Argentina's Customs Collection and Control Agency (ARCA) issued a new warning about fake emails circulating that seek to steal taxpayers' bank accounts and tax data.
The scheme is part of a growing wave of cyber scams that use the agency's identity to appear legitimate.
The fraudulent messages pose as official ARCA communications and usually warn about alleged tax debts, audits or tax problems.
The goal is to create concern and urgency so that the recipient clicks on a malicious link, where they are asked for personal or banking information or their Tax Password.
In some cases, the emails even appear under the name of AFIP, the agency that was replaced by ARCA in 2024, which is a clear sign of fraud.
The agency was categorical: ARCA never requests payments, tax passwords or personal data by email, WhatsApp, social media or phone calls.
The only official channel for receiving notifications is the Electronic Tax Address, which is accessed with a CUIT or CUIL and Tax Password from the official website.
Emails may only serve as a notice that a new communication is available, but the content must be viewed within that secure platform.
What measures ARCA recommended to protect yourself
ARCA urged users not to reply to suspicious messages, open links or download attachments. It also recommended carefully checking the sender's address and being wary of any message that seeks to create urgency to make payments.
To strengthen digital security, it advised using strong passwords, changing them regularly and avoiding public WiFi networks for tax procedures.
In addition, the agency set up an official channel to report fraud attempts: taxpayers can forward the complete fraudulent messages to phishing@arca.gob.ar, which helps detect and block these schemes.
"Artificial intelligence is accelerating digital transformation, but it is also changing the way cybercriminals operate. Today it is possible to generate more sophisticated, personalized and harder-to-detect attacks," said Armando Catarralá, CTO of CertiSur.
"In that scenario, digital identity and validation mechanisms take on a strategic role in reducing risks without affecting the user experience," he added.
How many Argentines fell victim to hacking or fraud in the last year?
Regarding cyber incidents, a report by CertiSur itself showed that 43% of users fell victim to hacking or fraud during 2025 and the first months of 2026.
Specifically, the most reported method is identity spoofing or phishing, carried out through channels such as:
- WhatsApp (31%)
- Email (23%)
- Phone calls (20%)
"Users' trust when browsing the Internet no longer depends solely on technology, but on the ability to validate identities, protect information and offer simple processes that give users certainty," summarized Néstor Markowicz, COO of CertiSur.
Source:iProUP