Guide updated on 4 November 2026. It brings together and replaces the site’s articles on phishing, smishing and vishing, QR codes and quishing, online shopping scams, deepfakes and social engineering.
In 2025 Italy’s Polizia Postale handled 27,085 cases of online fraud, with more than €269 million stolen, according to its annual report. In the same year Italy’s government CERT (CERT-AgID) recorded 3,620 malicious campaigns aimed at Italy; 328 of them imitated PagoPA payment notices and fines (CERT-AgID 2025 report).
Scams arrive by email, SMS, phone, WhatsApp, classified ads, QR codes and even with the cloned voice of a relative. The channel changes, the script does not. Once you recognise the script, you also recognise the variants you have never seen.
1. The script: the four levers behind every scam
Scammers do not attack the computer, they attack the person. This is called social engineering, and it almost always combines these levers:
- Urgency: “within 24 hours”, “your account will be blocked”, “the fine will double”. It stops you thinking.
- Authority: your bank, the post office, the tax office, the police, your boss. It stops you asking questions.
- Fear or affection: a suspicious login, a parcel on hold, a child in trouble writing from a new number.
- An unusual request: a code, a “safety” transfer, an app to install, a payment outside the platform.
The most effective defence is a single rule: when a message rushes you and asks you to do something, stop and check through a channel you choose. Close the message, open your bank’s app or type the website address yourself, and call the number printed on your card or on the official site.
2. Channel by channel: the warning signs
| Channel | Typical examples | Warning signs | What to do |
|---|---|---|---|
| Email (phishing) | Bank account suspended, tax refund, mailbox full, invoice attached | Sender with an odd domain, generic greeting, link leading to another site, zipped attachments or attachments with macros | Don’t click; sign in through the app or by typing the address |
| SMS (smishing) | Unpaid fine, parcel on hold, pension office, motorway toll, “unusual login” at your bank | Shortened links or names similar to real ones, a request to install an app | Don’t open the link; check in the official app |
| Phone (vishing) | Fake bank fraud team, fake police officer, fake technician | The number on screen looks genuine; they ask for codes or transfers, or for you to install a remote-access app | Hang up and call the official number yourself |
| WhatsApp and chat | “Hi mum, I’ve changed my number”, a fake friend asking for a code | Unknown number, request for money or for your 6-digit WhatsApp code | Call the person’s old number; never send codes |
| QR codes (quishing) | Stickers on parking meters, fake fines on the windscreen, flyers, emails with a QR code | A QR code stuck over another one, a site asking for card details | Check the address shown before opening it; pay in the official app |
| Ads and shopping | Seller asking you to pay outside the platform, fake “shipping” or “receive payment” link | Price too low, pressure, instant transfer or top-up card payment | Always stay inside the platform and its payment system |
| Fake voices and videos (deepfakes) | A relative’s voice asking for money, celebrity videos promoting investments | Urgent, unusual request; slightly unnatural audio; “don’t tell anyone” | Ask something only the real person knows; call back their saved number |
3. How to check a link before opening it
The part of an address that matters is the domain: the name just before the first slash /. Read it from right to left, starting from .it, .com and so on.
https://www.poste.it/accedi: the domain is poste.it, the real one.https://poste.it.verifica-conto.com/accedi: the domain is verifica-conto.com. “poste.it” at the start is just a disguise.https://posteitaliane-sicurezza.net: a domain that contains a brand name is not that brand.
On a computer, hover over the link without clicking and read the address at the bottom of the window. On a phone, press and hold the link to preview it. The padlock and https do not mean a site is honest: they only mean the connection is encrypted, even to a scammer.
Your password manager helps too: it only fills in fields on the real site. If it does not offer your password, ask yourself why. See the guide on protecting your accounts.
4. Phone scams: why the number on screen is not enough
With spoofing, callers can make any number appear on your phone, including your bank’s customer service number. The same goes for SMS sender names: Italy’s communications regulator AGCOM has introduced rules on alphanumeric sender names, but scam texts can still come from ordinary numbers.
The most common script is the fake fraud team: first a text about a suspicious payment, then a call that seems to come from the bank. The caller is polite, knows your name and perhaps the last digits of your card, and asks you to move your money to a “safe account” or to read out a code you have just received.
No bank will ever ask you to make a transfer to protect your account, to read out a one-time code or to install a remote-control app such as AnyDesk. If it happens, hang up, wait a few minutes and call the number on the back of your card.
5. QR codes: convenient and easy to swap
A QR code is just a link you cannot read by eye. A home-printed sticker over the original on a parking meter or a menu is enough to send you to a fake payment page. The most common variants are fake parking fines left on windscreens and emails with a QR code to scan “to reactivate your account”, designed to slip past spam filters that check links.
- Before opening, read the address your camera shows in the preview.
- Feel whether the QR code is a sticker placed over another one.
- For parking and fines, use the official app of the council or operator, or pay with the notice code.
- Do not scan QR codes received by email to sign in to an account: go through the website or app.
6. Buying and selling online
On classified-ad sites the most common scam is not about the product but the payment. The fake buyer sends you a link to “receive the payment” or “confirm shipping” that actually asks for your card details. The fake seller asks for an instant bank transfer, a top-up card or a “friends and family” payment, none of which offer any protection.
- Stay inside the platform: chat, payment and shipping through its own system.
- You never need to enter card details to receive money.
- Be wary of unknown online shops with prices far below average: check the company registration, contact details and reviews on independent sites.
- Prefer payment methods that allow disputes, such as a credit card or the platform’s protected payments.
7. Deepfakes: when a voice is no longer proof
A few seconds of audio, taken from a social media video or a voice message, are enough to imitate someone’s voice. Deepfakes are used in two ways: a call from a relative in trouble asking for money at once, and videos of celebrities promoting miracle investments. The Polizia Postale report lists the latter among growing scams.
- Agree on a family code word for real emergencies.
- If a familiar voice asks for money, hang up and call the number in your contacts.
- No public figure promotes trading platforms through social media ads. Check whether a firm is authorised with the financial regulator (in Italy, Consob).
- If someone spreads a fake video of you, save the evidence (addresses, screenshots) and report it to the platform and the police.
8. Already clicked or paid? What to do now
| What happened | What to do in the first few minutes |
|---|---|
| You entered card details | Block the card in the app or by calling the blocking number, then ask your bank to dispute the unauthorised payments. |
| You made a bank transfer | Call your bank immediately and ask for a recall: it is only possible in the first moments, and often not at all with instant transfers. |
| You entered passwords or codes | Change the password from a clean device, sign out all sessions, turn on or renew two-step verification. |
| You installed an app or gave remote access | Disconnect from the internet, uninstall the app, call your bank and have the device checked before using it for payments. |
| You gave away your WhatsApp code | Reinstall WhatsApp and register your number again, turn on WhatsApp’s two-step verification, warn your contacts. |
In every case keep the messages, numbers, addresses and receipts and file a report with the police; in Italy you can start it online on the Polizia Postale portal. A police report also helps you get a refund from your bank when you did not authorise the payment.
Five rules to remember
- Urgency is the main warning sign: the more a message insists, the more likely it is fake.
- Always check through a channel you choose, never the one you were offered.
- Codes, PINs and passwords are never read out to anyone, not even your bank.
- Money is never moved “to keep it safe”.
- When buying and selling online, stay inside the platform.
Sources
- Polizia di Stato, 2025 annual report of the Polizia Postale, summary on Cybersecurity360 (Italian).
- CERT-AgID, 2025 report on malicious campaigns (Italian).
- Cybersecurity360, AGCOM rules on SMS sender names (Italian).
- Commissariato di PS online, reports and complaints.
- Consob, authorised firms and warnings about unauthorised sites.