How to verify a notification from Hacienda or Seguridad Social

"Agencia Tributaria: you have a pending refund of 342,18 €. Confirm your bank details here." Or the reverse: "You have an outstanding debt with Seguridad Social. Avoid seizure by settling it here." Public bodies make an excellent disguise for fraud: everyone knows them, nobody wants trouble with them, and their real procedures are cryptic enough that a fake message looks plausible.

These campaigns run in waves and repeat the same skeleton as the fake DGT fine SMS and the fake parcel SMS: known entity + money pending (in your favour or against you) + urgency + link. If you learn to verify one, you verify them all.

The key rule: public bodies do not do business via links in texts

Remember two things:

1. Hacienda and Seguridad Social will not ask for your bank details, passwords or payments through a link in an unexpected text or email. Their online services run through their official electronic offices, which YOU access with your own means of identification (Cl@ve, digital certificate, DNIe).
2. A real refund does not need you to "confirm your details" from a link. If Hacienda is going to refund you money, it pays it into the account already listed on your tax return. It will not ask for a new card by text.

Any message pushing you to tap a link to collect, pay or "settle" something with a public body is suspicious by default. Not because these bodies never send communications, but because the link-as-a-channel is not how they work.

What the fake message looks like

• The refund. The most effective hook during tax season (April–June): "you have a pending refund", with a specific, believable amount. It takes you to a fake site imitating the electronic office where you enter your personal and bank details.
• The debt or seizure. "Final warning before seizure", "outstanding debt with Seguridad Social". It plays on fear instead of hope, but the destination is the same: your details and your card.
• The appointment or procedure. Variants asking you to "confirm your appointment" or "update your details" via a link. Less urgent-looking, equally fake.
• Lookalike domains. Links containing "aeat", "agenciatributaria", "seg-social" or "sede" plus hyphens and extra words, on domains that are not the official ones. The real offices end in .gob.es.
• A sender that proves nothing. As with all texts: the sender can be spoofed and proves or disproves nothing.

How to check whether anything is real

The method is the usual one: close the message and go to the official channel yourself. With public bodies it is even clearer because the official channels are unique and well known:

1. Do not tap the link. Close it.
2. Go to the official office yourself. Type the address into your browser (sede.agenciatributaria.gob.es, sede.seg-social.gob.es) or use their official apps. Do not arrive via the link in the message or a hasty search.
3. Identify yourself with Cl@ve or a certificate and check. If there is a refund, a debt, a case file or a notification, it will show up there. If nothing shows up, the message was fake.
4. If you are not comfortable with the electronic office, call the official information lines (looked up by you on the official website, not in the message) or book an in-person appointment.

If something real exists, you handle it inside the official office. Never through a link in a message. It is exactly the same habit we recommend for verifying a call or text from your bank.

What to do if you already tapped or gave details

• You only tapped and closed: almost certainly nothing happened. Block, delete and move on.
• You entered card details: call your bank now, block the card and request a new one. Watch your charges over the coming weeks.
• You entered your Cl@ve, username or office password: change your password as soon as possible from the official office and check for procedures or direct debits you do not recognise. If you gave your permanent Cl@ve PIN, renew it.
• Report it with screenshots of the message and the link. The 017 line from INCIBE gives free guidance.
• Report the number of the sender in the spam numbers directory.

Quick questions

Does Hacienda ever really send alerts by text? Hacienda may send informational notices (for example, that you have a notification available in the office), but a real notice directs YOU to go into the electronic office yourself — it does not embed a management link or ask for details in the message itself. When in doubt, treat it as unverified and check in the office.

And Seguridad Social? The same: informational communications yes, handling things via a link in an unexpected message no. The electronic notifications system (DEHú) works by you going into the portal, not by tapping links sent to you.

Are they more dangerous during tax season? Yes, because the context helps the scammer: everyone is watching their tax return and a "pending refund" fits right in. In April, May and June, be doubly suspicious of any tax message with a link.

Is an email with the official logo more trustworthy than a text? No. A logo is copied in a minute and the email sender is spoofed too. Apply the same rule: no inbound links — go to the office yourself.

If you have received one of these messages, report it in the NoCall numbers directory: these campaigns rotate their disguise with the season, and your report helps the next person recognise the pattern in time.