Online scams in Spain: fake SMS from the DGT, Correos and your bank

Updated: October 2026

Soon after you get a Spanish phone number, the messages start: a traffic fine from the DGT, a parcel waiting at Correos, a security alert from your bank. Many of them are fake. Newcomers are an easy target, because you are still learning which letters and messages are normal in Spain. This guide shows the most common scams, how to recognise them and what to do if you have already clicked.

Fake traffic fines from the DGT

Spain’s National Cybersecurity Institute (INCIBE) has warned several times about SMS and emails that pretend to be from the DGT (Dirección General de Tráfico). They say you have an unpaid fine, offer a 50% discount if you pay now and send you to a page that looks like the DGT website. The page asks for your personal details and card number, then for a code and even your card PIN.

According to INCIBE, the DGT notifies fines by post, on the official notice board (tablón edictal) if it cannot reach you, or electronically through the Dirección Electrónica Vial (DEV). It does not ask you to pay through a link in an SMS. If you are unsure, check your fines on the official DGT website, never through the link in the message.

Parcel messages from “Correos” or delivery companies

Another classic: a message saying a parcel could not be delivered and you need to pay a small fee or confirm your address. The link leads to a fake payment page. When you are moving and ordering lots of things online, these messages are easy to believe. Track parcels only in the official app or website of the company you ordered from, using your own tracking number.

Calls and messages from “your bank”

Scammers can make a call or SMS look as if it comes from your bank’s real number. They say there is a suspicious payment and ask you to confirm a code, move money to a “safe account” or install an app. A real bank will never ask you for your full password, your PIN or the codes you receive by SMS. Hang up and call your bank yourself on the number on your card or in the app. If you are just opening a bank account in Spain, ask your bank how it contacts customers.

“Hi Mum” messages and Bizum requests

• Family in trouble: a WhatsApp from an unknown number says “Hi Mum, I lost my phone, this is my new number” and soon asks for money for an urgent bill. Always call your family member on their old number before you pay anything.
• Bizum requests: when you sell something second-hand, a “buyer” may send you a Bizum request instead of a payment. If you accept it, money leaves your account. Read how it works in our guide to Bizum mobile payments.
• Rental deposits: a flat that looks perfect and cheap, an owner who is “abroad” and wants a deposit before you can see it. Never pay for a property you have not seen, or that is not offered through someone you can verify.

Warning signs

• Pressure to act now: “today only”, “or your account will be blocked”.
• A link in an SMS or WhatsApp that asks for card details, codes or passwords.
• A sender address or website address that is slightly different from the official one.
• Spelling mistakes and strange Spanish or English.

How to protect yourself

• Do not click links in unexpected messages. Go to the official website or app yourself.
• Turn on two-factor authentication on your email, bank and Spanish digital certificate and Cl@ve.
• Keep your phone updated and only install apps from the official app stores.
• Be careful on public Wi-Fi, and use mobile data or a VPN for banking when you are out.

Some security tools can also help by blocking known dangerous websites. NordVPN (ad), for example, includes a feature called Threat Protection Pro that blocks dangerous sites and scans downloads for malware. No tool replaces common sense, though: if a message feels wrong, it usually is.

What to do if you have clicked or paid

1. Call your bank immediately and block your card. Ask whether a payment can be stopped.
2. Change the passwords of any account you entered, starting with your email.
3. Keep the evidence: screenshots of the messages, the link and the phone number.
4. Call 017, INCIBE’s free and confidential cybersecurity helpline (every day, 8:00 to 23:00), or write on WhatsApp to 900 116 117.
5. File a complaint (denuncia) with the Policía Nacional or Guardia Civil, and bring your evidence. Your bank will often ask for a copy. See also our guide to the police in Spain.

Useful links

• INCIBE warning: fake DGT fines by email and SMS (Spanish)
• INCIBE 017 – your help in cybersecurity
• Safety and emergency situations in Spain

FAQ: online scams in Spain

Does the DGT send fines by SMS?

No. According to INCIBE, the DGT notifies fines by post, on the official notice board or electronically through the DEV. An SMS with a payment link is a scam.

Where can I report a scam in Spain?

Call 017 for advice and file a complaint with the Policía Nacional or Guardia Civil. Contact your bank first if money is involved.

Will my bank ever ask for my SMS code?

No. Never give anyone the codes you receive by SMS, your PIN or your full password, even if the call seems to come from your bank’s number.

Disclaimer: This article is general information only. It contains a sponsored link marked (ad); we may earn a commission at no extra cost to you.