AEAT SMS Scam or Real Notification? How to Verify Messages from Agencia Tributaria

You receive a text message from AEAT.

It says a new tax notification is waiting for you.

Do you click it?

Maybe.

Maybe not.

Every year, scammers send fake Agencia Tributaria messages designed to steal passwords, banking details and tax credentials.

This guide explains how to tell the difference in less than a minute, what warning signs to look for, and how to verify the message safely through DEHú or the official AEAT Notifications section.

Example of a fake AEAT SMS

One common phishing message claims that Agencia Tributaria has issued a communication addressed to you. The message then includes a link that appears to be related to the Spanish Tax Agency.

Example of a phishing SMS pretending to be from Agencia Tributaria. The suspicious link does not belong to the official AEAT website.

In this example, the message includes a link to:

agenciatributariana.eu.cc

At first glance, the domain may look similar to the official AEAT name. But it is not an official government website.

Why this AEAT SMS is a scam

The official website of the Spanish Tax Agency is:

agenciatributaria.gob.es

The fake website uses a different domain:

agenciatributariana.eu.cc

There are several warning signs:

• The domain contains an extra letter in the name.
• It does not use the official Spanish government domain.
• It uses a suspicious third-party domain.
• The message pushes the user to click a link immediately.
• The message does not provide a secure way to verify the notification independently.

This technique is known as typosquatting. Scammers register domains that look similar to real websites and hope that users will not notice the difference.

New phishing campaign reported in July 2026

The phishing campaigns have not stopped. Shortly after the Q2 2026 tax filing deadline, taxpayers across Spain reported a new wave of fraudulent SMS messages impersonating Agencia Tributaria.

Example of a fake AEAT SMS reported in July 2026. The message uses another fraudulent domain that imitates Agencia Tributaria.

Unlike earlier phishing attempts, this campaign used a completely different fake domain. This is a common tactic: scammers frequently register new websites after previous ones are blocked, while keeping the wording of the message almost identical.

The timing was also significant. The messages appeared shortly after the quarterly tax filing deadline, when many autónomos were genuinely expecting communications from Hacienda, making the scam much more convincing.

Example of a real AEAT notification

A legitimate notification from Agencia Tributaria may contain information identifying the taxpayer, such as the recipient's name and part of the NIF.

Example of an official AEAT notification. It identifies the taxpayer and does not rely on a suspicious external link.

For example, a real notification may say that Agencia Tributaria has issued a notification addressed to a specific person with a partially masked NIF.

This is more consistent with an official message. However, even if a message contains your name or NIF, you should still verify it through official channels.

Can AEAT Send SMS Messages?

Yes, AEAT may send informational SMS messages in some situations.

But an SMS alone should never be treated as proof that a notification is real. The safest approach is always to verify the notification yourself through DEHú or the official AEAT electronic office.

Can Scammers Know Your Name or NIF?

Yes. Seeing your name, phone number or part of your NIF does not automatically prove that the message is genuine.

Personal information can appear in data leaks, old documents, marketplace accounts or previous online forms. For that reason, the domain and the official verification channel matter more than the text of the SMS.

How to verify an AEAT notification

The safest rule is simple: do not trust the SMS link. Instead, check the notification directly through official government platforms.

Option 1: Check DEHú

DEHú, or Dirección Electrónica Habilitada Única, is Spain's official platform for electronic notifications from public administrations.

Open the official DEHú website manually:

DEHú official website

Log in with an accepted identification method and check whether the notification appears in your account.

Option 2: Check AEAT Notifications

You can also verify the notification directly through the AEAT electronic office.

Open the official AEAT website manually:

Agencia Tributaria Electronic Office

Then log in and go to the Notifications section.

1. Open the official AEAT electronic office.
2. Log in using Cl@ve, digital certificate or DNIe.
3. Go to the Notifications section.
4. Check whether the notification exists in your account.

If the message is real, you should be able to find the notification through DEHú or AEAT. If you cannot find it there, treat the SMS as suspicious.

Why tax scams are so effective

Tax scams work because they create fear. Many people worry about missing an official deadline, ignoring Hacienda, receiving a fine or losing access to a tax refund.

Scammers use this pressure to make users click quickly without checking the domain name.

Similar fear-based tactics are also used in bank account scams. If you are worried about account reviews or blocked accounts, see our guide on why Spanish banks freeze accounts for foreigners and autónomos.

What If You Were Expecting a Real Notification?

This is exactly why AEAT scams work.

Many taxpayers are genuinely waiting for something: a Modelo 303 review, a refund, a document request, a penalty notice or a response from Hacienda.

Scammers use that uncertainty. The safest rule remains the same: do not trust the link. Open AEAT or DEHú yourself and check whether the notification exists.

Common fake messages used by scammers

Fake AEAT and Hacienda messages often claim that:

• You have a tax refund waiting.
• You need to provide additional documents.
• A new electronic notification is available.
• Your tax account requires verification.
• You must act immediately to avoid penalties.

In real tax procedures, official requests can be checked through government systems. For example, if Hacienda requests documents related to a VAT return, you can verify that request through official channels.

If you've received a genuine request from Hacienda and are unsure what it means, what documents to prepare or how much time you have to respond, see our guide on Hacienda Requested Documents for Modelo 303.

What Should You Never Do?

• Do not enter your bank card details through an SMS link.
• Do not install apps suggested by a suspicious message.
• Do not upload your passport, NIE or TIE through an unknown website.
• Do not call phone numbers shown on suspicious pages.
• Do not assume a message is real only because it mentions AEAT.

What to do if you clicked a fake AEAT link

If you clicked a suspicious link, do not panic, but act quickly.

• Do not enter any additional information.
• Close the website immediately.
• Change passwords if you entered login details.
• Contact your bank if you entered card or bank information.
• Monitor your accounts for suspicious activity.
• Report the suspicious SMS to the relevant authorities.

Hacienda may already receive information legally

Many taxpayers panic when they receive fake messages because they fear Hacienda has detected undeclared income or suspicious payments.

In reality, Hacienda already receives certain information through official reporting systems. For example, platforms and payment services may report data under specific rules.

To understand this better, read our guides on whether Hacienda can see your Upwork income through DAC7 and whether Hacienda can see your Bizum payments.

Special note for autónomos in Spain

Autónomos are frequent targets for tax-related scams because they regularly interact with Hacienda, file quarterly returns and may receive electronic notifications.

If you are starting your activity, make sure you understand the official registration process. Our guide on how to register as an autónomo in Spain explains the basic steps with Hacienda and Social Security.

If you are not yet registered but plan to issue invoices, you may also want to read whether you can invoice without being autónomo in Spain.

Related guides

• Can Hacienda See Your Upwork Income Through DAC7?
• Can Hacienda See My Bizum Payments?
• Hacienda Requested Documents for Modelo 303
• Why Spanish Banks Freeze Accounts: What Foreigners and Autónomos Need to Know
• How to Register as an Autónomo in Spain
• Can You Invoice Without Being Autónomo in Spain?

Final thoughts

The easiest way to identify an AEAT phishing SMS is to ignore the link and verify the notification yourself.

If the message is real, the notification should be available in DEHú or in the official AEAT Notifications section. If it is not there, the safest assumption is that the message is fraudulent.

Government notifications can always be verified directly. A suspicious SMS link should never be your source of truth.