Italian residents are receiving fake traffic fines from certified email accounts that look entirely official, because the accounts are real, just hijacked. Italy's national CERT, CERT-AGID, says that over the past week it has seen several phishing campaigns sent through compromised PEC mailboxes, demanding payment in the name of PagoPA, the government's payments platform.
PEC (posta elettronica certificata) is Italy's legally recognized certified email, used by public bodies, businesses and professionals for official correspondence. A fine arriving by PEC carries an authority that an ordinary email does not, and that is exactly what the attackers are borrowing.
A formal notice with a ticking clock
In the two most recent cases CERT-AGID analyzed, the message was sent from a compromised PEC account to an ordinary email address, with about 340 PEC addresses copied in. It poses as an administrative order for a supposed Highway Code violation, written in heavy legal language with many references to the law, and demands 198 euros by a near deadline, threatening to raise it to 268 euros if payment is late.
A button labelled "Accesso al portale istituzionale" (access the institutional portal) leads to a .ru domain that copies PagoPA's logos and design. In both cases, CERT-AGID says, the pages were hosted on infrastructure traceable to a Russian hosting provider. The site asks for the victim's first and last name, codice fiscale (tax code), date of birth, email address and phone number.
The scammers steer each victim live
The more interesting finding sits in the page's code. Every half second, the page asks a management panel on the server whether there are new instructions, through a script that polls ../panel/classes/processor.php. When the operator sends one, the browser is redirected to the next screen. CERT-AGID says those screens appear designed to collect payment card details and bank verification codes, and that the setup could let criminals walk each victim through the fraud and adapt their requests to whatever they still need to complete it.
1,874 campaigns and counting
Fake fines are nothing new. Since 21 April 2025, CERT-AGID has catalogued 1,874 fine-themed phishing campaigns abusing the PagoPA and SEND brands, and distributed 14,279 indicators of compromise to public administrations subscribed to its IoC feed. PagoPA-branded campaigns outnumber SEND-branded ones by almost two to one. We covered an earlier variant, a fake PagoPA refund, in September, and fake fines topped Italy's phishing week in August. More context on the country's threat picture is on our Italy profile.
Verify fines on official portals, never through the link
CERT-AGID has started takedown work with PEC providers and shared the campaign's indicators with accredited organizations through its feed. Its advice is direct:
- A message arriving from a PEC address does not prove it is legitimate.
- Check any payment request directly through the official channels of the body concerned, without using links in the message.
- Be wary of unexpected PEC messages about invoices, payments or reminders, even when the sender looks genuine, and forward suspicious ones to CERT-AGID for checking.
The campaign works because PEC was built to be trusted. Once an attacker controls a real certified mailbox, that trust becomes the lure.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.