Health card, fake refunds and bonuses: how to avoid scams involving phishing emails

The advice from the Department of Health in this instance is therefore that, if you have received such emails, you should not click on the link and should delete the message. You are then advised to consult ‘only official channels’ for information.

But attempts at cyberattacks via deceptive messages sent to users are becoming increasingly varied. Fake income tax refunds and fake holiday vouchers are just some of the new types of scams that have been identified and exposed in recent weeks. Some tips provided by the Italian Revenue Agency can help you work out whether you are facing a malicious attempt to steal your personal data.

As the Agency explains on its dedicated page, you can carry out a sort of mini-test: ‘First of all, start by asking yourself whether the message comes from a known sender, then check whether it is written in correct Italian. Furthermore: is it addressed personally to us? Is it well ‘constructed’, in the sense that the fonts used are consistent, or does it look like a slapdash copy-and-paste job? Does the text ‘flow’ smoothly and make sense? Even just one of these shortcomings is enough to cautiously regard the message as dangerous.”

Be careful with links, too. “If there are links in the message,” the Agency emphasises, “the first thing to check is whether, when you hover the mouse over the link, it matches the text. It is always advisable to be wary of shortened links (such as those ending in bit.ly) which do not reveal the destination address in advance. If there are attachments, you should always check that they have a single file extension (for example, .docx rather than .docx.exe). If you have any doubts about the true origin of a document received by email, rather than opening it, it is better to contact the sender by other means (such as a telephone number or an official email address) and ask for confirmation.

The Italian Revenue Agency also states that it ‘never sends emails containing taxpayers’ personal data’.

But some scams also circulate via text messages; in this case, they are known as ‘smishing’. The method is similar to that used in emails. They come from ‘fake’ institutional bodies that deceive users by trying to lure them to links in the text messages, which lead to malicious websites designed to steal personal data, login credentials and/or financial information.

As regards the tax authorities, the most recent case to come to light involves messages containing false tax notifications with trap links embedded within them. In this instance too, the Italian Revenue Agency ‘disavows these communications, stating that it has no connection whatsoever with their content or with the fraudulent schemes associated with them’ and urges the public “not to provide personal data, confidential information or login credentials via web pages accessed through links contained in unexpected, unsolicited or otherwise suspicious communications”.