Fake traffic fine by SMS: what to do and how to check if it's real

"DGT: you have an unpaid penalty. Pay today with a 50% discount and avoid the surcharge." Plus a link. It arrives on an ordinary Tuesday, and your first thought is whether that motorway speed camera caught you. That doubt is exactly what the scammer is after. This is a fake traffic fine sent by SMS, one of the smishing campaigns that keeps coming back in Spain (the DGT is the Dirección General de Tráfico, Spain's national traffic authority; elsewhere the same scam uses your own country's traffic agency, police or toll operator). Its goal isn't to collect the fine: it's to get you to type your full card details into a website that imitates the authority.

The good news is that one rule takes it apart: the traffic authority does not ask you to pay a fine through a link in a text message. If you want to know whether you have a real penalty, you can check in a minute through the official channels, without tapping anything you were sent.

How does the fake fine scam work?

The script repeats with few variations:

• An authority that commands respect. Almost always the DGT, sometimes a city council, the "local police", a toll motorway or a low-emission zone. All bodies you could believably receive a penalty from.
• A plausible amount. Real fine amounts for speeding or parking, so it raises no suspicion.
• A discount with a deadline. They copy a real rule: in Spain, many fines can be paid with a 50% reduction within 20 calendar days of notification. The scammer turns it into urgency bait: "today only", "final notice", "before seizure".
• A link to a cloned website. Logos, colours and text copied from the official site. They ask for your number plate or ID number to "find the fine", then your card to pay it.

Often the fake site then asks for a code sent to you by SMS. That code doesn't confirm paying the fine: it authorises a much larger charge or adds your card to the scammer's digital wallet. With your personal details they can also call you days later posing as your bank, knowing enough to sound credible.

How do I recognise the fake SMS?

Watch for these signs. Any single one is reason enough for suspicion:

• It includes a payment link. This is the decisive sign. Real fine notifications in Spain arrive by registered post or through the Dirección Electrónica Vial (DEV, the DGT's official electronic mailbox), and are checked on the DGT's official e-services site, not via a link in an unexpected message. Elsewhere, real fines also come through official, traceable channels.
• The domain isn't the official one. The DGT's website ends in dgt.es or a .gob.es domain. Be wary of addresses with added hyphens or words ("dgt-multas", "pago-sanciones"), odd extensions or link shorteners.
• It gives no specifics. A real notification identifies the case file, date, place and vehicle. The fake SMS talks about "your fine" generically because it knows nothing about you.
• It rushes and threatens. Immediate surcharges, a frozen bank account, lost licence points or an impounded car "if you don't pay today". The administration works with legal deadlines, not ultimatums measured in hours.
• You get it even without a car. The messages are sent in bulk. If you don't drive, you already have your answer.
• The sender proves nothing. The name "DGT" in the sender field can be spoofed, and the fake message can even appear in the same thread as earlier genuine alerts.

How do I check whether I have a real fine?

Without tapping the link, on your own:

1. Close the message. Don't reply or tap anything, not even to "unsubscribe".
2. Go to the official channel yourself: type the DGT's address (dgt.es) into your browser and go to its e-services site, or open the official miDGT app downloaded from your phone's official store. Elsewhere, type in your traffic authority's official address yourself.
3. Check your penalties by logging in with Cl@ve, a digital certificate or your electronic ID (Spain's official digital identification systems). There you'll see any fines notified to you and can pay them with whatever discount applies.
4. Also check the Tablón Edictal Único (the official notice board published by the BOE, Spain's official gazette) if you're worried about a notification that never reached you: penalties that couldn't be delivered are published there.
5. If the fine is municipal, check it on your city council's official website. In Catalonia and the Basque Country some penalties come from their own regional traffic authority, which also has an official website.

If nothing shows up in any of those channels, the SMS was fake. It's the same sequence that works for checking a parcel notice or a text from your bank: close the message and go in yourself through the official door.

What do I do if I already entered my card?

Act in this order, the sooner the better:

1. Call your bank on the number on the back of your card or in its official app. Ask them to block the card and issue a new one.
2. Say if you gave a code. If you entered a code sent to you by SMS, tell the bank explicitly: a charge may already be authorised or your card added to someone else's phone.
3. Review your transactions over the coming weeks and turn on charge notifications in your bank's app. Fraudulent charges sometimes arrive days later.
4. If you gave your ID number or personal details, distrust later calls "from the bank" or "from the police" asking you to move money or share passwords. No bank asks for that.
5. If you paid by Bizum (Spain's instant mobile payment service) or bank transfer, tell the bank anyway: recovery options are more limited, but the sooner they know, the better. We explain it in how to recover money lost to a phone scam.

Where do I report it?

• Report it to the police: in Spain, the Policía Nacional (091) or the Guardia Civil (062); elsewhere, your national police. Bring screenshots of the SMS, the link and the receipts for any charges. Banks usually ask for that police report to process a claim.
• Get guidance: in Spain, call INCIBE's 017, the free and confidential cybersecurity helpline; its citizen service, OSI, publishes alerts about these campaigns when they are detected. Elsewhere, contact your national cybersecurity agency.
• Call 112 only for a genuine emergency; for a scam that has already happened, the route is a police report.
• Report the number in the spam number directory so others can recognise it.

Frequently asked questions

Does the DGT really send text messages? It may send you alerts if you've signed up to its services, for example to tell you there's a notification waiting in the DEV. But that alert doesn't ask you to pay through a link: it tells you to check for yourself on the official site or app.

I do have a real fine and the SMS matches. Could it be genuine? A match proves nothing: with millions of drivers, guessing right by chance is easy. Check the case file on the DGT's official site and pay only from there.

I only tapped the link and typed nothing. Am I at risk? The main risk lies in the data you enter. Close the page, don't download anything it offers and keep your phone updated. If you didn't type any details, all that's left is to delete the message and report it.

What if it comes by email or WhatsApp? It's the same scam on another channel, just like the fake DGT fine SMS we analyse on the blog. The defence doesn't change: never pay from the link you received; check for yourself on the official channel.

In short

A real fine is checked and paid through official channels, never from a link sent to you by SMS. If in doubt, close the message, go to the DGT's official site or miDGT yourself (or your own country's traffic authority) and check. If you already entered your card, call your bank now and report it. And if one of these texts reached you, report it in the NoCall spam number directory: your report may be what stops the next person before they pay a fine that doesn't exist.