‘Sponsored’ IPVA scam: new cleverness of thieves scares experts; here’s how to protect yourself

Kaspersky, a global cybersecurity company, has issued a warning about a new wave of digital scams involving the payment of IPVA. The fraud consists of creating websites that imitate the official portals of the Treasury Secretariats in order to offer non-existent discounts and issue slips in the name of scammers. So far, at least 13 fraudulent websites have been identified operating in five Brazilian states, with emphasis on Rio de Janeiro.

The sophistication of the scam lies in the subtlety of the process: the fake pages do not arrive only by email or SMS, but appear prominently on Google through links sponsored by the criminals — who also disburse money on social networks.

The tactic, the company explains, is dangerous because it uses the algorithm to hook precisely the driver who, at that moment, is looking for more information about the IPVA on the internet.

SEE ALSO:

• Motorcycle couriers pressure government for salary floor and end of the ‘black box’ of apps
• GAC GS3 is the new Chinese combustion SUV with an eye on Crete, T-Cross and co.
• Traffic jam with 60 cars and 40 trucks scares but leaves no one dead in the US

The dynamics of fraud: real data to deceive

Unlike generic scams, this fraud uses apparently true data to pass credibility. The websites mimic the government’s interface and use addresses similar to those of state websites. In addition, criminals create bureaucratic documentation steps so as not to generate suspicion.

• Data validation: The fraudulent website requests the Renavam number. By entering it, the system searches for and displays the real information of the vehicle, such as model, year of manufacture and color. This convinces the victim that they are in the official environment.
• The discount bait: A fake slip is generated, often with an attractive discount for cash payment via Pix.
• The deviation: The payment, instead of going to the public coffers, is directed to the accounts of oranges or shell companies.

How to protect yourself when paying

To avoid losses, the primary recommendation is to avoid clicking on sponsored links (those that appear marked as “ad” at the top of Google) and always type the official address of the DMV or the Department of Finance directly into the browser. Kaspersky also warns the user to thoroughly check the website address, looking for small changes or spelling errors.

The “cat’s leap” to identify fraud is at the final moment: before completing the transfer, carefully check the beneficiary’s data (who will receive the money). Official IPVA guides must have the State Government or the Department of Finance as the beneficiary, never individuals or companies with unknown names (LTDA/MEI).

The use of security software is also indicated to block automatic access to these malicious links.