Treat it as a scam until you've checked on the tax office's site, typed yourself.
Take out passwords, codes and card numbers first.
What it looks like
You're due a tax refund of €263.40. Claim it before it expires: [link]
The page copies the tax office's site and asks for your card or bank details "to send the refund".
Red flags
- A refund link by text or email.
- An exact, odd amount.
- A deadline to claim.
- A request for your card details to receive money.
- A sender that isn't the tax office's own address.
What the tax offices say
- Agencia Tributaria (Spain) never sends a link to claim a refund and never asks for card details by text or email. It keeps a list of fake messages sent in its name, with cases up to December 2025.
- HMRC (UK) has a page to check whether a text from it is genuine. Forward suspicious texts to 60599 and emails to phishing@hmrc.gov.uk.
- impots.gouv (France) only emails from addresses ending @dgfip.finances.gouv.fr and never texts about late payment.
- The IRS (US) put fake emails and texts first in its list of tax scams for 2026.
If it's happening now
- Don't tap the link.
- Sign in to the tax office's site by typing its address yourself.
- Report the message and delete it.
Already entered your details?
- Call your bank now on the number on your card and block the card.
- If you sent a photo of your ID, report it to the police and ask how to renew it.
- Keep the message and report it.
Where to report it
If money has gone or you shared card details, call your bank first, on the number on your card or in its app, never a number from the message.
Which country are you in?
- Free help, every day 8:00–23:00. INCIBE: call 017, WhatsApp 900 116 117 or Telegram @INCIBE017. Official page
- Report a scam message. Forward the email, or a screenshot of the text, to incidencias@incibe-cert.es. Official page
- If you lost money. Report it online at denuncias.policia.es, then sign it at a police station within 72 hours. Call 091 if it's happening now. Official page
- If your bank says no. Complain to your bank's customer service, then to the Banco de España if it won't help. Official page
- Report a scam text. Forward it to 7726, free. Official page
- Report a scam email. Forward it to report@phishing.gov.uk. Official page
- If you lost money. Report Fraud, at reportfraud.police.uk or 0300 123 2040 (England, Wales, Northern Ireland). In Scotland, Police Scotland on 101. Official page
- Report a scam text. Forward it to 33700, free. Official page
- Free help. 17Cyber, at 17cyber.gouv.fr. Official page
- Report a fake website. Pharos, at internet-signalement.gouv.fr. Official page
- If you lost money to an online scam. Complain online through THESEE on masecurite.interieur.gouv.fr. Official page
- If your card was used online. Block the card, then report the payments through Perceval on masecurite.interieur.gouv.fr. Official page
- Report a scam text. Forward it to 7726. Official page
- Report a scam. ReportFraud.ftc.gov. Official page
Read on the official pages on 12 November 2026.
Questions people ask
I filed my return recently. Could it be real? Check on the official site yourself. Real refunds go to the account you gave when you filed, without a link.
Why do they need my card to pay me? They don't. A refund never needs your card number.
Is it worse for people filing for the first time? It works best on people who don't yet know how the tax office writes to them, which is why students and first-time workers get it.
What if I only opened the link? If you didn't enter anything, close it and delete the message.
Can Kiwi check the message? Yes. Press the button, paste it, and Kiwi tells you what looks wrong.