PACS protects Spanish taxpayers from online gambling ID fraud
With the start of the 2025 tax campaign, digital security and tax integrity are once again at the center of public debate in Spain. The Directorate General for the Regulation of Gambling (DGOJ) has reactivated the Protocol for Action for Impersonated Taxpayers, an essential coordination tool alongside the Tax Agency and police forces. This mechanism emerges as an urgent response to protect citizens who discover, with surprise and concern, that their personal data has been used by third parties to bet on digital platforms, generating tax gains that the victims never received but that the Treasury is claiming.
The magnitude of the problem is significant, and official figures for 2025 reflect an upward trend that necessitates extreme caution. Over the past year, more than 8,600 complaints of identity theft linked to gambling activity were recorded, representing a 12 percent increase compared to the previous period. This phenomenon now affects almost 16,000 active gaming accounts, a volume that represents approximately 4 percent of the total census of bettors in the country and has raised alarms about the vulnerability of personal information in the digital environment.
A particularly revealing finding in the DGOJ's analysis is the marked difference between the profile of the regular player and that of the impersonation victim. While the recurring user of these platforms is typically a young man between 18 and 25 years old, those who suffer data theft are predominantly women and people over 26 years old. This shift in the criminal target suggests a deliberate strategy by fraudsters to seek profiles that, a priori, would not raise immediate suspicions in the monitoring systems of gambling operators.
The resurgence of these illicit practices appears to be closely linked to a recent regulatory change in the Spanish market. The reappearance of welcome bonuses, following the annulment of certain restrictions by the Supreme Court, has acted as a catalyst for fraud. Promotional incentives, which revitalized the casino and sports betting sector, are the main driver for the massive creation of fake accounts. This phenomenon explains why the casino vertical has doubled its incidence in impersonation cases in just one year, rising from 7 to 18 percent of registered cases.
Authorities have managed to classify four patterns of criminal behavior that frequently recur through the PACS protocol. First, there are individuals registered in the self-exclusion registry who try to circumvent the prohibition using the identities of family members or acquaintances. Added to this is the access of minors using other people's data and the technical sophistication of using bots to operate accounts automatically. Finally, bonus fraud remains the main reason for the misuse of other people's identities, as it allows a single individual to claim multiple welcome incentives on different platforms.
As an additional preventive measure, the regulatory body keeps the Phishing Alert service fully operational. This tool allows any citizen to register to receive immediate alerts in their email if someone tries to open a gaming account using their personal data. In this way, Spain seeks to close in on fraudsters and ensure that the iGaming industry continues to operate under transparency standards that do not harm the financial health of citizens unrelated to this activity.
Tags: Spain, online betting Spain, KYC Spain betting, PACS protocol Spain