Phishing wave in the name of the Ministry of Finance uses family allowance as bait
Summary
Why is this warning issued?
This warning has been included because it is based on a report from Watchlist Internet. It is intended to protect other users from this scam. The assessed risk is elevated.
How the scam works
- You receive an email that appears to come from the Federal Ministry of Finance and warns of data misuse related to family allowance payments.
- The message claims that in some cases family allowance payments have been redirected to foreign accounts, meaning entitled recipients have not received their money.
- You are pressured to act within a tight deadline (by the end of the week) and click a link such as 'Check and secure your data now'.
- On the fake portal you enter personal data: first and last name, email, date of birth, phone number, and address.
- You then select your bank from a drop-down menu, after which a deceptively realistic-looking bank login window opens.
- In this window you enter your online banking login details – and they end up directly with the criminals.
- Shortly afterwards, a second wave of fraud may follow (so-called 'Recovery Scam'): supposed bank employees call and offer help with 'recovering' the funds in order to extract more money.
How to recognise it
- The email supposedly comes from the Federal Ministry of Finance, but was sent via hacked company servers (e.g. @hirespace-sso.com, @nanomed-sso.com, @excelfixer-sso.com).
- The supposed verification portal has the domain finanzamt-familienbeihilfe-at.com – this is not an official government domain and was only registered in Belgium on 18 August.
- You are asked to enter personal data and, in the end, your online banking credentials on a page accessed via a link in the email.
- Threats are made about the loss of future family allowance payments if the 'verification' is not completed by the end of the week.
- Real ministries or government agencies do not send emails with direct links to external verification portals.
- You are not addressed personally but bombarded with a generic salutation ('Dear user').
- The texts exist in slightly modified versions – but the method and the intent are always the same.
- Generic salutation and time pressure
How to protect yourself
- Do not click the link in the email; instead, open the page manually in your browser by going to FinanzOnline yourself (not via the link).
- Never enter online banking login details on pages you have reached via an email link – real banks do not request this via email.
- If you have entered data: contact your bank immediately, explain what happened, and ask them to block your account.
- Change your online banking password immediately and monitor your account closely over the coming days.
- File a report with the police and collect all evidence (email, screenshots, timestamps).
- Remain alert to follow-up calls from supposed bank employees wanting to 'help' you – this is usually a second scam.
What you should never do
- Do not click the link in the email and do not download any attachments.
- Do not enter online banking credentials, passwords, or PINs on portals you have accessed via links from emails.
- Do not let yourself be pressured by deadlines – real authorities do not issue threats with deadlines by email.
- Do not transfer any money to supposed bank employees who contact you by phone after the incident claiming to 'limit the damage'.
- Do not reply to the phishing email and do not provide any further data over the phone.
Frequently asked questions
Do I actually have to expect my family allowance to stop if I don't respond?
No. This is a classic threat designed to pressure you into clicking. Real authorities do not send threatening emails with links or set deadlines by email. If you are unsure, log in to FinanzOnline directly and check whether a message is waiting for you there.
Where did the fraudsters get my email address and personal data?
It is not possible to say with certainty. Email addresses and personal data frequently circulate from old data breaches. It does not mean that the authority has passed on your data. Those affected are often people whose data has appeared somewhere online.
I have already entered my data and online banking login details – what should I do now?
Contact your bank immediately, explain what happened, and ask them to block your account. Change your online banking password, monitor your account closely, and report any unusual activity straight away. File a report with the police and secure all evidence (email, links, screenshots, timestamps).
How can I distinguish a real message from the Ministry of Finance from a fake one?
Check the sender address carefully (official domains end in bmf.gv.at, not in hirespace-sso.com or similar). Never click links in emails; instead, go to the official site yourself. Real authorities never request online banking credentials by email.
What is this 'Recovery Scam' and how do I recognize it?
Shortly after phishing incidents, supposed bank employees often call and offer to 'recover' lost money. This is a second scam. Real banks do not contact you unsolicited in this way, do not request payments, and do not ask for additional data over the phone. If in doubt, call your bank yourself – using the official number.
Affected data
Comments
No comments yet. Registered users can share their experiences.
Related warnings
- Phishing-Mails der ÖGK jetzt auch im Dialekt
- „Sie haben eine neue Nachricht“: Phishing-Falle im Namen der easybank
- A1-Phishing: Gefälschte E-Mails im Umlauf
- Phishing-Radar: Aktuelle Warnungen
- Phishing-Mails: Woran Sie sie erkennen und worauf Sie achten müssen
- Neue Gesundheitskarte: Betrugsversuche mit Phishing-Mails
Original source
Find more information in the original source.
Watchlist Internet ↗Update history
- 21/08/2026Description updated
- 20/08/2026Warning added from an official source