CERT-AGID: fake Polizia di Stato traffic-fine SMS leads to poliziadistato.info card phishing
CERT-AGID warns of SMS messages claiming an unpaid Rome GRA traffic fine from the Polizia di Stato, linking to poliziadistato.info to collect personal and payment card data.
- First reported
- Reports
- 1
Source: cert-agid.gov.it · published
What happened
Italy's CERT-AGID reported on 16 October 2026 that it had received a report of a fraudulent SMS that uses the theme of traffic fines and the name of the Polizia di Stato (Italy's State Police) to push recipients into paying through a non-institutional website.
The message refers to an alleged fine on Rome's Grande Raccordo Anulare (GRA) ring road and offers a reduced payment of 17.00 euro due the same day, threatening a 291 euro penalty and the loss of licence points if it isn't paid. CERT-AGID quotes the text: 'Multa GRA Saldo ridotto 17,00 € scade oggi. evita sanzione 291€ e perdita punti. Procedi: hxxps://poliziadistato[.]info/it'.
The link points to poliziadistato[.]info, which uses the police force's name to appear credible but is not its official domain, poliziadistato.it. The Polizia di Stato is being impersonated and is not involved.
How the scam works
CERT-AGID says the campaign relies on urgency and fear of financial and administrative consequences: a well-known road, a small-looking amount and a same-day deadline are designed to make people act without checking. Following the link may take the user to a fraudulent page built to simulate an official service and collect personal information and payment card details.
CERT-AGID lists the warning signs as artificial urgency, psychological pressure, a small initial amount, abuse of an institution's name and a link to a non-institutional domain, and stresses that a link received by SMS should never be trusted just because of the name it uses. It has requested takedown of the domains hosting the phishing pages and shared the indicators of compromise with accredited organisations.
If you entered card details, CERT-AGID advises contacting your bank promptly through official channels to consider blocking the card. Suspicious messages can be forwarded to malware@cert-agid.gov.it, ideally with the full SMS text and link.
Source
CERT-AGID, "Smishing a tema multe: SMS fraudolenti sfruttano il nome della Polizia di Stato per richiedere pagamenti urgenti" (16 October 2026).
Red flags
- An SMS about a traffic fine with a same-day 'reduced payment' deadline.
- Threats of a much larger penalty and loss of licence points.
- A link to a domain that uses an institution's name but isn't its official site (poliziadistato.info instead of poliziadistato.it).
If you were targeted
- 1Don't click the link or enter personal or card details.
- 2Check whether a fine exists through the issuing authority's official channels, reached on your own.
- 3If you entered card details, contact your bank through official channels to block the card.
- 4Forward suspicious messages to CERT-AGID at malware@cert-agid.gov.it.