Fake Mercadona '€40 food box' survey email leads to Azure-hosted lookalike page; Mercadona calls it a fraud

What happened

Spanish fact-checker Maldita.es reported on 20 October 2026 that an email supposedly from the supermarket chain Mercadona promises a food box worth €40 for answering a satisfaction survey. The link leads to a page at plagearleacajou.swedencentral.cloudapp.azure.com/mcfoodbox/ that imitates Mercadona's visual identity but has no connection to the official site mercadona.es, and asks for €2.95 supposedly to cover home delivery. Maldita warns that paying could sign the victim up to a paid online service with recurring charges they did not knowingly agree to. Mercadona's communications department told Maldita.es that 'it is a fraud', that the company does not run this kind of promotion or giveaway or hand out vouchers, that its brand and image are being used without authorisation, and advised not to give bank details or other personal information or make payments. Mercadona is not involved.

How the scam works

According to Maldita.es, the message arrives by email and asks the reader to answer a short satisfaction survey in return for a box of fresh food worth €40. The link leads to a page that copies Mercadona's visual identity, but the address is a long string under swedencentral.cloudapp.azure.com, a Microsoft cloud-hosting domain, rather than mercadona.es. The page then asks for a small €2.95 payment, presented as the cost of home delivery. Maldita warns that entering card details for that fee could sign the person up to a paid online service that takes recurring charges without their knowledge.

Mercadona told Maldita.es that it knows about these scams, is taking steps to limit them, and recommends checking its official profiles. Maldita's general advice for messages using a trusted company's name is to look at the web address before clicking, especially the part just before the last dot, which is the real domain; to check that the message comes from the company's official account; to stop and think, because these messages create urgency; and to check with the company or Spain's National Cybersecurity Institute (INCIBE) before giving any details. Microsoft's cloud service is being used to host the page and is not running the scam.

Source

Maldita.es, "Mercadona no está enviando un correo electrónico para regalar una caja de alimentos valorada en 40 euros: la empresa afirma que es 'un fraude'" (published 20 October 2026).