In short
Emails impersonating tax agencies, such as AEAT in Spain, HMRC in the UK or the SII in Chile, spike every tax season. They promise a refund, warn about a debt or a problem with an invoice, and lead to a fake page asking for your tax login or card details, or to a file with malware. The safest rule is to never use the link in the email: type the agency's address yourself and check your notifications there.
Why tax agencies are impersonated so often
Every person and business deals with the tax agency, its notices create urgency, and almost nobody dares to ignore an alleged debt. Campaigns cluster around the dates when people expect news: the income tax season (April to June in Spain, January in the UK for Self Assessment, April in Chile), plus monthly and quarterly VAT deadlines.
Agencies themselves publish warnings: Spain's Agencia Tributaria keeps a page of impersonation alerts on its website, HMRC publishes examples of scam emails and texts, and Chile's SII and national CSIRT have warned about campaigns claiming problems with electronic invoices that distribute malware.
The most common lures
| Lure | What they ask for | How it really works |
|---|---|---|
| "You have a pending refund" | Your card details so they can pay it | Refunds go to the account on file; agencies don't ask for card details |
| "You have an outstanding debt" or "seizure notice" | Immediate payment through a link | Debts are checked and paid on the official website |
| "Problem with your e-invoice or VAT return" | Download a file or "fix it" through a link | Real notices are checked on the official site after logging in |
| "Official notification" | Open a PDF, ZIP or link to read it | In Spain, electronic notifications arrive in the e-office or the authorized electronic address (DEH) |
| "Update your details" | Your tax login credentials | No legitimate sender asks for your password by email |
Warning signs
- The sender doesn't end in the official domain (for example agenciatributaria.gob.es, gov.uk or sii.cl), even if the display name says "Tax Agency" or "HMRC".
- The link goes to another domain. Hover over it before clicking.
- A very short deadline: "if you don't settle within 24 hours, a fine will be applied".
- A compressed attachment, an .html file or a PDF asking you to "enable content".
- They ask for your tax login, banking password or card details.
- Details that don't match your situation, like a refund you never claimed.
Today's fraudulent emails are usually well written and use official logos. Spelling is no longer a good clue; the link's domain and what they ask you for are.
How to verify a real notice
- Don't click anything in the email. Open your browser and type the official address yourself.
- Log in and check your notifications, debts or pending procedures.
- If there's nothing there, the email was fake. If in doubt, call the official helpline using the number on the website, not the one in the email.
What to do if you already clicked
| What you did | What to do now |
|---|---|
| Entered your tax login | Change it immediately on the official site and check nothing was filed in your name |
| Entered your card details | Call your bank to block the card and check your transactions |
| Opened an attachment | Disconnect the computer from the network and have it checked; it may have malware |
| Entered your email password | Change it and check the mailbox's forwarding rules and filters. Guide: compromised email account |
To report it: in Spain, contact INCIBE on its free 017 helpline; in the UK, forward suspicious HMRC emails to phishing@hmrc.gov.uk and report scams to the National Cyber Security Centre at report@phishing.gov.uk; in Chile, report to the National Cybersecurity Agency's CSIRT. At work, always tell your IT team, since the same email probably reached other people.
How to protect a business or a server
These campaigns get past many filters because they use freshly registered domains, legitimate rented servers and pages that only show the fake content to some visitors. A rule-based filter like SpamAssassin rarely catches them. What works is checking where the links lead and comparing the sender with the agency it claims to be.
Clisec checks every inbound email at the SMTP layer: it verifies SPF, DKIM and DMARC, rates the sender's reputation and inspects links, destination pages and attachments before delivery. It protects every account on the cPanel server with no MX record changes.
More background in credential phishing and malicious attachments.
Frequently asked questions
Do tax agencies send emails with links?
Some send informative emails, but the safe way to check any notice is to go straight to the official website by typing the address. Never enter your login through a link in an email.
How do I know if a message from the Spanish Agencia Tributaria is real?
Go to its e-office by typing the address, or use the official app, and check your notifications. If the notice isn't there, the email was fake.
Where do I report a fake HMRC email?
Forward it to phishing@hmrc.gov.uk. You can also report it to the National Cyber Security Centre at report@phishing.gov.uk.
Why didn't my spam filter catch the fake email?
Because it arrives in small batches, from new domains and servers with a good reputation, and the content looks like a real notice. Catching it takes analyzing the links and destination pages, not just the text.
Protect inbound email on your whole server
Clisec inspects links and their destination pages before delivering each email, for every account on your cPanel server.