Fake DIAN emails: how to spot them and check what you owe

An email, text or WhatsApp message saying you owe DIAN money, that your bank accounts are about to be frozen, or that your RUT will be suspended, with a file or a link to "see the notification", is very likely fake. Real DIAN email comes only from addresses ending in @dian.gov.co, carries a code you can check on DIAN's own website, and never includes a link to pay. Don't open the attachment. Log in to DIAN's online services yourself and see whether anything is really pending.

What the fake messages look like

DIAN is Colombia's tax and customs authority. Scammers use its name because a tax threat scares almost everyone. The messages arrive in Spanish and use a few words worth knowing: embargo (a freeze or seizure of your bank accounts or property), sanción (a fine), mandamiento de pago (a formal order to pay) and RUT (the tax registry that gives you your tax number, or NIT). Two invented examples, translated:

From: DIAN Notificaciones <avisos@dian-notificaciones.co>. Subject: Embargo notice. You have an unpaid income tax debt and your accounts will be frozen today. Download the attached payment order (Notificacion_DIAN.zip, password 2026). Verification code: 8F3K-22QX.

DIAN: your RUT will be suspended for inconsistencies. Update your details today to avoid a fine: dian.gov.co.estado-cuenta.top

They share a few features:

• A threat and a deadline: an embargo today, a fine, a suspended RUT.
• Something to open: a PDF, a ZIP with its password in the message, a Word or Excel file, or a link to "download the notification".
• A sender that isn't DIAN: a free email account, or a domain that merely contains "dian".
• Your name missing from the To field. If it isn't there, DIAN notes, you're probably in hidden copy of a mass mailing.
• A "verification code". DIAN has warned that fake emails copy its codes too, so a code proves nothing until you check it yourself.

DIAN also warns about texts and WhatsApp messages that promise prizes in its name, collect supposed tax debts, or claim a parcel is held by customs. That last kind works like the package held text scam.

How real DIAN contact works

• Formal decisions go to the email in your RUT. DIAN notifies its official acts, such as a fine or a payment order, electronically to the email registered in your RUT. When that isn't possible, it uses the other formal means the law sets out.
• Every email has a code you can check. DIAN says all its communications carry an alphanumeric code, and its website has a "Verificación de correos" page to confirm it.
• No links to pay, no data by email. DIAN states that it never sends links to pay your obligations and never asks for personal or financial information by email or phone.
• Payments go through DIAN's own services. You fill in the official payment receipt, form 490, on DIAN's website, then pay it at an authorized bank or online through PSE, Colombia's bank payment system.
• Procedures are free. DIAN says its procedures cost nothing and need no intermediaries.

Real debts do exist. DIAN can freeze bank accounts in a formal collection process, and its staff may contact you. But a real case shows up in your DIAN account and can be confirmed by calling DIAN yourself.

How to check the message, step by step

1. Don't open the attachment, tap the link or reply. Checking first costs you nothing.
2. Look at the full sender address. Tap or hover over the sender's name. The part after the @ must be exactly dian.gov.co. Paste it into the lookalike domain checker, which runs in your browser and spots letters swapped for look-alikes. Senders can be forged, so a correct address isn't enough on its own.
3. Check the code on DIAN's site, not in the email. Type dian.gov.co into your browser, find "Verificación de correos" and enter the code. Don't click the code in the email: in a fake, that click goes wherever the scammer wants.
4. Check the attachment without opening it. Save it and drop it into the file checker. It reads the file in your browser and uploads nothing, and shows what the file really is: a "PDF" that is really a program, a ZIP hiding a program, a web page that imitates a login, or a document with macros (small programs inside Word or Excel files). It isn't an antivirus and can't see inside RAR, 7-Zip or password-locked files. A password-locked ZIP from "DIAN" is a warning sign in itself: the password stops antivirus programs from looking inside.
5. Paste the text into the scam checker. It knows DIAN's official domain, so it flags links that use DIAN's name elsewhere, and it checks how old each linked domain is. The text stays in your browser; only the links go to our server (api.ethorns.com), and results are kept for up to an hour. For a short link, the short link expander shows where it ends without your device visiting it. In dian.gov.co.estado-cuenta.top, the real site is estado-cuenta.top; see how to check a link.

How to check whether you really owe anything

1. Log in to DIAN yourself. Type dian.gov.co, go to the online services (the system is called MUISCA) and log in with your ID number and password. There you can see your account status and any obligations on record. If you don't have access yet, the login page explains how to set it up.
2. Or call DIAN. Its contact page lists the tax contact centre, 601 489 9000, and the national collection centre for overdue debts, 601 794 8883. If someone calls you about a debt, hang up and call one of these numbers back.
3. Check the email in your RUT. If you no longer read that address, update it through DIAN's RUT services so real notifications reach you.

If you already clicked, opened the file or typed your data

1. If you only opened a page and typed nothing, close it. That's usually the end of it.
2. If you opened the attachment and it turned out to be a program, or you clicked "Enable content" in a document, disconnect that computer from the internet and run a full scan with an updated antivirus. From another device, change your email and bank passwords.
3. If you typed your DIAN password on a fake page, change it on the real site right away, and anywhere else you use it. See strong passwords you can remember.
4. If you gave card or bank details or paid, call your bank now on the number printed on your card. The scammed or hacked tool lists the next steps; it sends nothing anywhere.
5. If you typed your ID number or address, watch for credit opened in your name. See loans in your name.
6. Report it. DIAN asks people to report fake messages to the police's CAI Virtual. The guide on where to report a scam covers the other channels, including where to forward phishing emails. Keep the message as evidence.

Quick checklist

• I didn't open the attachment, tap the link or reply.
• The sender ends exactly in @dian.gov.co and my name is in the To field.
• I checked the code on dian.gov.co, reached by typing the address.
• I checked any file with the file checker before opening it.
• I logged in to DIAN myself or called its official number.
• I pay DIAN only with form 490, through its own services.

Frequently asked questions

I really do owe some tax. Could the message be real?

It could, which is why you check instead of guessing. A real debt shows up in your DIAN account and can be confirmed by phone. Pay it with form 490 through DIAN's services, never through a link or file in a message.

Does DIAN send texts or WhatsApp messages?

Its formal notifications go to the email in your RUT. For anything else, DIAN warns about fake texts and WhatsApp messages in its name and says it never sends links to pay. Check your account or call DIAN instead.

I'm a foreigner with a RUT. How would DIAN reach me?

Like everyone else: through the email registered in your RUT. If you've moved or changed email, update your RUT, and check your account yourself from time to time.

Try it

• 1.3Is this file safe?See what a file from WhatsApp or email really is and spot attachment tricks: disguised programs, macros, PDF scripts, SMS-reading apps.
• 1.1Is it a scam?Paste a message or link you received and see its warning signs: brand look-alikes, new domains, short links, scam wording.
• 1.7Lookalike domain detectorCheck a link or domain for look-alike tricks: letters from other alphabets, digits for letters, a hidden real domain.
• 1.4Short link expanderSee where a short link (bit.ly, t.co, tinyurl…) really goes before you click it: every redirect, the final URL and warning signs.

For your team

• US$19Phishing awareness kit for small businessesA 30-minute session on fake messages, ready to give to your team: a facilitator guide, 12 example messages, a poster, a policy and a quiz.