This Wednesday the campaign for the declaration of the Income 2023 which will end next 1st of July. During these three months, scams that use the Income Tax campaign as a hook to deceive their victims will multiply. Usually, through sending mass communications by email and SMS in which the identity and image of the State Tax Administration Agency is supplanted and reference is made to alleged tax refunds and refunds, but whose objective is to obtain the victim's personal and banking data. These are identity theft tactics known as phishing If the medium is email and smishing if the contact is made through an SMS.
The Tax Agency warns on its website of the danger they pose and offers a series of tips so that taxpayers do not fall into this type of deception. It also clarifies a very important point such as the web addresses it uses, 11 in total, and which are the only ones in which procedures can be carried out with it that involve payments. Identity phishing techniques usually direct the victim to fraudulent web pages with web addresses similar to those used by the entity they want to impersonate, but not the same. In other cases, it may consist of tricking the victim into downloading a file infected with a virus.
The organization also offers a list of fraud attempts detected classified by year. For example, you can see those for 2024, 2023 and other years.
Detecting phishing: what the Tax Agency never does
The administrative entity has very regulated processes for communicating with taxpayers that facilitate the detection of fraud attempts. Thus, the Tax Agency recalls a series of supposed procedures or procedures that were They are usually required by cybercriminals, but they do not coincide with their way of proceeding in communications.. These are:
- The Tax Agency never requests confidential, financial or personal information, account numbers or card numbers by email.
- Never attach attachments with invoice information or other types of data.
- It never makes refunds to credit or debit cards.
- It never charges any amount for the services it provides. The person who uses them will only assume the shared cost of calls to 901 telephones.
The recommendations of the Tax Agency to avoid falling into deception
Upon receipt of a fraudulent email or SMSthe public body recommends:
- Do not open messages from unknown or unsolicited users.
- Do not respond under any circumstances to these messages.
- Be careful when following links in emails, even from known contacts. The same applies to SMS.
- Be careful when downloading email attachments, even from known contacts.
These are the web addresses used by the Tax Agency
Cybercriminals use fraudulent websites with names similar to Agenciatributaria.es, so It is important to know which web addresses the organization uses and be aware that if a fraudulent email or SMS sends you to a supposed Tax Agency URL that does not exactly match any of them, then it is a scam.
The entity not only uses the aforementioned web address, which corresponds to the Tax Agency Portal, but also also 10 other domains used by its electronic headquarters. The complete list of Tax Agency domains that correspond to websites where payments can be made is the following:
- www.agenciatributaria.es.
- headquarters.agenciatributaria.gob.es.
- www.agenciatributaria.gob.es.
- www1.agenciatributaria.gob.es.
- www2.agenciatributaria.gob.es.
- www3.agenciatributaria.gob.es.
- www6.agenciatributaria.gob.es.
- www8.ia.agenciatributaria.gob.es.
- www9.agenciatributaria.gob.es.
- www10.agenciatributaria.gob.es.
- www12.agenciatributaria.gob.es.