A text says I have an unpaid fine. How do I know whether it is real?

The text says a penalty is outstanding, that the amount expires in a few hours, and that to avoid it doubling you have to tap a link. The sender is called something like “Polizia” or “pagoPA”. And as you read it, you are already running through the times you might have done something wrong at the wheel.

That mental list is exactly why the message works.

The short answer: a text message is never the formal notice of a fine. In one specific case it can be an alert telling you to go and check somewhere else. But it is not the place where you look at the document, and it is not the place where you pay. Below is why, and above all how to check it in ten minutes without touching anything.

How a fine actually reaches you

The boring part, which is also the only one that gives you a rule.

Article 201 of the Codice della Strada, the Italian highway code, lists the ways a penalty can be served: traffic police officers, municipal process servers, an official of the authority that established the offence, the forms set out in the code of civil procedure, the postal service. Text messages are not there. Email is not there. WhatsApp is not there. The notice has to arrive at the residence or domicile shown in the vehicle registration document, in the national vehicle archive or on the driving licence, and there is a deadline: ninety days from the time the offence was established, after which the obligation to pay lapses for anyone who was not served in time.

Since 2023 there has also been a digital route, and here it gets a little more complicated. It is called SEND, PagoPA runs it, and it can be used by local councils, so by the Polizia Locale too for traffic tickets, and by collection agents for tax demands. But SEND does not send you the document. It sends you an avviso di avvenuta ricezione, which tells you a notification exists, gives you an identifying code and explains how to get into the platform. You download the actual document by logging into SEND with SPID or CIE, Italy’s digital identity schemes. If you have a PEC, Italy’s certified email, registered in the public directories, that notice arrives there. If you do not, it arrives on paper, by registered post.

And here is the thing no popular article says all the way through.

Yes, a text message can be genuine. But it is not the fine

Article 26 of decree law 76 of 2020, at paragraph 7, provides that if you have given a non-certified email address, a phone number or another digital contact point, the platform operator sends you an electronic courtesy alert carrying the same information as the avviso di avvenuta ricezione. That information is listed at paragraph 4: that a notification exists, its unique identifier, and how to reach the platform. So a text message from SEND can exist.

Three things fence it in, and all three can be checked.

The first: it only arrives if you gave them that number. SEND’s security page is explicit: it contacts you by text, email or the app IO only if you have chosen those as your courtesy contact points, and if you have not set them up and you receive messages with urgent demands for payment, it is probably a scam.

The second: it has no legal effect. The platform’s operating manual says so, and its only purpose is to let you see the document sooner.

The third, which is the one that counts while you have the phone in your hand: that list at paragraph 4 has no amount in it and no payment. SEND’s frequently asked questions say that if you receive an email or a text you have to log into SEND to see the documents and pay any costs. The route goes through authentication with SPID or CIE, always.

One thing I could not find documented anywhere, and I say so because it is precisely the question a reader will ask: no official source publishes the exact wording of SEND’s courtesy text message, so I cannot tell you whether it contains a tappable link or not. The law says “the same information”, and the platform manual states that it does not describe the content of the message. I am trying to verify it on a phone with a registered number, and when I have it I will update this article.

In the meantime, the rule that holds either way: even if a genuine text message points you to SEND, you do not need that link. You can get to SEND on your own.

What the Polizia Postale said, and how to read it

On 5 August 2026 the Polizia Postale, the Italian cyber police, published a notice about this exact scam. The key sentence: the Polizia di Stato does not serve traffic tickets or administrative penalties through text messages, messaging apps or links sent to mobile devices.

It should be read for what it says. It is talking about the Polizia di Stato as the body doing the serving. It is not a denial that SEND, on a council’s behalf, might send you a courtesy alert. The two things live side by side, and reading only the first one risks making you ignore a genuine message.

The right way to hold them together is this: a text message is never the formal notice; it can be, if you gave them the number yourself, an alert sending you to check on SEND; and in no case is it the channel on which you pay.

Around the same time CERT-AGID, the incident response centre for Italian public administration, described the fake campaign, and the technical detail deserves telling because it teaches more than any generic warning. The fake site presents itself as a Polizia Stradale portal for looking up traffic tickets. It asks for the vehicle’s registration plate and the owner’s codice fiscale, the Italian tax number. Then it shows a statement with an offence that does not exist and a discounted amount of 42 euro if you pay within fifteen days. Then it imitates the pagoPA payment page, naming Agenzia delle Entrate-Riscossione, the Italian revenue agency’s collection arm, as the creditor, while staying on the scam site’s own domain. At the end it asks for the cardholder name, the card number, the expiry date and the CVV.

Forty-two euro. Not four thousand. An amount that sets off no alarm, that you pay just to stop thinking about it. The same mechanism turned up in September 2026 in a campaign about vehicle tax that ACI reported: there the amount was 15.87 euro.

The sender proves nothing, and there is an Italian source that says so

The most solid technical point in the whole article.

On 1 April 2026 the Agenzia delle Entrate, the Italian revenue agency, published a notice stating that the sender of certain text messages is counterfeited using the technique of sms spoofing, which fakes the sender’s number, and that it is a system similar to the one seen with marketing calls. That is an Italian institution certifying that the name at the top of the message is not proof of authenticity.

Worse: the fake message can land in the same conversation as the genuine ones. If the phone groups messages by sender name, and the name has been faked, the scam message slips in underneath the legitimate ones. There is no dividing mark of any kind.

Two clarifications that remove two very common shortcuts.

A register of SMS aliases does exist in Italy. AGCOM, the Italian communications regulator, set it up with decision 12/23/CIR of May 2023: anyone sending messages with an alphanumeric sender has to be registered, using an unregistered alias is forbidden, and providers have to block attempts to send with aliases not registered in their name. But as of 14 October 2026 I have not found any public lookup that lets a member of the public go from an alias back to its holder. So I cannot tell you to “check the AGCOM register”, because it is not a tool for you.

And the anti-spoofing filter that was talked about so much in 2025 covers phone calls, not messages. AGCOM brought it in in two phases, August and November 2025, and the stated numbers are large: around 49.3 million unlawful calls from Italian mobile numbers blocked in the first eleven days of the second phase, around 56% of the incoming calls from abroad using an Italian mobile number. None of those documents mentions text messages. In parallel, in January 2024 the Lazio regional administrative court struck down precisely the provision that would have required blocking text messages from abroad with an alphanumeric sender, holding the legal basis insufficient and the reasoning generic. The rest of the regulation stands, that part does not.

So, for a reader: on calls, something is moving. On text messages, today, the network filter that ought to stop a faked institutional sender arriving from abroad is not there.

How to check, without touching the link

1. Do not touch the link. Not out of general caution: because you do not need it. Whatever that message says, the same information can be found by starting from scratch.
2. Open SEND by typing the address by hand: notifichedigitali.it, and log in with SPID or CIE. If there is a notification for you, it is there, and any payment slip is attached to the document. If there is nothing, there is nothing.
3. Check the app IO, if you use it. SEND sends courtesy messages there, and you can see the served documents from it.
4. Ring the authority, finding the number yourself. Not the number in the message. The Polizia Locale command of the council where the offence supposedly happened, or Agenzia delle Entrate-Riscossione if the message is about tax demands. The Polizia Postale, PagoPA and the Agenzia delle Entrate all advise this, all three in the same words: contact the authority directly using official contact details.
5. Report it and delete it. PagoPA asks you to forward it to truffe@pagopa.it, and accepts a screenshot of the text message on its own. The Polizia Postale's reporting form is at commissariatodips.it, and it is not a criminal complaint: it is a report, useful because it allows checks to be made and alerts to be issued.

One check I cannot recommend with the same confidence: reading the link without opening it. PagoPA explains the technique, but describes it for someone browsing on a computer, that is, hovering the mouse over it without clicking to see the real address. On a phone that gesture does not exist, and I have not found any institutional source explaining how to do it on a smartphone. There is the long press on a link, which on many phones shows the address in a preview, but the behaviour changes from app to app and I have not tested it systematically. When in doubt the rule above applies: start again from the beginning instead of inspecting.

A concrete detail for recognising the fake site, if you have already ended up on it. In the two campaigns documented in 2026 the domain looked like the real one but with the wrong extension: names containing “poliziadistato” with a suffix other than .it, and acitalia.info or acitalia.click instead of aci.it. And in both cases the payment page stayed on the scam site’s own domain. A legitimate pagoPA payment does not happen on the site that brought you there, and it does not ask you for your CVV at the end of a journey that started with a message.

If you have already paid

This needs to be precise, because it is the point where you read the most mistaken promises. Italian law distinguishes two situations, and only one of the two gives you a right to a refund.

The first is the unauthorised transaction: you entered your credentials on a fake site and then somebody else ordered a payment with your details. Here article 11 of legislative decree 11 of 2010 says the bank refunds you immediately, and in any case by the end of the business day following the one on which it becomes aware of the transaction. It can suspend the refund only where there is reasoned suspicion of fraud, notifying Banca d’Italia in writing, and it can ask for the money back if it later shows the transaction was authorised. Article 12 adds the excess: no more than 50 euro borne by you, unless you acted fraudulently or with intent or gross negligence, in which case you bear the whole loss. No loss at all, on the other hand, if the bank did not require strong authentication.

That “gross negligence” is the point people really fight over, because the law does not define it and banks use it to refuse a refund to anyone who typed their credentials into a fake site. I have not gone into the case law of the Arbitro Bancario Finanziario, the Italian banking ombudsman, so I am not telling you where that threshold sits today: I do not know.

There is something moving on this, and it needs telling carefully because out there it has already become a judgment that does not exist. On 5 March 2026 the advocate general of the Court of Justice of the European Union delivered an opinion in case C-70/25, the case of a Polish customer who fell for phishing and was refused a refund by her bank for gross negligence. The proposal is that the bank should refund at once, save for reasonable grounds to suspect fraud, and should then be able to claim the money back if it establishes gross negligence, going to court if need be. An advocate general’s opinion does not bind the Court, and here I have to declare a limit: a ruling appeared to be listed for 12 October 2026, two days before I wrote this, and I could not get hold of the text. So I cannot tell you how it went, or even whether it has gone. What I can tell you is what not to expect: even if the Court follows the advocate general, the result would not be “you get your money back and that is that”, it would be that the burden of making the next move passes to the bank, which can then ask you for the money back and, if you refuse, take you to court. If this matters to you, find the judgment before trusting what you read about it.

The second situation is the one where you paid. You entered the card details, you confirmed, or you made a bank transfer. There is no right to a refund. Article 24 of the same decree says that an order carried out in accordance with the unique identifier is deemed to have been carried out correctly, and what you are left with is: the bank’s duty to make reasonable efforts to recover the funds, the duty of the recipient’s bank to cooperate, and the right, on written request, to obtain the information you need in order to go to court. The costs of the recovery attempt may fall on you, if your contract provides for that.

There is no chargeback on bank transfers: chargeback belongs to the card schemes’ own rules, not to any provision of law. On cards you can make the request to your bank, and it often works, but I have not verified it against an Italian institutional source and so I am not presenting it to you as a right.

However it went, the order of things to do is the one PagoPA sets out and it does not change: ring the bank straight away to block the card and transactions, then make a criminal complaint. Filling it in online on the Polizia Postale site saves time, but the official page warns that what you get is a receipt with a reference number and that you still have to go to an office for the complaint to proceed. That page is from 2019, modified in 2021: if this matters to you, check that the procedure is still this one.

To understand what sits underneath

The faked sender mechanism is the same one used in phone calls and in email, and it is worth seeing whole: I wrote about it in Spoofing: why the number and the sender you see prove nothing. If what you want instead are the signs to look for in a suspicious message, that is in How to spot a scam text message: the signs of smishing and what to do. And if you have already touched the link, the order of operations is in I clicked a scam link: what to do in the first two hours.