Fake Tax Office Scams in Spain
Criminals impersonating the Agencia Tributaria (AEAT) demand immediate payments or personal data from Spanish taxpayers via email, SMS and phone.
Part of: Fake Tax Office Scams
Last reviewed: 1 June 2026
The Agencia Tributaria (AEAT), Spain's tax authority, is one of the most impersonated institutions in Spanish cybercrime. Fraudulent emails and SMS messages claiming to be from the AEAT surge around income-tax filing season (April–June) and October when annual tax settlements are issued, exploiting legitimate concerns about tax compliance.
The AEAT publishes frequent warnings through its 'Buzón de fraude' tool, but the volume of attacks remains high. Victims who respond risk surrendering payment-card numbers, banking credentials or NIF/NIE identity numbers that enable further fraud.
How this scam works on Spain
Smishing messages claim a tax refund of €300–€600 is waiting and provide a link to a spoofed AEAT portal requesting banking details to process the transfer. In reality, credentials entered are harvested for account takeover.
Alternatively, vishing calls warn of an overdue tax bill that will result in an embargo on the victim's bank account unless immediate payment is made by credit card over the phone. The caller uses partial personal information — perhaps a real NIF — to appear credible.
In a newer variant, victims receive a real-looking AEAT notification via the Cl@ve system (Spain's official electronic ID) — a spoofed version — directing them to renew their digital certificate through a phishing site.
Common red flags
- Unexpected tax-refund notification sent via SMS or unsolicited email
- Link in message does not lead to the official sede.agenciatributaria.gob.es domain
- Request for bank details or card number to process a refund
- Threat of immediate bank embargo unless payment is made by phone
- Caller or email uses pressure and urgency to prevent you from consulting anyone
- Official-looking Cl@ve notification from an address that is not genuinely cl@ve-managed
How to protect yourself
- Access AEAT communications only through sede.agenciatributaria.gob.es — type the URL manually
- Real AEAT refunds are credited automatically to the bank account on file — no action is required
- Call AEAT on 91 290 13 40 to verify any suspicious contact
- Report phishing emails using the AEAT 'Buzón de fraude' at agenciatributaria.gob.es
- Never provide card or banking details over the phone to anyone claiming to be AEAT
How to report it
- AEAT fraud mailbox: agenciatributaria.gob.es — 'Buzón de fraude' online submission
- Policía Nacional: denuncias.policia.es — online cyber-fraud complaint
- INCIBE (cybersecurity institute): incibe.es — report phishing incidents
Frequently asked questions
How does the real Agencia Tributaria contact taxpayers in Spain?
The AEAT sends formal notices to your registered address or through the official electronic notification system accessed at sede.agenciatributaria.gob.es. It never asks for bank details by SMS or demands immediate phone payments.