SCAM ALERT: Fraudsters posing as Spanish Health Ministry in fake SMS renewal scam
People in the Canary Islands are being warned to ignore any text messages or emails claiming that they need to “renew” their health card. The Instituto Nacional de Ciberseguridad (INCIBE) has issued an official alert about a phishing campaign currently circulating in Spain, in which criminals impersonate the Ministerio de Sanidad (Ministry of Health) to steal personal data and bank details.
The scam begins with an SMS or email that looks official, warning recipients that they must renew their health card (TSI) due to a “new verification system.” The message includes a link that leads to a fake website, which is designed to look almost identical to the official one.
Once on the page, users are asked to go through a series of fake “security steps”, including solving a simple calculation, selecting their autonomous region (with fake logos), and entering personal information such as their DNI/NIE and full name. Finally, the site requests a €2.99 payment, supposedly for postage of the new card.
Behind the scenes, the scammers are stealing sensitive information, including bank card details, while the user sees a “loading” screen that never ends.
How to spot the scam
INCIBE has identified several red flags in these fraudulent messages:
- Poor spelling and awkward phrasing, e.g., “Actualiza su TSI” or “Renovacion”.
- Fake use of the Health Ministry’s logo without its yellow background.
- Email or SMS addresses that do not belong to “sanidad.gob.es”.
- Urgent language such as “last warning” to pressure the recipient.
What to do if you receive the message
If you haven’t clicked the link:
- Do not respond or interact with the message.
- Block the sender and delete the message.
- Report the scam to INCIBE through their incident mailbox or by calling their free cybersecurity helpline on 017.
If you have entered your details:
- Contact your bank immediately to block your card or any transactions.
- Take screenshots of the fake message and website.
- Report the incident to the Policía Nacional or the Guardia Civil.
- Check whether your data has been compromised through trusted platforms such as Have I Been Pwned.
Important: The health card does not need to be renewed
INCIBE reminds the public that the Tarjeta Sanitaria Individual (TSI) does not require periodic renewal. Your health card number is personal, permanent and unique, and any legitimate changes or replacements must only be made through official channels such as:
- The official Ministry of Health website
- Seguridad Social
- Sistema Cl@ve
- Official health websites of the autonomous regions
These procedures always require secure identification, such as a digital certificate, electronic DNI, or Cl@ve system. If a website claiming to be official does not ask for these credentials, it is almost certainly fraudulent.
Authorities are urging everyone to remain vigilant and not to click on suspicious links, even if they appear to come from official institutions.
Share:
