A certified email can contain a scam: what to check before paying

GRISK Editorial Team · 2026-10-28

A payment request arrives at the office, refers to a traffic offence and warns that the amount will increase unless action is taken immediately. The sender uses PEC, Italy’s certified email system. For anyone managing deadlines, invoices and company vehicles, that combination can lower their guard. That precise step—from trusting the channel to trusting the request—deserves an additional check.

On 27 October 2026, CERT-AGID reported phishing campaigns observed over the preceding week: compromised PEC accounts were being used to send fraudulent requests in the name of PagoPA. In the two cases described, the messages reached an ordinary email account, with around 340 PEC addresses copied in. The supposed fine was €198, rising to €268 if payment was late. The link led to a fake portal asking for personal data. [1]

Hardware Upgrade covered the report on 28 October. This is journalistic coverage of the same technical analysis, rather than a second independent investigation. The sources considered here do not document the number of victims or losses from these specific campaigns. [2]

The check must also cover what is being requested

CERT-AGID warns that a message originating from PEC does not automatically make its content legitimate. [1] For a business, the operational implication is clear: the sender’s address should not be enough to authorise a payment. The request must be linked to a verifiable event and to a party that actually has the authority to make it.

This approach can also be applied to unexpected invoices, reminders and changes to bank details: these are suggested business controls, rather than additional confirmed incidents in the campaign described above. The aim is to avoid leaving the recipient to decide solely on the basis of the message’s formal appearance.

PagoPA states in its help centre that it does not directly send payment requests by email and advises checking with the creditor organisation. This does not mean that every message from an organisation concerning a payment through pagoPA is fraudulent: each request must be verified, without relying on the brand displayed in the message. [3]

A short verification, through a separate channel

Business administration teams can benefit from a simple sequence, with an identifiable person responsible for each step.

First, establish the reason for the payment. If a vehicle is involved, compare the registration number, period and user with internal records. For a supply, retrieve the order and the relevant contact. A plausible match allows the verification to continue; it does not replace confirmation from the organisation or counterparty.

Then, use an independent channel. Open the organisation’s official website using an address already known or found separately, without following the button in the message. PagoPA also recommends this precaution. [3] If a telephone call is needed, use a number verified elsewhere and note which office answered.

Finally, record the authorisation. A short note should identify who checked the request, through which channel and with what result. For anomalies, arrange a second check before payment, particularly when a supposed urgency is used to request an exception to the normal procedure.

Pausing a payment to verify it does not mean ignoring a potentially real deadline. The request should be assigned promptly to someone responsible for the check. Leaving it without an owner creates the opposite risk: discovering too late that it was authentic.

If someone has already interacted

The first information to gather is what happened: merely opening the message, visiting the website, entering data or making a payment. These are different situations and should be described accurately to whoever provides assistance, avoiding rushed reconstructions or improvised changes to devices.

As an organisational measure, preserve the original message, any attachments, timestamps and receipts, limiting circulation to those responsible. If banking data or money is involved, contact the bank immediately through its official channels and approach the competent authorities. PagoPA accepts reports of suspicious messages at truffe@pagopa.it, while making clear that such a report does not replace contacting the bank or reporting the matter to the authorities. [4]

The most useful measure to introduce today is a rule everyone can understand: an unexpected request must undergo a documented check before authorisation, even when it arrives through a channel normally considered trustworthy.

GRISK can support businesses in checking counterparties and reconstructing relevant corporate and reputational connections when a suspicious request involves commercial relationships.