A fake official notice. The authority is real, the message is not, and the deadline exists to prevent you from checking.
Two versions dominate. The first demands money: an unpaid fine, a toll, a tax debt, a customs charge, with a penalty if you do not pay within hours.
The second offers money: a refund, a rebate, an unclaimed benefit, and it needs your bank details to pay you.
What the messages look like
- A document attached to an email or linked from a text: recognisable layout, official-sounding reference numbers, a seal.
- A deadline measured in hours, not days, and a warning about penalties, interest, or enforcement.
- Payment routes that a real authority does not use: gift cards, cryptocurrency, a transfer to an individual's account.
- For refunds: a form asking for card number, expiry and security code, or for online-banking credentials, so the money can be 'sent'.
How to verify without calling them back
- Find the authority's own site through a search engine, not through the link, and log in to the account you already have with them.
- Call the number published on their own site — never the number in the message.
- A real obligation is recorded somewhere you can already see: your account, your file, your case number.
- A real refund never needs your card's security code, and never needs your online-banking password.
If you have paid or given details
- 1Call your bank today and block the card or the transfer route used.
- 2If you paid by gift card, contact the card issuer immediately — unredeemed cards can sometimes be frozen.
- 3Reset the passwords for anything you typed, starting with email, then banking, then any account that shares a password.
- 4Report it to the authority being imitated and to the national fraud reporting service; they track these campaigns and warn others.
- 5Keep everything: the message, the reference numbers, the payment receipts. A report is far more useful with them.
Frequently asked questions
The document had the correct layout, seal and reference format. How?
Official documents are public and copied within hours of any new campaign. Recognising a layout proves the sender copied it, nothing about who sent it.
I do actually owe a fine. How do I know this is not about that?
Look up the fine where you would normally find it — the authority's own portal or app. If it is real it is there, and you can pay it there, by the route you already use.
They offered a refund and only asked for my IBAN, not card details. Safer?
An IBAN alone cannot empty an account. But the same link usually also harvests login details in a second step, and a real refund is paid to the account the authority already holds on file.
Written by The BaitScan team
Last updated September 16, 2026
Results are automated risk estimates based on public indicators and heuristics.