Lorraine Williamson
A warning from Spain’s cybersecurity institute has highlighted a worrying fraud risk during tax return season: online betting winnings appearing on a person’s Hacienda record, even when they have never placed a bet.
The alert comes from INCIBE, Spain’s National Cybersecurity Institute, which published a real case on 21 April involving a taxpayer who found betting income listed on their draft tax return. The person had not used online gambling platforms and contacted INCIBE’s cybersecurity helpline for advice.
A tax surprise that may point to identity theft
In the case described by INCIBE, the affected user discovered alleged profits from online sports betting while checking their declaración de la renta.
The person later remembered that they had once sent a selfie-style photo with their DNI during an online purchase verification. INCIBE said this raised the possibility that personal documents had been misused to create gambling accounts in the victim’s name.
For residents in Spain, the warning is timely. Tax return season often prompts people to check official records more closely, and unexpected income can have real consequences if not challenged.
Why online gambling fraud can affect Hacienda records
If a criminal uses someone else’s identity to register with betting websites, any supposed winnings may be linked to the victim’s tax profile.
That can leave the genuine taxpayer facing questions from the Agencia Tributaria over income they never received. It may also suggest wider misuse of their DNI, NIE or passport.
INCIBE advised the victim to follow the protocol for impersonated taxpayers through Spain’s gambling regulator, the Dirección General de Ordenación del Juego.
What INCIBE says victims should do
Anyone who finds unexpected online betting income on their tax return should gather evidence and report possible identity theft to Spain’s security forces.
INCIBE also recommends renewing the DNI in cases involving suspected document misuse, checking whether loans or credit have been requested fraudulently, and searching online for signs that personal data has been exposed.
The agency also points users towards the Guardia Civil’s online reporting system, where digital identification, such as certificado digital or Cl@ve, can be used.
How to reduce the risk when sharing ID documents
The case also carries a wider lesson for anyone in Spain asked to upload ID documents online.
INCIBE recommends making copies harder to reuse. That can include pixelating the photo or signature, converting the copy to black and white, and adding a watermark stating the exact purpose of the document.
These small steps do not remove all risk. However, they can make stolen documents less useful to fraudsters.
Help is available through Spain’s cybersecurity line
INCIBE reminded users that its cybersecurity help service is available every day from 8.00 am to 11.00 pm. The service offers support for doubts or incidents linked to online fraud, identity theft and digital safety.
For anyone checking their tax return, the advice is simple: do not ignore income you do not recognise. A strange line in Hacienda’s records may be the first sign that someone else has used your identity.
South American footballers scam exposed in Spain