; 4) pressure through a short deadline.
  2. 2IN CASE OF FRAUD: Block ID Austria via oesterreich.gv.at, report to CSIRT AT (csirt@cert.at), file a complaint with the police.

Source

BSI

Source reviewed by Mythos Forensic Team

https://www.bsi.bund.de/

FAQ

Is FinanzOnline Phishing — Fake Tax Refund in Austria a real scam pattern?

Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.

What are the first warning signs?

Urgent pressure to click, pay, or share codes immediately.; A link or sender that does not match the official organization.; Requests for card data, passwords, OTPs, wallet signatures, or bank transfers.

What should I do first?

Indicators: 1) FinanzOnline never sends emails with clickable links; 2) domain is not .gv.at; 3) SVNR and IBAN requested simultaneously; 4) pressure through a short deadline.; IN CASE OF FRAUD: Block ID Austria via oesterreich.gv.at, report to CSIRT AT (csirt@cert.at), file a complaint with the police.

Can LegalAudit check my case?

Yes. Start a free chat and paste the message, link, sender, or payment details for triage.