Italy: Smishing scams impersonating PagoPA and municipalities

New smishing campaigns are targeting users through fraudulent SMS messages impersonating Italian public administration services. These scams use names such as ‘PagoPA-SEND’ or generic senders like ‘Comune’ to alert recipients of alleged administrative sanctions, such as speeding fines.

The messages typically use formal language to create a sense of urgency, prompting victims to click a link to ‘consult the report’ or ‘verify the violation.’ However, these links lead to suspicious, non-institutional domains designed to mimic official websites. Once on these fraudulent pages, criminals attempt to steal personal information and credit card details under the guise of paying the fine.

Authorities advise citizens not to click on links in such messages and to avoid entering any personal or payment credentials. Official Italian public administration services use certified domains, and any communication directing users to unofficial web addresses should be treated as a security threat.