How to Spot Phishing Sites Impersonating Italian Bollo Auto Calculators

Vehicle owners in Italy often use online calculators to estimate the regional bollo auto before the payment deadline. Criminals exploit that routine by building phishing pages that look like official tax portals, aiming to steal payment card details and personal data. This guide sets out the concrete signs that separate a legitimate estimator from a fake one and what to do if you land on a suspicious page.

Check the domain and URL first

Fraudulent bollo auto sites usually rely on a domain that appears official at a glance. Look for extra words or hyphens, such as bollo-auto-pagamento.com or bollo2026-italia.net, which are not official regional portals. Genuine Italian public administration pages generally sit under a .it domain belonging to the region or the national administration, not on a random .com page. If the address bar shows a long string of numbers, an IP address, or a subdomain that does not match the claimed institution, close the page.

Check the domain age and registration if you can. A domain registered only a few days ago is a common sign of a throwaway phishing site, though not every new domain is malicious. The key is to compare the address with the official regional website you already know, and never trust a link sent by email or SMS without checking the destination.

Read the page like an Italian official

Phishing pages often contain machine-translated Italian, awkward phrasing, or a mix of languages. Legitimate bollo auto guidance is published in Italian, the official language in Italy, San Marino, Vatican City and the Swiss canton of Ticino, so the text should read naturally and use standard administrative vocabulary. They may use urgent countdown timers, claim that your vehicle tax is overdue, or ask for details that a bollo calculator does not need, such as your full tax code, card PIN, or online banking credentials. A legitimate estimator typically requests only vehicle class, region of residence, power in kW or CV, emission standard, and the months to pay; it should not demand payment card details before showing an estimate.

Also look at the footer. Legitimate public administration sites include clear contact information, privacy policies, and references to the responsible office. A missing or fake imprint, a generic email address, or no way to contact anyone should raise suspicion.

Compare with a trusted Italian calculator

Before entering any personal information, cross-check the estimate against a known source. For a quick sanity check, a free Italian-language tool such as Calcolo Bollo Auto publishes 2026 tariffs for all 20 Italian regions and can help you spot an estimate that is suspiciously different from your region’s official figure. If a site returns the same number regardless of your region or vehicle power, treat it as unreliable. The official regional portal remains the only place to confirm the exact amount due and make the payment.

Inspect the payment step carefully

Legitimate bollo auto payments generally take place through official regional or national payment channels, not through a random card form on an unfamiliar page. A fake site may instead show a card payment form and pressure you to pay immediately. Check that the payment page belongs to a payment provider you recognise, that the certificate is valid, and that the URL does not switch to a different domain at checkout. HTTPS and a padlock are necessary but not proof of legitimacy; attackers can obtain certificates for look-alike domains.

If you are asked to pay through an unusual method, such as a gift card, cryptocurrency, or a direct transfer to a personal IBAN, stop immediately. No legitimate bollo auto payment system uses those channels.

If you suspect a fake page

Close the tab without entering any data. Find your regional portal through a search engine or by typing the region’s official website directly. If you already entered card details or credentials, contact your bank or card issuer immediately, change any reused passwords, and consider reporting the site to your local police or the national cybercrime reporting channel. Keep screenshots of the fake page and the URL to help investigators.

You can also look up whether the domain has been reported by searching for the site name plus Italian words such as ‘truffa’ or ‘phishing’. The absence of reports is not proof of safety. For the latest official warnings, check the websites of ACI and the Agenzia delle Entrate directly.