A smishing campaign impersonating the General Treasury of the Social Security (TGSS) has been identified through fraudulent SMS messages. The aim is to deceive victims into providing their personal and banking information.

Campaign description

The fraudulent messages inform users of a supposed pending update or an economic benefit related to Social Security and urge them to access a link to complete a procedure.

The link leads to a fraudulent website that imitates the visual identity of the Social Security Administration. The website initially requests personal information and subsequently asks for banking information, such as card details, with the aim of obtaining sensitive information and committing fraud.

Different variants of these messages and different fraudulent domains have been identified in an attempt to confuse users.

Explanation of the steps:

• Fraudulent SMS: The user receives a message that appears to come from an official organization and informs them that they have a pending procedure or issue.
• Fraudulent website: The link in the SMS leads to a fake website that imitates an official website in order to gain the user's trust and convince them to continue.
• Request for banking details: The fake website asks for card information, such as the card number, expiration date, and security code.
• Goal: to steal your data and money: The criminals use the information obtained to attempt fraudulent transactions and steal money.

What is smishing?

Smishing is a type of fraud based on sending SMS messages that impersonate legitimate organisations with the aim of deceiving users into accessing a malicious link or providing personal information, credentials or banking details.

How to identify the fraud

⚠️ Be wary of messages asking you to carry out an urgent procedure through a link.

🔗 Always check the website domain before entering any information.

🔐 Do not provide personal data, credentials or banking information through links received by SMS.

🏛️ To carry out procedures, access the official Social Security channels directly and avoid using links included in suspicious messages.

Recommendations

If you have received the SMS but have not accessed the link, it is recommended that you block the sender and delete the message.

If you have accessed the link and provided personal or banking information:

• Contact your bank and request assistance in blocking any unauthorised transactions and, where appropriate, your bank card.
• Keep all available evidence, including the SMS, screenshots, URLs and any related communications.
• Report the incident to the relevant authorities.
• If you have provided personal information, periodically monitor for possible misuse of your data.

Official sources

The campaign has been identified by INCIBE, under identifier INCIBE-2026-566, and the information is also available through the Social Security Administration's cybersecurity channels.

Further information

• INCIBE: Smishing campaign impersonating the Social Security Administration
• Social Security Administration: Cybersecurity information and recommendations