On 2 November 2026 a handset in Austria showed a text from +43 676 6299131. In German, it said the FinanzOnline registration had expired that day, and it asked the reader to update their details. The link was finanz.on-datenerneuerung.cc. The number on the screen is what the phone displayed. A displayed number can be chosen by the sender. It is not a desk at the finance ministry.
FinanzOnline is the real online service of the Austrian Federal Ministry of Finance. People file taxes there, and businesses file there. It is reached at finanzonline.bmf.gv.at. On 18 October 2026 the ministry warned again about texts, emails, calls and copied websites that use the names of the ministry, the tax office, the customs office and FinanzOnline. A real notice, it said, is a digitally signed decision, sent by post or into the FinanzOnline Databox. The ministry does not ask for a password, a card or account details. Watchlist Internet, the reporting desk run by the Austrian Institute for Applied Telecommunications, puts the same rule in one line for this particular wave: the ministry does not send a text that contains a link.
The text of 2 November is that wave with a new host. The page copies the portal, then asks for the person, then for the IBAN and the bank.
How it works
- A text says the FinanzOnline registration has expired, or is about to. The date is today, or a day close by, so the message feels like a deadline rather than a circular.
- The link is not finanzonline.bmf.gv.at. In this message the host was finanz.on-datenerneuerung.cc, built from "finanz" and a German word for renewing data. The page that opened used https. A padlock means the connection is encrypted. It says nothing about who owns the site.
- The page is dressed as FinanzOnline. The red mark, the words "Bundesministerium Finanzen", and a box saying the registration is running out. The form asks for a full name, an email, a date of birth, a phone number and an address, down to the stair and the door number.
- Under the address it asks for the IBAN, then which bank. A yellow note says the bank has to be linked so that future automatic steps can be carried out. The bank field is marked as required. That is the step where the account details leave. The real FinanzOnline login does not collect an IBAN on the way in.
- The button says "Weiter", continue. This page is not the end of the form. Watchlist's write-up of the same pattern says the next page is dressed as the person's own bank and asks for the online-banking login. The state police in Vorarlberg have described what can follow the form: a call about a suspicious transfer, with a request to approve a push message on the phone, and, in other cases, instructions to move money at a cash machine to "keep it safe".
Signs and red flags
The text and the page below were opened to see what the link did. Nothing was typed into the form.
The address bar is the check. The only FinanzOnline address is finanzonline.bmf.gv.at, typed by hand, or a bookmark you made yourself. A host that merely contains the word "finanz", on .cc or on any other ending, is a different site.
The form is the second check. A sign-in asks for a login. This page asks for a street, a door number, an IBAN and a bank, and it will not continue until a bank is chosen. Watchlist's earlier example of the same mask asked for a name, a date of birth, a postcode, a phone number, an account number and a bank, and then moved on to the bank login.
The footer is the third check, and it is there to fail you. Imprint, privacy, and a line about Fred, the finance administration's chatbot, are the real portal's words. On earlier copies, Watchlist found that those links really do open the ministry's own pages. A link that leaves the form does not make the form the ministry.
The date in the text is swapped as the wave goes on. One message listed by Watchlist says the FinanzOnline ID expires on 24 October 2026 and points at finanzonline2.cc. Earlier hosts named in the public warnings include finanz.online-reaktivierung.cc and finanz.online-erneuern.cc. The sentence is the same. The host is the part they change.
A page you want to look up, without opening it, can go through the site checker. The checker reads the address. It does not ask for an IBAN, a name or a bank.
The same shape, with a different tax office on the letterhead, is the HMRC refund email that is not HMRC.
Cases and figures
This host is new. A public registration lookup shows on-datenerneuerung.cc was created on 21 October 2026, twelve days before the text. The registrar is NiceNIC International Group Co., Limited. The holder's name is redacted. The record names the United States and no organisation, which does not identify who sent the messages. The name servers belong to Cloudflare, so the public record also hides the machine behind the site. No ministry warning found on 2 November 2026 names this exact host. The pattern around it is already written up. The host Watchlist lists for the 24 October text, finanzonline2.cc, is a separate registration: created on 22 October 2026, through CNOBIN Information Technology Limited, on nameservers that are not Cloudflare's. Same costume, different record.
The ministry's 18 October 2026 warning lists "suspicious sign-in attempts and necessary updates at FinanzOnline" among the stories being told, alongside tax refunds, the climate bonus, family allowance, unpaid demands and questions about crypto holdings. A January 2026 warning describes emails telling businesses that company data in FinanzOnline must be checked through a linked form, on a page in the FinanzOnline style that asks for personal data and payment details. The ministry said those messages and those pages were fakes.
Watchlist Internet calls the texts a long-running wave aimed at contact details and bank details. The federal government's online-safety site describes the twin on finanz.online-erneuern.cc: after the form, a second page asks the person to sign in to online banking, which the real FinanzOnline portal does not do.
In Vorarlberg, the state police told VOL.AT that reports of this scheme had already been filed. They did not give a number of cases or a loss total. The chamber of labour told the same outlet that enquiries over recent weeks and months were in the mid hundreds, and that completed losses were rare. The outlet also describes one case from the previous year in which €180,000 was lost. That is one reported case, not a national total, and the police did not adopt it as their figure.
What to do and where to report
Do not type into the page. Do not press "Weiter". Delete the text. If something about the registration really needs a look, type finanzonline.bmf.gv.at. A message in that mailbox, or a letter, is how the ministry says it writes to you.
If the form was already sent, the IBAN and the bank name have left, even when no money has moved.
Call the bank on the number printed on the card or on a statement. Say that an IBAN, and the name of the bank, were typed into a page opened from a FinanzOnline text. Ask them to watch the account and to stop a transfer you did not make. If a later page asked for an online-banking login, or a caller asked you to approve a push message, ask the bank to lock online banking and to issue new access. The Vorarlberg police told VOL.AT that a transfer which has only just been made can sometimes still be stopped, and that the urgent call is to the bank. Use the number you already had. A caller who introduces themselves as the bank, and who needs a confirmation in order to cancel a payment, is the step the police described.
A report can be made at a police station. Suspected internet crime can also go to the reporting point listed by the interior ministry's online-safety pages. The text, with a screenshot and the fields you filled in, can go to Watchlist Internet. They publish anonymised warnings. They do not pull money back. The bank does that part.
Do not go back to the page to delete what was sent. There is nothing on that page you can delete. If a FinanzOnline password was typed anywhere along the way, change it only after you have opened finanzonline.bmf.gv.at yourself.
Start with Get help. A later caller who offers to recover the money, or to secure the account for a fee, is a second approach to the same person: Recovery.
This is general information, not legal or financial advice. The rules and the figures change. If money has already left, contact the bank and the authorities through the help pages.