Since 12 January 2023 the Spanish Criminal Code has arranged the fraud offences differently. Until that date article 248 gathered in a single provision the classic fraud, the one committed by deceiving someone into paying, together with the computer and payment card variants. The reform that came into force that day left the fraud by deception in article 248 and moved computer manipulation and the use of other people’s cards or card data to the following article. The penalty was left untouched. Fraud under article 248 of the Criminal Code is still punished with six months to three years in prison, or with a fine where the amount defrauded does not exceed 400 euros. For anyone who receives a text message claiming to come from the DGT, Spain’s traffic authority, about an unpaid fine and ends up typing their card details into a fake website, that arrangement has a practical consequence, because the deception that made them pay and the later use of their data are two different acts, prosecuted under different provisions and carrying the same sentencing range. I explain it because both the criminal complaint and the recovery of the money depend on knowing which of the two you have suffered, or whether you have suffered both.
The DGT is the body being impersonated in this scam. It does not send text messages with payment links, it does not collect penalties through that channel and it does not warn by text that a case file is about to attract a surcharge. If the message on your phone does any of those things, it is fake, and everything that follows starts from that certainty.
What the message looks like and why it works
The pattern repeats with minor variations. A text arrives, sometimes in the same thread where you have previously received legitimate messages from other public bodies or from your bank, informing you of an unpaid traffic fine. The wording warns that the deadline is about to expire and that, if you do not pay, the amount will increase or the file will go to enforcement. It includes a link, often shortened or with a domain that imitates the official one by adding words or changing a letter. Opening it brings up a page with the logo, the colours and the look of the official e-office, which asks for your number plate, your national ID number and your card details, including the security code on the back. Some versions then ask for the confirmation code your bank sends by text to approve transactions, and that is the moment the scammer obtains what he needs to charge whatever he wants to your card.
It works because almost everyone has had a fine at some point and does not rule out having another, and because the amount requested is not absurd. It is a plausible figure for a traffic offence, often presented with the early payment discount that genuinely exists for real fines. Added to that, sender spoofing allows the text to appear under a name that looks official, so neither the number nor the name on screen is enough on its own to dismiss it. This is known as «smishing», the text message variant of phishing, and in legal terms it is fraud under article 248 of the Criminal Code. Impersonating a public authority is the instrument of the deception, not a decorative detail.
How the DGT really notifies and how to check whether you have a fine
Traffic penalties are notified through two channels. If you or your company have activated the Dirección Electrónica Vial, the electronic notification mailbox, the notification is deposited there and you access it by identifying yourself at the e-office with your own credentials. If you have not activated it, the notification arrives by post at the address held in the driver or vehicle register. Any legitimate alert directs you to identify yourself independently at the e-office, never to pay from a link, and the authority does not refund money that way either, which is the other side of the same fraud.
If you are still unsure whether you have a real fine, do not resolve the doubt through the link in the message. Go on your own to the DGT e-office or its official app, identify yourself as you usually do with public administrations and check the pending penalties in your name and against your number plate. There you will see the file number, the amount and the deadline, and that is where you pay. If nothing appears, there is nothing, and the text is exposed. If a real fine appears, pay it through that channel and not through the message, because coincidence in timing does not make the text legitimate. Ignoring a message the authority never sent generates no surcharge, no seizure and no consequence of any kind for a real file, whose deadlines run from its own notification and not from a text.
What to do in the first hours depending on how far you went
If you have only read the text, do not tap the link and do not delete it yet. Take a screenshot showing the sender, the date, the time and the full text with the link, and then block the number. That message is evidence, whether you end up reporting it or someone else does.
If you tapped the link but filled nothing in, the risk is low. Close the page, do not go back to it and, if your phone asked you to install anything or grant permissions, do not grant them. Write down the exact address of the page, because it is useful for the complaint and for getting it taken down.
If you entered your number plate and ID number but did not reach the card stage, you do not yet have a money problem, but you do have a personal data problem, which I deal with below.
If you entered your card details, every minute counts. Call your bank’s emergency number printed on the card itself or shown inside its app, never a number that arrived by text or by a later phone call, and ask for the card to be blocked immediately. Do this before you start looking for charges, because charges can take hours to show up and the block prevents the next ones. Also ask them to confirm whether there are authorised transactions pending settlement. Then review your statements and keep proof of every charge you do not recognise and, if you made it, of the payment you yourself made on the fake site.
If you also handed over the confirmation code your bank sent by text, tell the bank exactly that and note it down for the complaint. It is part of the facts, it will appear in the bank’s records and hiding it only harms the person hiding it.
If you already paid, who has to refund you
The most common confusion among victims of this fraud is thinking that all the money lost is claimed from the same place for the same reason. It is not, and whether the claim succeeds depends on that difference. Payment services regulation obliges the bank to refund transactions the account holder did not authorise. A charge made by the scammer with your card details, after you typed them into the fake site, is a transaction you did not order, however much the data left your own hands. That charge falls within the territory of the unauthorised transaction and the bank has a legal obligation to refund it, subject to the exceptions the regulation itself provides and which the bank will try to invoke.
A different matter is the payment you yourself made on the fake site believing you were settling a fine. You ordered that payment, with your card and your confirmation, even though you were deceived. It is an authorised payment made under deception, and the refund rule for unauthorised transactions does not apply to it as such. To recover that money the route is a chargeback through the card scheme, designed precisely for purchases from fraudulent merchants or merchants that do not deliver what was promised, together with the claim against the scammer himself within the criminal proceedings. The chargeback has conditions and time windows counted in days, not months, and framing it with the right documentation and the right legal basis is the lawyer’s job.
| What happened | What it is in legal terms | Who the claim goes against |
|---|---|---|
| The scammer made charges with the card details you typed into the fake site | Unauthorised payment transaction | The bank, under the refund obligation in payment services regulation |
| You paid the fake fine on the site with your card | Authorised payment made under deception, fraud under article 248 of the Criminal Code | Chargeback through the card scheme and the scammer’s civil liability in the criminal case |
| You gave your number plate and ID number, but not the card, and there were no charges | Fraudulent harvesting of personal data, with no financial loss yet | A complaint to leave a dated record and monitoring of later misuse |
| You ignored the text and had a real fine | Administrative penalty following its own deadlines | Paid through the DGT e-office, and the text changes nothing |
At the firm, when a client arrives with several charges on their card, the first thing we do is separate them, because each one has its own route and lumping them together in a single claim is the surest way to get the bank to reject both. It is part of the work we do in cybercrime. On what the bank is obliged to refund and how it usually resists, I wrote in more detail in bank refund after phishing.
Your personal data is now in someone else’s hands
Even if the bank refunds you to the last euro, the fake form kept your ID number, your number plate, your phone number and, in many versions, your full name and address. With that, quick loans are taken out, duplicate SIM cards are requested, accounts are opened with payment services and utilities are signed up in the name of someone who never signed anything. The risk does not end with blocking the card and can surface months later, in the form of a debt claim for a loan you never asked for or an entry in a credit reference file.
There are two things you can do about that today. The first is to report it even if you lost no money, because a dated complaint is the proof that your data was stolen before any contract they later attribute to you, and without it the burden of showing it was not you becomes much heavier. The second is to distrust every subsequent call. Whoever holds your data uses it for a second phase, in which someone presents themselves as your bank, as the DGT itself or even as the police to «help» you with the earlier fraud, and under that pretext asks for passwords or tells you to move money to a safe account. No bank asks for passwords or transfers over the phone. If you are asked to receive a transfer and forward it, or to lend your account to «recover» what was lost, the person who agrees goes from victim to suspect as an intermediary for other people’s money, and that is a criminal problem of its own that has nothing to do with the fine any more.
How that second phase of bank impersonation works and what can be demanded of the bank is set out in bank impersonation scam, what to do.
The complaint, the criminal case and what can be claimed
Reporting does not require knowing who the scammer is or where he is. The complaint can be filed at any National Police station, Guardia Civil post or duty court, and in these frauds the investigation is usually taken on by a court in the place where the victim made the payment or suffered the loss, not the place the message was sent from. Bring the screenshot of the text with the sender and time, the address of the fake page if you noted it, the statement with the charges marked, proof that the card was blocked and any communication you have had with the bank. The complaint serves three separate purposes, to get the matter investigated, to evidence the fraud before the bank and the card scheme, and to have a certain date on record if your data resurfaces later.
You should know that a significant share of these cases is provisionally closed because the perpetrator is not identified, since he usually operates from outside Spain and through intermediaries. That closure settles nothing definitively. The case is reopened if the perpetrator surfaces, which happens more often than people think once complaints from many victims accumulate against the same infrastructure, and in the meantime the complaint keeps its full evidential value against the bank. Nor does the fact that your particular charge was under 400 euros make the matter a minor one, because the classification is made on the total defrauded by the same perpetrator from all his victims, not on what was taken from you.
When the perpetrator is identified, alongside the sentence the court declares civil liability arising from the offence, which covers restitution of what was paid and compensation for the losses proven, including those arising from the later misuse of your data. Acting as private prosecutor is what allows you to claim all of that within the same proceedings instead of waiting for the public prosecutor to do so. As for time limits, fraud is time-barred after five years and the minor offence after one, so the criminal limitation period is not the problem. The real problem is the chargeback window, which runs out in days, and the evidence that disappears when the message is deleted or the fake site is taken down.
What you risk on your own and what we do
The concrete risk in this matter is twofold. On one side, claiming from the bank the payment you yourself made as if it were an unauthorised transaction, and accepting the first refusal as final when that charge had a different route. On the other, letting the chargeback window close while you wait for an answer to a misdirected claim. At the firm we put the facts in order, separate each charge according to its nature, bring the bank claim and the chargeback where each belongs and act as private prosecutor in the criminal case so that civil liability is claimed from the outset. If you are in this situation, you can call +34 677 841 007 or write through the contact page. When you call, have to hand the screenshot of the text, the statement with the charges marked, the time you alerted the bank and what they told you, and a copy of the complaint if you have already filed it. With that, the first conversation achieves more than anything else.
Frequently asked questions
How do I know whether I really have an unpaid fine with the DGT?
By going on your own to the DGT e-office or its official app, identifying yourself as you usually do and checking the pending penalties in your name and against your number plate. Never through the link in the message. The DGT notifies through the Dirección Electrónica Vial or by post, and if there is nothing there, there is no fine. If there is one, it is paid from the e-office and the text is still fake.
If I already paid the fake fine with my card, does the bank have to refund me?
It depends on which charge it is. The ones the scammer made with your details afterwards are transactions you did not authorise and the bank has a legal obligation to refund them, subject to the exceptions provided in payment services regulation. The payment you made yourself on the fake site is an authorised payment made under deception and is recovered through a card chargeback and by claiming against the scammer in the criminal case. How each claim is framed is the lawyer’s job.
Is there a deadline for reporting the DGT text scam?
The criminal deadline is generous, because fraud is time-barred after five years and the minor offence after one. The deadline that really presses is the card chargeback window, which is counted in days, and the evidence lost if you delete the message or the fake site disappears. Report as soon as possible and keep the screenshot of the text, your statements and proof of the card block.
Do I need a lawyer for this, or is it worth claiming at all?
If it is a single small charge and the bank refunds it as soon as you notify them, you do not need a lawyer. File the complaint yourself and keep the paperwork. It is worth instructing a lawyer when the bank refuses the refund, when there are several charges or they are of significant value, when you handed over the confirmation code and the bank uses that to refuse, or when your data has started appearing in contracts you never made. In those cases what is at stake clearly exceeds the cost of defending it properly.