It happened in January this year, it happened again in September, and now the Spanish Association of Consumers (ASESCON) warns of a new wave of fraudulent emails that tries to dupe the public with a false traffic fine notification.
The message states that "an electronic fine No. ____ was issued on ____ at _____." and then asks the user to choose "the best way to consult their bill" via two links that open a malicious file that infects the user's electronic device and exposes the victim's personal data.
In addition to asking users to take extreme precautions to avoid falling into this type of fraud, known as 'phishing', ASESCON advises that neither the traffic authority, nor other entities such as the Post Office, banks, the tax office, electricity companies, etc., request information from their users, such as passwords and personal data, through an email, nor will they ask them to make a payment through a link attached to an email.
In the case of the traffic authority, it never communicates its fines by email, but always by registered letter or, when this notification fails, through official bulletins, municipal notice boards or the Traffic Penalties Notice Board (TESTRA) or the Single Notice Board (TEU).
There is only one exception: if the person has voluntarily registered in the Electronic Address System (DEV), an electronic mailbox for receiving communications and notifications with the same legal effects as paper notification. In this case, it would be possible to receive a notification by SMS or via the enabled e-mail address, requesting that you enter the DEV and, after identifying yourself (with an electronic ID card or Digital Certificate), access the fine.
In addition, any citizen can consult TESTRA, where neither certificate nor electronic DNI is required, only the number of one's DNI, NIE or CIF.
ASESCON recommends deleting any suspicious email or SMS without opening it; keeping antivirus software updated, both on mobiles and computers; not opening links in dubious emails or SMS; and, before entering personal data on a website, to make sure that it is a secure server (the address of the page should start with https and there should be a padlock in the address bar).
If the malicious file has already been downloaded and executed, the device may already be infected. To protect it, the Office of Internet Security advises scanning the device in question with an up-to-date antivirus or following the steps found in their 'disinfecting devices' section.