Drivers in Spain are being warned about a new wave of highly convincing messages that impersonate the country’s traffic authority and threaten victims with rapidly increasing fines.
The National Cybersecurity Institute (INCIBE) has identified fraudulent emails and text messages claiming to have been sent by the Directorate-General for Traffic (DGT).
The messages tell recipients that they have an unpaid traffic fine or that an enforcement file requires their urgent attention.
Some warn that a €100 penalty has already increased to €200 and will rise again to €400 unless payment is made within 24 hours.
Victims are then encouraged to follow a link to review the supposed case or take advantage of a last-minute discount.
However, the links lead to fake websites designed to steal personal and banking information.
How the scam works
The fraudulent pages closely copy the DGT’s official branding, including its logos, colours and website menus.
Some victims are first shown a box reading ‘Secure access: click to confirm’, although this does not mean that the website is genuine.
The page then requests the driver’s name, surname and vehicle registration number under the heading ‘Penalty pending regularisation’.
After these details have been entered, a realistic-looking speeding fine is generated, complete with a case number, barcode and references to Spanish traffic laws.
The fake penalty demands €140 but offers to reduce it to €70 if payment is made that day.
Victims who continue are taken to a ‘secure payment’ form requesting the cardholder’s name, bank card number, expiry date and CVV security code.
INCIBE stressed that the use of official logos, payment provider branding and the words “secure payment” does not make the website legitimate.
The objective of the campaign is to obtain enough personal and banking information to use victims’ cards or commit further fraud.
How the DGT actually issues fines
The DGT does not notify drivers of fines by ordinary email or text message.
Traffic penalties are normally sent by post or delivered through the official Electronic Road Address system, known as DEV.
Drivers registered with DEV may receive an email or SMS alerting them that a new notification is available. However, the message will not direct them to an unofficial website demanding an immediate card payment.
Anyone concerned about a possible fine should access the DGT website or MiDGT app independently instead of following a link contained in a message.
Common warning signs include spelling mistakes, sender addresses that do not use an official DGT domain, extreme urgency and threats of steep increases if payment is not made immediately.
What to do if you receive one
Anyone who receives one of the messages should avoid replying, opening the link or entering any information. The sender should be blocked and the message deleted after being reported to INCIBE.
If the fraudulent website has already been opened, it should be closed without completing any forms.
Victims who entered their card details should contact their bank immediately, explain what happened and ask for the card to be blocked. INCIBE warns that they should not wait for an unauthorised charge to appear before taking action.
Screenshots, links and copies of the messages should be preserved as evidence before the incident is reported to the Policia Nacional or Guardia Civil.
INCIBE’s Cybersecurity Helpline can also provide specialist advice by calling 017.
