INCIBE warns that corporate fraud is no longer limited to email: SMS, calls, messaging, and QR codes
INCIBE notes that, according to its 2025 Cybersecurity Balance, online fraud accounted for 4 out of every 10 incidents, with phishing remaining at the forefront. Campaigns now combine email, SMS, calls, instant messaging, and QR codes.
News summary
In a publication from its business section dated 8 October 2026, INCIBE highlights that, according to its 2025 Cybersecurity Balance, online fraud represented 4 out of every 10 managed incidents, with phishing leading the list.
The organisation describes how campaigns have become multi-channel: they may start with an email, continue via WhatsApp or Teams, be followed up with a phone call, and end on a fake website or with a request to change bank account details. Traditional techniques are now supplemented by SMS, QR codes, ads, and content generated by artificial intelligence.
On that same day, INCIBE and the OCU warned of an SMS and email campaign impersonating the DGT with fake fines, an example of how deception builds credibility by using well-known organisations.
For a company, the consequence is that protecting the inbox alone is no longer enough. The weak point is usually a process: who is authorised to change an IBAN, how an urgent request is verified, and what an employee does when something does not add up.
Source: INCIBE — 8 October 2026
Frequently Asked Questions
- What should I do if an employee has fallen victim to fraud?
- Contact the bank immediately to attempt to stop the transfer, change the affected credentials, preserve any evidence, and report the incident. INCIBE offers the 017 cybersecurity helpline.
- Does an anti-spam filter prevent this type of fraud?
- It significantly reduces malicious email, but does not cover SMS, calls, or messaging. Therefore, filtering, verification processes, and training must be combined.
Concepts mentioned in this article: Cybersecurity · Phishing
Fraud targets the weakest process, not just email. At Seintec, we strengthen your filtering, access controls, and verification procedures. Speak to our team.
Contact SeintecRelated service
Antispam
Managed protection against spam, phishing, and malware.