Have you received a traffic fine notification by SMS text message in Spain? How to check if you have been scammed

Anyone who receives an SMS text message about a traffic fine should treat it as a scam, Spain's National Cybersecurity Institute (Incibe) has warned.

The new type of scam that is starting to emerge in the country involves a text message where the fraudster impersonates the Directorate-General of Traffic (DGT) and informs the victim that they have received a traffic fine. It is accompanied with a link, which directs them to review the amount of the fine and how to pay it.

The fake website looks very similar to the official DGT website, officials have warned. Once clicked through, bank details are requested to pay the fine. The offence is typically for illegal parking and the amount of the fine is generally 35 euros if paid within 24 hours, otherwise it rises to 50 euros.

If you click on the attached url, the web page to which it redirects then reports problems when trying to process the payment with Opera (a web browser), and explains it can be done from another browser. "This message tries to distract the victim's attention," Incibe pointed out. It then asks for personal data such as name, surname, address, date of birth, post code, telephone number and email. Then, to make the payment, the card number is requested, as well as its expiration date, CVC security code and PIN security code. The operation ends with a pop-up window in French notifying of a problem with the bank card number, but by that stage the cybercriminals have already obtained the victim's personal and banking data.

How to act

If the attached link has not been clicked, Incibe recommends blocking the sender of the message and deleting the SMS. If the URL has been clicked on and personal and bank details have been entered, these are the steps to follow:

- Take screenshots or save all possible evidence of the fraud and the links attached to them. You can use online witnesses to certify this evidence.

- If you have entered bank details, contact your bank to report the incident.

- In the coming months, review your online presence (egosurfing) to ensure your personal data has not been compromised.

- Report the fraud to Incibe or contact the Incibe's cybersecurity helpline to prevent others from falling victim to this fraud.

- File a report with local authorities, presenting evidence of the fraud.

The DGT reminds users that it never communicates its fines by e-mail or text message, and always by letter in the post. Anyone can check if they have a pending fine - whose notification by letter has failed - by entering the TESTRA, where neither certificate nor electronic DNI is required, only the number of the DNI, NIE or CIF, it added.