Fake Tax Agency “Holiday Bonus” Campaign Steals Personal Data
Summary
CERT-AGID reported a phishing campaign impersonating Italy’s tax agencies with a fake holiday-bonus application. It solicits identity documents, payslips, a selfie, and contact details that could enable fraud and identity theft.
Key points
- The campaign impersonates Italy’s Revenue Agency and Revenue Agency-Collection using a polished, multi-page site.
- A fake “Holiday Bonus” service leads to a fraudulent login page offering SPID, CieID, or a manual document-upload option.
- The SPID and CieID options redirect users to authentic identity-provider or government authentication pages, which may make the fraudulent site seem more trustworthy.
- The manual option requests photos of both sides of an identity card and health card, three months of payslips, a selfie, a phone number, and an email address.
- Stolen information could be used for fraud or identity theft, including applying for loans in victims’ names.
- CERT-AGID notified the relevant agency, requested that the phishing site be disabled, and distributed campaign indicators of compromise to accredited organizations.
Article Details
- Event Type
- Phishing campaign impersonating Italian tax authorities to steal personal data
- Impact
- The fraudulent site sought identity-document images, recent payslips, a selfie, phone number, and email address. The stolen information could be used for fraud and identity theft, including applying for financing or loans in victims’ names. CERT-AGID notified the affected entity and requested that the phishing site be disabled.
Products
CieIDAll’utente vengono proposte le consuete modalità di accesso tramite SPID e CieID, affiancate da una terza opzione, “Altro”, che invita a effettuare l’accesso caricando manualmente i propri documenti.SPIDAll’utente vengono proposte le consuete modalità di accesso tramite SPID e CieID, affiancate da una terza opzione, “Altro”, che invita a effettuare l’accesso caricando manualmente i propri documenti.