Key Takeaways
Why this mattered. A text claiming to be from the Dutch Tax Administration pushed a payment deadline and linked to a non-official domain.
What stood out. The sender was a private mobile number, the message was generic, and the URL used a disposable dynamic-DNS host rather than the official government domain.
Safe steps. Do not click or reply; block the number; report the message to the Dutch Tax Administration’s phishing mailbox.
Story & Details
The message. The text announced an “outstanding debt with reference PX103,” said it remained unpaid “after several reminders,” ordered payment before “20-11-2025,” and pointed to a link on a subdomain ending in ddns.net. The phone interface flagged the sender as an unsaved number and displayed a built-in warning about impersonation fraud.
Why the link exposes the ruse. The Dutch Tax Administration (Belastingdienst) does not ask anyone to transfer money through links in SMS or chat. Official digital correspondence lives behind secure government portals, and payment instructions arrive through formal letters or verified channels. A dynamic-DNS address is a common throwaway location used by scammers because it is easy to create and abandon.
The pressure play. The deadline and the claim of repeated reminders are classic urgency triggers. Paired with a generic salutation and no personal details, this pushes recipients to act before verifying anything.
How to respond safely. Open nothing, reply to no one, and preserve a copy for reporting. Forward suspicious messages to the Belastingdienst’s dedicated address. If you are worried about real debts or letters, check only through official portals you navigate to yourself, not through a link in a message.
Conclusions
A private mobile sender, a generic script, and a payment link on a dynamic-DNS host together signal phishing, not a legitimate tax demand. Caution is simple here: avoid the link, keep your information to yourself, and use official channels to verify and report. Calm beats urgency; independence beats any link in a text.
Selected References
[1] Report a suspicious message (SMS or WhatsApp) — Dutch Tax Administration (Belastingdienst). https://www.belastingdienst.nl/wps/wcm/connect/bldcontenten/standaard_functies/individuals/contact/scams_and_fake_messages/report-suspicious-message/suspicious-message-sms-whatsapp-report
[2] How to report a suspicious SMS — Belastingdienst (Dutch). https://www.belastingdienst.nl/wps/wcm/connect/nl/contact/content/verdacht-sms-bericht-melden
[3] “Sms Belastingdienst is nep” — Fraudehelpdesk (Dutch). https://www.fraudehelpdesk.nl/alert/sms-belastingdienst-is-nep-2/
[4] One in ten Dutch people scammed online last year — Government of the Netherlands. https://www.government.nl/latest/news/2024/10/09/one-in-ten-dutch-people-scammed-online-last-year
[5] Examples of fake messages — Belastingdienst (Dutch). https://www.belastingdienst.nl/wps/wcm/connect/nl/contact/content/voorbeelden-van-valse-whatsapp-berichten-sms-berichten-mails-en-brieven
[6] Chamber of Commerce (KVK) explainer video on phishing (public, institutional). https://www.youtube.com/watch?v=NqDdtKncQN4
Appendix
Belastingdienst. The Netherlands’ Tax and Customs Administration, the national authority that never asks for payments via links in SMS or chat.
DDNS (dynamic DNS). A service that maps a changing IP address to a stable name; frequently abused by scammers to spin up disposable web addresses.
Phishing. A social-engineering tactic that impersonates trusted institutions to harvest credentials or money, often by pushing malicious links, attachments, or urgent payment claims.
SMS spoofing. The manipulation of sender information in text messages so a fraudster can appear as a trusted number or brand.
Verification best practice. Navigate to official portals by typing the address yourself or using saved bookmarks; never from a link in a message.
My Diary - Leonardo Cardillo 