Phishing Campaign Impersonates ACI to Steal Personal and Payment Details
Summary
CERT-AGID reported a phishing campaign impersonating ACI that uses fake unpaid car-tax notices to collect victims’ tax codes, vehicle plates, contact details and payment-card information. CERT-AGID requested takedowns and shared indicators.
Key points
- The campaign uses the domains acitalia[.]info and acitalia[.]click, which are not official ACI channels.
- A fake unpaid car-tax notice warns of penalties and vehicle restrictions to pressure victims into responding.
- The site first collects victims’ tax codes and vehicle registration plates, then requests contact and home-address details.
- A simulated €15.87 payment page requests the cardholder’s name, card number, expiration date and CVV.
- ACI’s official car-tax payment service uses public-administration authentication such as SPID or CIE; unexpected requests for personal or banking details without that login may indicate fraud.
- CERT-AGID requested that the identified domains be taken down, notified ACI and shared campaign indicators with accredited organizations.
Article Details
- Event Type
- Phishing campaign impersonating the Automobile Club d’Italia (ACI) and claiming victims owe an unpaid vehicle tax.
- Impact
- The fraudulent sites solicit victims’ tax code, vehicle registration, contact and residential details, and payment-card data, creating a risk of personal and financial data theft.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | acitalia[.]click | Fraudulent domain hosting a phishing site impersonating ACI and collecting personal and payment-card data. |
| DOMAIN | acitalia[.]info | Fraudulent domain hosting a phishing site impersonating ACI and collecting personal and payment-card data. |