Fake Tax Office Scams in Belgium
Fraudsters impersonate the SPF Finances / FOD Financiën to extort EUR payments or steal itsme credentials from Belgian residents.
Part of: Fake Tax Office Scams
Last reviewed: 1 June 2026
SPF Finances (French) / FOD Financiën (Dutch) impersonation is a persistent phishing pattern in Belgium. Scammers send SMS or emails claiming tax refunds or debts, directing victims to fake portals designed to steal itsme digital-identity credentials or card numbers.
itsme is Belgium's primary digital authentication solution, linked to banking, government services, and contracts. Unauthorised access to itsme can allow attackers to sign documents, authorise bank transfers, and access public-sector accounts. The Centre for Cybersecurity Belgium (CCB) has issued multiple warnings about this campaign type.
How this scam works on Belgium
A phishing SMS claims a tax refund of EUR 200–600 is available, with a link to a convincing lookalike of the Tax-on-web portal. The page requests itsme login, capturing credentials the attacker uses to authorise a bank transfer.
Phone variants feature bilingual callers (French or Dutch) claiming a specific tax underpayment and threatening legal proceedings unless EUR is transferred immediately to a 'special government account'.
Email campaigns attach fake tax-assessment PDFs with official-looking SPF/FOD letterheads, instructing recipients to pay via wire or upload banking credentials to a 'secure government portal'.
Common red flags
- SMS about a tax refund with a login link — SPF Finances uses Tax-on-web (myminfin.be), not SMS links
- itsme prompt initiated on a page reached via an unsolicited message
- Caller demands immediate EUR payment to a non-official bank account number
- Email from a non-.belgium.be domain claiming a large refund or urgent debt
- Request to read your itsme code aloud or share it with a caller
- Urgency framing with threats of immediate legal action
How to protect yourself
- Access tax matters only at myminfin.be typed directly
- Never approve an itsme request you did not personally initiate
- Verify any alleged tax matter by logging into MyMinfin via your own bookmark
- Hang up and call SPF Finances at 0257 257 57 to verify any caller's claim
- Report suspicious messages by forwarding SMS/email to [email protected]
- Enable itsme notification alerts for all authentication events
How to report it
- Forward suspicious messages to [email protected] (CCB automated phishing intake)
- File a complaint at police.be
- Contact your bank if itsme was misused to authorise a transaction
Frequently asked questions
What is the safeonweb.be reporting address used for?
It is the Centre for Cybersecurity Belgium's automated phishing intake. Forwarding suspicious emails and SMS there helps CCB track and block fraudulent campaigns targeting Belgian residents.