Got a message from Hacienda by email or SMS? How to tell if it’s fake
The Agencia Tributaria keeps a list on its website of the fake emails and texts that use its name, and the 2026 list already has a bit of everything: “tax refund” texts quoting a specific amount, notices saying “your tax return has been processed”, emails asking for a supposed settlement to be paid in cryptocurrency and, in March, an “electronic invoice notification” email leading to a fake copy of DEHú (the government’s electronic notification site) to steal usernames and passwords.
That last one worries us most for businesses. With VeriFactu three months away and e-invoicing between businesses on its way, an email about “your invoices” that comes “from Hacienda” won’t surprise anyone. That is exactly why it works.
What Hacienda never asks you for
The Agencia Tributaria says it in its own warning: it never asks by email, SMS or Bizum for confidential, financial or personal information, account numbers or card numbers, and it doesn’t send attachments with invoice information. If a message asks for any of those, it is fake, whoever it claims to be from.
Four habits for your business
- Don’t tap the link in the message. If you want to check something, go in yourself by typing the address of the official site (sede.agenciatributaria.gob.es) or through the official app. Real notifications can be checked there or on DEHú.
- Decide who looks at messages from Hacienda. If your accountant (gestoría) receives them, make sure the rest of the team knows that anything “from Hacienda” gets forwarded to that person and nothing else.
- Be careful with the digital certificate. If it is installed on the till computer or on one everybody uses, anyone who falls for a scam opens the door. Better on a machine with its own user and password.
- Keep backups that get tested. Many of these scams end up installing something on the computer. If that happens, what saves you is a recent backup that has actually been restored as a test.
If you’re unsure about a message, INCIBE’s 017 helpline answers cybersecurity questions free of charge and in confidence.