Self-employed workers in Spain are being warned about a convincing SMS scam designed to steal their bank card details by pretending they owe money to the taxman.

Thousands of autonomos have received fraudulent messages claiming there is a discrepancy in their Social Security contributions and that an additional payment is required.

A Spanish Eye reporter was this month sent a similar SMS message, which claimed they were actually owed €300 by the tax authorities.

The messages contain a link taking victims to a fake website designed to look like Importass, the official Social Security portal.

Once there, users are told there has been a problem with their contributions and are pressured into making an immediate payment to avoid surcharges or further notifications.

One example of the scam demands just €38.74, a deliberately modest amount that cybersecurity experts say could make the supposed debt appear more believable.

The fake website then requests the cardholder’s name, card number, expiry date and CVV security code.

Confusingly, it eventually describes the charge as an ‘IRPF: supplementary payment’ – despite IRPF income tax being administered by the Agencia Tributaria, commonly known as the Hacienda, rather than the Social Security Treasury.

Josep Albors, director of research and awareness at cybersecurity company ESET Spain, said fraudsters were exploiting a procedure that autonomos already know exists.

Regularisation of Social Security contributions is genuine, making a warning about a small discrepancy potentially convincing enough to make victims act quickly without checking it first.

The Seguridad Social has stressed that it will never request payment of debts or personal information through a link sent by SMS.

Among the warning signs are suspicious web addresses containing misspellings or variations of terms such as portal, seg and social, as well as grammatical errors, mixed languages and messages creating a sense of urgency.

However, experts warn that increasingly sophisticated phishing messages can be virtually indistinguishable from legitimate communications.

Autonomos are therefore advised not to click the link at all, regardless of how convincing the message or website appears.

Instead, anyone concerned that they genuinely owe money should independently access the official Importass portal or Seguridad Social electronic headquarters and check their account there.

Those who have already entered their card details should treat the card as compromised even if no fraudulent payment has yet appeared.

They are advised to immediately block the card, contact their bank using its official telephone number and request a replacement.

Victims should also preserve screenshots and other evidence and report the scam to the Policia Nacional or Guardia Civil, while monitoring both completed and pending transactions for unauthorised payments.

Anyone who also entered online banking passwords or security credentials should change them immediately.