TLDR
Email or SMS impersonates the Tax Agency (Agencia Tributaria) announcing an IRPF refund of EUR 137 587. The link leads to agenciatributaria devolucion.es (real: agenciatributaria.gob.es). It requests DNI (Spanish national ID), IBAN,...
How it works
Email or SMS impersonates the Tax Agency (Agencia Tributaria) announcing an IRPF refund of EUR 137 587. The link leads to agenciatributaria devolucion.es (real: agenciatributaria.gob.es). It requests DNI (Spanish national ID), IBAN,...
Red flags
- Urgent pressure to click, pay, or share codes immediately.
- A link or sender that does not match the official organization.
- Requests for card data, passwords, OTPs, wallet signatures, or bank transfers.
What to do
- 1Indicators: 1) The Tax Agency (Hacienda) never requests data by email; 2) the domain does not end in .gob.es; 3) it requests CVV and expiration date (the Tax Agency never does); 4) 24 hour deadline.
- 2IF YOU ARE A VICTIM: block your card, change your Cl@ve PIN, report to the National Police GDT (gdt.guardiacivil.es) and report to INCIBE 017.
Source
FAQ
Is Fake Tax Agency — IRPF refund of EUR 437.82 a real scam pattern?
Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.
What are the first warning signs?
Urgent pressure to click, pay, or share codes immediately.; A link or sender that does not match the official organization.; Requests for card data, passwords, OTPs, wallet signatures, or bank transfers.
What should I do first?
Indicators: 1) The Tax Agency (Hacienda) never requests data by email; 2) the domain does not end in .gob.es; 3) it requests CVV and expiration date (the Tax Agency never does); 4) 24 hour deadline.; IF YOU ARE A VICTIM: block your card, change your Cl@ve PIN, report to the National Police GDT (gdt.guardiacivil.es) and report to INCIBE 017.
Can LegalAudit check my case?
Yes. Start a free chat and paste the message, link, sender, or payment details for triage.