Receiving an email that appears to be from the Spanish Tax Authorities can be stressful—especially if you’re an expat. It’s important to understand that the Agencia Tributaria (Spanish Tax Agency) does not send tax notifications via email. Instead, they may send a message informing you that a notification is available in your electronic inbox on their official website.
Never make click in any links of emails or open attachments. It may be a virus. Just consult with a professional lawyer about legitimate of the notification.
This guide will help you recognize legitimate communication and take the right steps to protect your personal and financial information.
Recognizing official communications
What does a legitimate email look like?
- The Spanish Tax Agency may send email alerts to inform you that a tax-related notification is available.
- These emails will not include sensitive information directly and will never ask for your personal or banking data.
- They will direct you to access the notification through the official electronic portal using a digital certificate, Cl@ve PIN, or electronic ID (DNIe): https://sede.agenciatributaria.gob.es
Official email domains
Legitimate emails come from domains such as @correo.aeat.es or @agenciatributaria.gob.es.
Emails from domains like @agencia.tributarias.digital or similar should be treated with suspicion.
Language and tone
- Official messages are written in clear, formal, and professional Spanish. Messages and notifications are always the same because authorities use templates for different types of notifications.
- Urgent or threatening language is a common red flag for phishing attempts.
- Poor grammar, generic greetings, or vague references to your tax status often indicate fraud.
What to do if you receive a suspicious email
Do not interact
- Don’t click on any links or download attachments.
- Don’t reply or share personal information.
Verify the information
- Go directly to the Spanish Tax Agency’s official website through your browser.
- Never access your account through a link provided in a suspicious email.
- When in doubt, speak with a qualified tax lawyer immediately.
Report the attempt
- Forward the suspicious email to: phishing@correo.aeat.es
- You can also notify local authorities or cybersecurity services.
What if you already clicked?
- Disconnect from the internet to prevent data leaks.
- Run a complete antivirus scan.
- Change all your passwords—especially on financial or government-related accounts.
- Activate two-factor authentication (2FA) for extra protection.
- If you entered any banking info, contact your bank immediately.
- And above all: Get in touch with a lawyer to assess your risks and next steps.
Prevention tips
- Keep antivirus software updated and use secure browsing.
- Monitor your bank and credit card activity regularly.
- Use only official channels for tax-related questions or responses.
- Be skeptical of any message requesting sensitive data via email or SMS.
Frequently asked questions
Can the Spanish Tax Agency email me?
Yes, but only to notify you that there’s a message waiting for you in your secure inbox. They will never send the actual tax notice by email or ask for data this way.
What happens if I don’t check the notification?
Notifications are considered legally delivered after 10 calendar days, even if you haven’t accessed them. Timely action is crucial.
I can’t access the online tax portal. What should I do?
If you’re having trouble accessing your notification, contact a lawyer or tax advisor immediately. Delays can result in missed deadlines or fines.
⚠️ Need help navigating a Tax Notification or suspected scam?
Don’t take risks with your finances or legal standing in Spain.
📩 Contact us today for legal guidance tailored to expats.
We can help you verify the legitimacy of any message, recover from a potential scam, and manage your tax situation safely and confidently.
English 
Dutch