A €305 payment from Social Security? The text scam targeting bank cards in Spain

A fake text claiming to come from Spain’s Social Security does not instantly ask for money. It offers some instead, a payment towards rising energy bills, which cybersecurity officials say is designed purely to get hold of a bank card.

How the initial message reels you in by offering you money

Spain’s National Cybersecurity Institute (INCIBE) issued an alert on Wednesday August 19 about a new wave of fraudulent text messages impersonating the Tesorería General de la Seguridad Social (TGSS), the body that manages Spain’s pensions, benefits and social security contributions. The message reads: “Seg Social: Tiene una actualización pendiente. Consulte su información y gestione el trámite correspondiente” (Social Security: you have a pending update, check your information and manage the procedure), and includes a link to a convincing copy of the real Social Security website.

INCIBE says anyone who receives the text should delete it without clicking the link. Genuine Social Security business should only ever be carried out through the official Sede Electrónica portal, sede.seg-social.gob.es, or the IMPORTASS app, never through a link sent by text message.

How the fake Social Security page tries to win trust

Clicking the link opens a page copying the real TGSS site’s logo and layout closely enough to pass a quick glance. The consumer group OCU, which flagged the campaign this week, said the page even asks visitors to confirm they are not a robot, a small touch designed to make the process feel like a genuine government procedure.

Only after that does the page ask for a full name, national ID number (DNI) and home address, framed as steps needed to check the user’s record.

A €305.85 ‘energy payment’ seals the trap

Once those details are entered, the page tells the visitor they are owed a specific benefit: a payment called “Asistencia para la adaptación energética 2026” (energy adaptation assistance 2026), worth €305.85 in one version seen by INCIBE. 

To “receive” that payment, a final page asks for the visitor’s full card number, expiry date and security code. In reality, no such benefit exists, and providing card details this way hands scammers everything needed to make unauthorised charges.

What to do if you have already handed over your details

Anyone who has entered card information on the fake site should contact their bank immediately to block the card and watch for unauthorised transactions. INCIBE also recommends keeping screenshots of the message and the fake website as evidence.

A report can be filed with the Policía Nacional or Guardia Civil, and separately with INCIBE itself, either through its free 017 helpline or its online incident form. INCIBE suggests checking periodically afterwards for any sign personal data has been used or published elsewhere online.

Staying safe if a similar message arrives

Foreign residents registered with Spain’s Social Security, whether through employment, self-employment or reciprocal healthcare arrangements, are just as exposed as Spanish nationals, since the messages are sent out in bulk rather than targeted at a particular profile. 

The safest response to any unsolicited text mentioning a pending update or payment is not to click the link at all, but to log in directly through the Sede Electrónica website or the IMPORTASS app to check whether anything genuine is outstanding. Legitimate Social Security communications never ask for bank card details by text.

Related: What to do if you get a suspicious bank text in Spain | Spain alert: fresh SMS bank scams