Fake Tax Office Scams in Belgium
Fraudsters impersonate the SPF Finances / FOD Financiën to extort EUR payments or steal itsme credentials from Belgian residents.
Part of: Fake Tax Office Scams
Last reviewed: 1 June 2026
SPF Finances (French) / FOD Financiën (Dutch) impersonation is a persistent phishing pattern in Belgium. Scammers send SMS or emails claiming tax refunds or debts, directing victims to fake portals designed to steal itsme digital-identity credentials or card numbers.
itsme is Belgium's primary digital authentication solution, linked to banking, government services, and contracts. Unauthorised access to itsme can allow attackers to sign documents, authorise bank transfers, and access public-sector accounts. The Centre for Cybersecurity Belgium (CCB) has issued multiple warnings about this campaign type.
How this scam works on Belgium
A phishing SMS claims a tax refund of EUR 200–600 is available, with a link to a convincing lookalike of the Tax-on-web portal. The page requests itsme login, capturing credentials the attacker uses to authorise a bank transfer.
Phone variants feature bilingual callers (French or Dutch) claiming a specific tax underpayment and threatening legal proceedings unless EUR is transferred immediately to a 'special government account'.
Email campaigns attach fake tax-assessment PDFs with official-looking SPF/FOD letterheads, instructing recipients to pay via wire or upload banking credentials to a 'secure government portal'.
Common red flags
- SMS about a tax refund with a login link — SPF Finances uses Tax-on-web (myminfin.be), not SMS links
- itsme prompt initiated on a page reached via an unsolicited message
- Caller demands immediate EUR payment to a non-official bank account number
- Email from a non-.belgium.be domain claiming a large refund or urgent debt
- Request to read your itsme code aloud or share it with a caller
- Urgency framing with threats of immediate legal action
How to protect yourself
- Access tax matters only at myminfin.be typed directly
- Never approve an itsme request you did not personally initiate
- Verify any alleged tax matter by logging into MyMinfin via your own bookmark
- Hang up and call SPF Finances at 0257 257 57 to verify any caller's claim
- Report suspicious messages by forwarding SMS/email to [email protected]
- Enable itsme notification alerts for all authentication events
How to report it
- Forward suspicious messages to [email protected] (CCB automated phishing intake)
- File a complaint at police.be
- Contact your bank if itsme was misused to authorise a transaction
Frequently asked questions
How do I verify a claimed Belgian tax debt without clicking a link?
Log into myminfin.be by typing the address directly and check your account status there instead of following any link in an email or SMS. You can also call SPF Finances directly to confirm any liability.
I was asked to read my itsme code aloud to a caller claiming to be from SPF Finances — did I make a mistake?
Yes, sharing an itsme code with anyone, including someone claiming to be a tax official, can allow them to authorise actions on your behalf. Contact your bank and itsme support immediately to secure your account.
Does SPF Finances ever threaten immediate legal action over the phone?
No — official Belgian tax matters proceed through formal written correspondence, not urgent phone threats demanding immediate payment. Treat any such call as fraudulent and verify independently.
What is the safeonweb.be reporting address used for?
It is the Centre for Cybersecurity Belgium's automated phishing intake. Forwarding suspicious emails and SMS there helps CCB track and block fraudulent campaigns targeting Belgian residents.