Identity Theft in Online Gaming: Thousands Affected in Spain

Thousands of people in Spain are facing an unpleasant surprise when filing their income tax returns. It’s not just about owing money; their identities have been stolen and used in online gaming. The Tax Agency (Agencia Tributaria) is notifying individuals that they have earned income from gambling and must declare it. If these earnings are not theirs, they can report it to the Directorate General for Gambling Regulation (DGOJ) of the Ministry of Consumer Affairs.

This action triggers a protocol for potential identity theft, managed by the DGOJ, an entity separate from the Tax Agency.

Record Number of Identity Theft Reports

The Ministry of Social Rights, Consumer Affairs, and Agenda 2030 reported 7,712 complaints in 2024 from individuals claiming to be victims of identity theft in online gaming. According to ministry sources, this is the first time this data has been available, thanks to a protocol launched last year by the DGOJ to protect taxpayers from these actions. This Protocol for Impersonated Taxpayers (PACS) involves collaboration between the State Tax Administration Agency (AEAT) and the National Police. It assists taxpayers whose identities have been used without their consent to conceal online gambling winnings and evade taxes.

Significant Percentage Affected

Following the closure of the 2023 income tax campaign, the DGOJ analyzed the collected data, focusing on cases with winnings exceeding 100 euros. The DGOJ found that 4.7% of those who won more than 100 euros in online games were victims of identity theft, based on reported complaints. The Ministry of Consumer Affairs warns that this percentage could increase in the current tax campaign.

Data from the 2023 tax year also reveals that identity theft affects men and women equally, despite women representing only 16.5% of the online gaming population. Notably, 91% of these identity thefts occurred in sports betting.

How Identity Thieves Operate

The Ministry of Consumer Affairs explains that identity thieves use payment methods that are difficult to trace and cannot be verified in real-time, such as e-wallets and bank cards. They also exhibit a different gaming pattern: placing significantly more bets and spending more hours per day, but using the stolen accounts for only 7.5 days on average, compared to the general population’s average of 35.8 days from account activation to cancellation.

The DGOJ has also identified that using the identities of family members or acquaintances is a common pattern, especially in cases involving minors, individuals registered in the General Registry of Prohibitions of Access to Gambling (RGIAJ), or those previously blocked by operators. Another common pattern involves identity theft for fraudulent purposes, both to avoid paying taxes and to carry out illicit operations.

Measures to Combat Identity Theft

In response, the DGOJ has urged gaming operators to improve their fraud prevention and detection mechanisms, strengthen security in identity verification processes, and ensure effective assistance to affected individuals. The DGOJ also clarifies that these results and the scope of identity theft are limited to individuals who have requested to join the PACS protocol. There are various reasons why a person may not have initiated the procedure, such as not having winnings exceeding 100 euros or not being required to file a tax return due to not reaching the minimum income threshold.