The National Cybersecurity Institute has warned of a new smishing campaign that impersonates the Tax Agency to try to steal users' personal and banking data.
The hook of the fraud is a supposed refund of money. The contradiction is in the message itself, because it is presented as a tax notice to collect income, but its real purpose is for the victim to hand over sensitive information.
Incibe warned on May 27 of a campaign impersonating the Tax Agency
The warning was published on May 27, 2026, and places the fraud in the realm of smishing, a type of scam distributed through mobile phone messages.
In this case, cybercriminals pose as the Tax Agency. The message uses a money refund as a pretext to build trust and push the user to act quickly.
The fraud seeks to have the victim hand over personal and banking data
The objective of the campaign is not to process any refund, but to obtain information from the victims. Incibe warns that attackers try to obtain users' personal and banking data through this impersonation.
The mechanism combines a sender that appears to be official with a promise of payment. Thus, a message that seems linked to tax management ends up becoming a way to capture credentials and financial information.
The alert disseminated on May 27, 2026, expressly identifies a smishing campaign that impersonates the Tax Agency and uses a supposed money refund as a lure.