The Costa del Sol has a genuinely low rate of violent crime — something we examine in depth in our piece on How Safe Is the Costa del Sol? The Evidence Against the Perception. But digital fraud is a different threat entirely, and it disproportionately targets people who are new to Spain, navigating an unfamiliar bureaucratic system, often under time pressure, and sometimes operating in a second language. These are not random scams. They are engineered specifically for people in your position.
Here are the five you need to know before you arrive.
1. The Fake Rental Listing
This is the most common financial trap facing new arrivals on the Costa del Sol, and it has become more sophisticated. Scammers post listings for apartments and villas — often priced 15–20% below the market rate for the area — on Facebook Marketplace, and sometimes on Idealista itself via cloned advertiser accounts. The photos are real; they are simply stolen from legitimate listings elsewhere.
The script is consistent: the property is in high demand, you need to pay a holding deposit — typically via Bizum or direct bank transfer — to secure a viewing slot. Once the money moves, the listing vanishes. Bizum transactions are often irreversible, so recovery is unlikely.
The red flags are predictable. Scammers clone Idealista's branding to send emails from addresses like "idealista-verification@flat-confirm.com" — a domain that has nothing to do with the real platform. Legitimate Idealista emails come only from @idealista.com. More broadly, any payment request before a signed contract or in-person viewing is a serious warning sign. You should also never be asked to send passport scans or bank details simply to arrange a viewing.
The protection is straightforward: request a nota simple from the notary (€10–15, available online via the Registro de la Propiedad) to confirm the landlord actually owns the property. Search the listing photos on Google Images to check whether they appear on other, unrelated listings. And never pay anything — not even €50 — before you have physically seen the property and signed a contract.
2. The Fake Lawyer Scam
This one targets property buyers specifically, and the stakes are dramatically higher. Scammers pose as solicitors or property lawyers — sometimes using cloned websites, spoofed email addresses, or phone numbers that appear legitimate — and request deposits or legal fees for due diligence that never actually happens.
The most dangerous variant is the email interception scam. You receive what appears to be an email from your legitimate lawyer with updated bank account details for your purchase deposit. You transfer the funds — potentially tens of thousands of euros — only to discover later that the email was fraudulent and the money has gone to a criminal account. A Fuengirola court is currently investigating a case in which an Austrian couple's Marbella beachfront property was fraudulently transferred using forged passports and a counterfeit power of attorney, with the property sold for just €320,000 — a fraction of its real value — before the owners even knew what had happened.
The rule: always verify any change to payment instructions by calling your lawyer directly on a number you already have saved — not one provided in the email. Never transfer a deposit based solely on email instructions, no matter how official the message appears. Ask your lawyer for their número de colegiado (bar registration number) and verify it on the Colegio de Abogados website for the relevant province.
When buying new-build or off-plan property through Mava Signature, all developer payments go through verified, regulated channels with full contractual protection — one of the underappreciated advantages of purchasing through a structured process rather than ad hoc private arrangements.
3. The Hacienda Email and SMS Scam
This is the one that catches people who should know better, because it exploits a very specific anxiety: the fear of getting something wrong with Spanish taxes.
The mechanics are well-documented. Spain's Tax Agency (Agencia Tributaria, known colloquially as Hacienda) has itself published repeated warnings about waves of fake SMS messages and emails impersonating its communications. The messages claim you are owed a refund or face an urgent penalty, and they direct you to phishing sites that steal your banking details. Some campaigns are sophisticated enough that the fake message appears in the same SMS thread as genuine previous communications from the tax authority — a technique called spoofing.
The rule you need to memorise is absolute: Hacienda never initiates contact by email or SMS to request financial or personal information. The Tax Agency has confirmed explicitly that it never requests card numbers, bank account details, or personal data via email, nor does it send unsolicited attachments. Official notifications arrive through your secure online tax account (sede electronica) or by registered post to your registered address. If you receive a message claiming to be from Hacienda and asking you to click a link or confirm bank details, it is a scam. Forward suspicious emails to phishing@correo.aeat.es and delete.
The broader context makes this more urgent: in early 2026, investigations were underway into claims that a group called HaciendaSec had stolen a database containing personal data on tens of millions of Spanish taxpayers — including names, addresses, phone numbers, IBANs and tax information. Whether or not the full scale of that breach is confirmed, the data circulating on dark web markets means that scammers can now personalise their phishing messages with real taxpayer details, making fake Hacienda communications significantly more convincing than they used to be.
4. The Utility Company Phone Scam
You will receive this call within your first year on the Costa del Sol. Someone calls claiming to be from Endesa, Iberdrola, or another energy provider. They tell you there is a problem with your contract, that prices are changing, that you qualify for a special discount, or — in one common variant — that Iberdrola is offering a €50 social credit to your account and they just need your bank details to process it.
According to Endesa's own published data, one in every five domestic customers has fallen victim to these scams and had their energy supplier switched without their knowledge or consent. Endesa disclosed a significant data breach in January 2026 in which customer names, national ID numbers, contact details and IBANs were accessed — data that is now being used to make fraudulent calls more credible, since the caller may know your contract number or address.
The protection: both Endesa and Iberdrola have confirmed that they will never ask for personal information, passwords, or bank details via an unsolicited phone call, email, or SMS. Any legitimate change to your energy tariff must be notified in writing at least 30 days in advance. If you receive a call and are uncertain, hang up and call the company back using the number on your official bill or their verified website. Endesa has launched a free "Check who called you" tool on its website — paste in the number that called you and it will flag whether it is a known fraudulent number.
5. Why Your Gestoría Is Part of Your Security Infrastructure
Most of the scams above exploit a single vulnerability: the new resident who does not yet know how Spanish administrative systems work, and who therefore cannot distinguish a legitimate official communication from a fraudulent one.
A gestoría — a registered Spanish administrative agent — closes that gap. A gestor handles your NIE application, Padrón registration, tax filings, and any routine dealings with the Agencia Tributaria on your behalf. They know exactly which forms to file, through which channels, and what legitimate official contact looks like. When a suspicious email purportedly from Hacienda arrives, a 30-second call to your gestor confirms whether you have any outstanding matter that would prompt genuine contact — and almost always the answer is no, it is a scam.
The cost is modest: routine gestoría services typically run €25–75 per procedure, with annual tax filing packages available for €150–300 depending on complexity. Note that a gestor is not a lawyer — they handle administrative procedures, not legal disputes. For property purchases, NIE applications in complicated circumstances, or anything involving contracts, you need a qualified abogado (solicitor) as well. The two roles complement each other and together they constitute the professional network that every new resident should establish before anything else.
A note on cita previa appointments: criminal gangs using bots have been reselling free immigration appointments for €50–90 or more, turning a public service into a fraud market. Your gestor will handle appointment booking through legitimate channels, removing this exposure entirely.
The Broader Digital Picture
Spain ranks among the most targeted digital environments in Europe. According to the Global Anti-Scam Alliance, digital scams caused losses of more than €7.4 billion in Spain in 2024, with one in six citizens targeted by at least one fraud attempt in that year alone. Phishing — fake emails and messages impersonating banks, energy companies and government agencies — remains the primary attack vector.
The practical responses are not complicated. Use two-factor authentication on all financial accounts. Never click links in unsolicited messages, regardless of how official they appear — type URLs directly into your browser. Verify any payment instruction by phone before acting on it. And build your local professional network — gestor, abogado, and a trusted agent — before you need them urgently.
Digital vigilance is simply part of life in Spain, as it is in Toronto, Paris, or Zurich. The scams here have a local flavour — Hacienda instead of the CRA, Endesa instead of Hydro-Québec — but the mechanics are identical. The advantage you have, having read this, is that you now know what they look like before they land in your inbox. For the physical side of staying safe on the Costa del Sol, our guide to Petty Theft on the Costa del Sol: The Real Risk and How to Avoid It covers the practical street-level precautions in the same detail.