Published on November 3, 2026 · The mitza.es team
SMS may look like old technology, but it is still a very effective channel for scammers: it lands on your phone with a sense of urgency, many people open it without thinking and it is rarely reviewed with a cool head. This spring and summer the Spanish press has reported three campaigns impersonating Spain's traffic authority (DGT), Correos (Spain's postal service) and Spain's tax agency (AEAT). The technical name is smishing. This guide explains how these campaigns work, which signs give the deception away and what a small business or a freelancer should do, because a company's phones and cards are as valuable a target as an individual's.
What smishing is
INCIBE (Spain's national cybersecurity institute) defines smishing as a form of fraud in which criminals try to deceive people through SMS messages with fraudulent links to obtain personal or financial data. It is the text-message equivalent of email phishing: a notice that appears to come from a known organisation, a link to a fake website and a form that asks for details. If you want to see how these scams are evolving with artificial intelligence, read our article on AI phishing and deepfakes.
Three campaigns in Spain in 2026
The fake DGT fine (May 2026)
As Que.es reported on May 13, thousands of people received an SMS that appears to come from the DGT: it warns of a pending fine and threatens a surcharge if it isn't paid within a set number of hours (24 in the case described). The link leads to a website that imitates the DGT's electronic office and asks for the card number, the expiry date and the security code. With that data the account is emptied or purchases are made. According to the same outlet, the DGT has denied the campaign and notifies penalties by registered mail or through the Electronic Road Address (Dirección Electrónica Vial), never with a payment link in an SMS.
The Correos parcel that “can't be delivered” (June 2026)
A message with the sender name “CORREOS” says that the parcel can't be delivered because of an address error or outstanding fees, and asks for a small payment, 1.99 or 2.50 euros according to Que.es (June 4). The clone website copies the look of the official one, asks for name, address and the full card details, and that token amount is the excuse: what gets stolen is the card. The same article cites INCIBE as saying that parcel-related smishing grew by 400% between 2023 and 2025.
The fake tax agency refund (July 2026)
According to Que.es (July 10), SMS messages are arriving from senders pretending to be “AEAT” or “Hacienda” with a very effective bait: “you have been selected for a refund of 500 euros”. The link imitates the electronic office and asks for the account number and the login credentials. The tax agency insists, according to that outlet, that it never asks for the account number or the access password by SMS, and that it doesn't announce refunds by text message: you check them in the electronic office, with a digital certificate or Cl@ve, typing the address yourself.
Warning signs (according to INCIBE)
- Unknown sender or one that doesn't match the organisation it claims to represent.
- Odd grammar or spelling mistakes that a serious organisation wouldn't make (although some scams are well written).
- Unusual requests: data that a legitimate company would never ask for by SMS.
- Suspicious links that lead to unknown websites or to app downloads.
- Urgency or threats to make you act without thinking.
We add one of our own, based on common sense: any message that asks you to pay by card through a link in an SMS you weren't expecting should be treated as fake until you check it another way.
Why the fake message can look genuine
The name shown as the sender of an SMS can be forged, so the fraudulent message can appear in the same conversation as the legitimate messages from Correos, your bank or another organisation. That is why trusting that “the sender is the right one” isn't enough. What does work is never going in through the link: type the organisation's address yourself, open its official app or call it on a number you already have.
Why this is a problem for your business
- Company accounts and cards: if someone enters the details of a corporate card or the online banking credentials, the damage isn't personal, it is the company's.
- Work phones: a malicious link can install apps or steal credentials for email, WhatsApp or the cloud.
- Impersonation of your brand: criminals can send SMS messages that imitate yours and your customers will blame you.
- A longer chain: stolen credentials are often the first step of bigger attacks, such as ransomware.
A simple protocol for your team
- Golden rule: nobody pays or enters details from a link received by SMS. Always go in through the official website or app.
- Two-step verification on online banking, email, the cloud and social networks, so that a stolen password isn't enough. Generate long, unique passwords with our password generator.
- Bank alerts and limits: turn on notifications for every transaction and review the limits on company cards.
- Two people for important payments: one prepares and the other authorises.
- A channel for questions: anyone should be able to forward a strange message to a trusted person before acting, without fear of looking bad.
- Operating system and apps up to date on the phones the team uses.
- A regular reminder: five minutes a quarter with real examples, like these three.
What to do if someone has tapped the link or given details
- Call the bank right away to block the card and dispute the unauthorised charges; every hour counts.
- Keep evidence: screenshots of the SMS, the link and the fake website, and the receipts for the charges.
- Change the passwords of any accounts that may be compromised and turn on two-step verification.
- Report it to Spain's National Police or the Guardia Civil and notify INCIBE on 017 (also by WhatsApp on 900 116 117).
- Check the account activity over the following weeks.
- If personal data of customers or employees is involved, talk to your advisor: there may be an obligation to notify a security breach to the data protection authority within 72 hours.
If your company sends SMS messages to customers
- Always use the same sender and tell people on your website and in your emails how you communicate with them.
- Don't include card payment links in SMS messages. If it is unavoidable, point to your official domain and explain to customers how to recognise it.
- Make your messages recognisable: your trade name, a detail that only the customer knows (such as the order number) and no threatening tone.
- Give customers a channel to check whether a message is really from you.
Quick questions
Can I get the money back?
It depends on the circumstances and on how quickly you act. Contact the bank immediately, claim in writing, keep evidence and file a report. It is the route recommended by both INCIBE and the media outlets that have covered these campaigns.
Does the tax agency notify me by SMS about anything?
According to what it has told the media, it doesn't use SMS to ask for your account number or passwords, or to announce refunds. If you have doubts about a notification, go into the electronic office yourself with your digital certificate or Cl@ve.
What do I do with a suspicious message I haven't opened?
Don't tap the link, don't reply, delete it and block the number. If you want to help others, you can forward it to INCIBE.
Other scams that exploit haste
SMS is one of the doors; the others are QR codes, emails and Bizum payments. We have guides on QR code scams, on the Black Friday scams that impersonate your store and on the reverse Bizum scam.
How we can help at Mitza
We review your company's access and accounts, turn on two-step verification and help you define a protocol for your team. If you're in southern Madrid, see our IT maintenance, or write to us from the contact page.