A fake Hacienda text is convincing taxpayers to hand over bank details

You glance at your phone and see a new message from Hacienda and at this time of year, that hardly seems unusual.

Spain’s income tax campaign is drawing to a close, millions of people are checking their tax returns and many are waiting to find out whether they will receive money back.

That is exactly why a new scam is attracting attention.

The message appears to come from Spain’s Tax Agency, known as the AEAT. It refers to an official notification and includes a link that recipients are encouraged to open.

On the surface, it looks like the sort of message many taxpayers might genuinely expect to receive.

What makes the scam particularly convincing is that some recipients have reported seeing it appear alongside previous communications from Hacienda, making it seem even more authentic.

The message is not from the Tax Agency at all. It is part of a phishing scam designed to collect personal and banking information from unsuspecting taxpayers.

Why the message looks more convincing than most scams

Most people like to think they would spot a scam immediately. We tend to imagine suspicious messages full of spelling mistakes, strange wording and obvious warning signs.

The reality is often very different. Modern scams are becoming increasingly polished, and criminals know exactly how to imitate organisations people already trust.

In this case, recipients receive a text message claiming that there is an official communication waiting for them from the Tax Agency.

The timing alone makes it believable. Many people are already checking for updates about refunds, payments or the status of their tax return.

Curiosity does the rest. A person receives the message, wonders whether there is something important to review and clicks the link.

That is where the scam begins.

What happens after you click the link

Anyone who follows the link is redirected to a website designed to resemble an official Tax Agency page. The site reportedly displays the AEAT logo and refers to information linked to a possible tax refund.

For someone quickly checking their phone, nothing may immediately seem out of place. The page then asks the user to enter personal information.

According to reports, victims may first be asked for identification details such as their DNI.

Further into the process, the site attempts to obtain banking information and that is the real objective.

The promise of a refund is simply a way of persuading people to hand over sensitive information that criminals can later exploit.

Cybersecurity specialists have long advised people not to trust links received through unexpected text messages, even when those messages appear to come from a familiar organisation.

Instead, they recommend accessing official services directly through the genuine website or application. That extra step may take a few moments longer, but it removes the uncertainty surrounding any message received by SMS.

What to do if you have already entered your details

Not everyone realises straight away that they have landed on a fraudulent website.

Sometimes it only becomes clear afterwards.

If banking information has already been shared, experts recommend acting quickly.

The first step is to contact your bank and explain exactly what information has been provided.

Depending on the circumstances, the bank may advise blocking cards, monitoring transactions or taking additional security measures.

Anyone who used a password that is also linked to online banking, email accounts or other important services should change those passwords immediately.

Security experts also recommend keeping a close eye on bank accounts over the following days in case of suspicious activity.

Another important point is that scammers sometimes return for a second attempt.

Once criminals know someone has interacted with a fraudulent message, they may try again through emails, phone calls or additional text messages.

That is why experts advise treating any unexpected communication with caution, especially if it requests personal or financial information.

The timing of the scam is no coincidence. With the income tax campaign nearing its end, many taxpayers are already expecting messages from Hacienda.

Scammers know that a message about a tax refund is far more likely to attract attention than a random text arriving at another time of year.

For that reason, the safest habit remains a simple one. If a message claims to come from the Tax Agency, avoid clicking the link and check directly through the official AEAT website or app instead.

It is a small precaution that can prevent a much bigger problem later on.