The Spanish Social Security Administration has issued a warning about a new wave of fraudulent text messages impersonating its services in order to steal citizens' banking information. This practice, known as smishing, has become one of the most frequent cybersecurity threats, especially targeting self-employed workers and benefit recipients. The SMS messages mimic official communications and create a false sense of urgency to trick victims into acting without verifying the message's authenticity.
Cybercriminals have perfected their techniques to make their messages appear completely legitimate. Using the Social Security Administration's name, they report alleged debts, discrepancies in contributions, or outstanding payments, and include a link that redirects to fake websites designed to mimic official pages. The ultimate goal is to lead victims to a fraudulent payment gateway where bank details are requested, either under the pretext of settling a nonexistent debt or receiving a supposed payment.
How the scam works and who it affects
The modus operandi of this campaign follows a well-defined pattern. The fraudulent message arrives on the victim's mobile phone and informs them of an alleged issue with Social Security, such as a pending data update, a discrepancy in contributions, or even payments related to income tax. This last detail is a red flag, since Social Security does not manage income tax payments ; that responsibility lies with the Tax Agency.
In other cases, the SMS takes the opposite approach, informing the recipient that they have an outstanding payment owed by Social Security. In both scenarios, the link included in the message leads to a website that mimics the appearance of official portals, with logos and forms similar to the real ones. The domains used by the scammers are designed to look official, with addresses such as poratlesgsoical-gob.top , portal-seg-social.help , or portaliseg-socialgobs.clik , among others.
This campaign particularly affects the self-employed and those receiving benefits who conduct business with Social Security online. According to authorities, the aim is to obtain bank credentials to make transfers or access victims' accounts. The combination of an apparently official message and the psychological pressure generated by the possibility of a debt or outstanding payment leads many people to fall into the trap without a second thought.
What to do if you receive one of these SMS messages
The Social Security Administration has issued a series of recommendations to protect against this threat. The main one is clear: do not access procedures through links received via SMS or email. If citizens want to check if there are any pending procedures, they should do so by accessing the agency's official websites directly, either by typing the address into their browser or using saved login credentials.
Official platforms include Importass, for procedures with the General Treasury of Social Security; the Social Security Electronic Office; the Your Social Security portal; and the National Social Security Institute's benefits website. Through these channels, citizens can check for any outstanding debts, notifications, or benefits without clicking on any suspicious links.
It is also crucial to pay attention to the telltale signs of a fraudulent message. Spelling mistakes, poor writing, nonexistent words, or texts that mix languages ​​are clear indications that the message does not come from the government. Likewise, messages that pressure you to act quickly or create an immediate need to solve a problem should be treated with caution. The domains from which the link is sent are also revealing, as they never match the official Social Security addresses.
One of the most frequently asked questions among citizens is how to distinguish a legitimate SMS from a fraudulent one. The answer is simple: Social Security never requests debt payments or updates to personal data through links sent by SMS. Any communication that urges you to click on a link to resolve an urgent matter should be considered suspicious.
According to a recent Kaspersky study on messaging scams, 40% of frauds are carried out via SMS/iMessage, a figure that demonstrates the popularity of this channel among cybercriminals. The same report reveals that 52% of successful scams are completed in less than 30 minutes, underscoring the importance of creating a sense of urgency as a primary tactic. Brand impersonation accounts for 31% of cases, making it one of the most frequent methods, along with cyber scams in Spain , fake delivery notifications (38%), and investment scams (37%).
The role of artificial intelligence in scams
Technology has played a key role in the evolution of these scams. According to the same study, 66% of victims believe that artificial intelligence was involved in the fraud they suffered. Poorly written messages, obvious grammatical errors, and unnatural communication styles that were once easy to identify have given way to much more convincing content. Cloned voices, deepfakes, and AI-generated messages allow scammers to accurately mimic the language and tone of brands and public administrations.
This adaptability makes detection more difficult and increases the perceived legitimacy of the messages. Scammers no longer limit themselves to a single channel, but instead move the conversation to other platforms to appear more natural and reduce the chances of being detected.
If the user has already provided their bank details or made a payment after receiving one of these messages, the Social Security Administration recommends contacting the bank immediately to block the account or card and reporting the incident to the police . Acting quickly can be crucial to minimizing damage and preventing fraudsters from making additional charges.
Furthermore, the Consumers' Union of Asturias has secured over 200 favorable rulings against Unicaja in cases of bank fraud where scammers used SMS messages to impersonate the bank. One of the most recent cases, resolved by the Provincial Court of Asturias, requires the bank to return €9.999 to a customer who was the victim of fraud. The court ruled that the bank failed to activate sufficient security controls, even though the transfer was made on the same day the phone number linked to the account had been changed.
Spanish consumers are increasingly aware of the risks posed by this type of fraud, and authorities recommend exercising caution at all times. The best defense remains prevention and direct verification through official channels. At the slightest suspicion, it is better to take a few minutes to check the information than to regret the consequences of a hasty decision.
