Scam with fake emails to replace the Health Card, the alert from the Ministry of Health

Fraudulent emails invite the user to click on a link to proceed with the renewal of the Health Card. The link takes you to a fake website, graphically similar to institutional platforms, where you are asked to fill out a form with numerous personal and sensitive data. The collected data can be used for illicit purposes, such as reselling information, cloning documents, or other fraudulent activities.

For further information: Health card scam, how it works and how to protect yourself from phishing

Ministry of Health

Last April the Ministry of Health reported a similar scam attempt, with false emails in which the user was invited to click on a link to update their data in the electronic health record. This led to a fake website where one was asked to fill out a form with numerous personal and sensitive data, including banking details.

The Revenue Agency explains that to defend oneself from this type of attack it is always necessary to keep in mind that the most effective tool is the conscious use of IT tools. To minimize the risks of falling into one of these traps, it is essential to adopt a series of precautions when using mail and the internet.

The first step is to ask yourself if the message comes from a known sender, then checking if it is written in correct Italian. Again: is it addressed personally to the person receiving it? Is it well "constructed", i.e. are the characters used consistent or does it look like a botched copy and paste? Does the discussion "flow" smoothly and make complete sense? Even just one of these shortcomings is enough to prudently consider the message as dangerous.

If there are links in the message, the first check to do is whether, when the mouse is hovered, the link matches the text. It is always advisable to be wary of shortened links (for example those of the bit.ly type) which do not allow you to know in advance what the destination address is. If there are attachments, you should always check that they have only one extension (for example .docx and not .docx.exe). In case of doubts about the real origin of a document received by email, rather than opening it, it is preferable to contact the sender by another means (a telephone number or an official email address) and ask for confirmation. The Revenue Agency never sends communications containing taxpayers' personal data by email. Ultimately, the most effective line of defense against cyber attacks of this type is presence of mind, supported by common sense and a pinch of attention.

Be careful because some scams travel through text messages, in this case they are called "smishing". The mechanism is the same as that of emails, with fake institutional senders who deceive users by trying to send them to links to websites where personal data, access credentials and financial information are stolen.

See also: Revenue Agency, new scam with fake email about tax refund available