Several cases of identity theft have been detected in the invitations to the upcoming Princess of Asturias Awards.

A message offering a place at a royal awards ceremony is designed to feel special – and that is exactly why it can make people lower their guard. A polished email, an official-looking attachment and a short deadline can create enough excitement that a request for money or personal details seems plausible.

The practical check is simple: the Fundación Princesa de Asturias says genuine invitations to its 2026 awards events are sent directly by the Foundation, are free of charge and do not require recipients to send identity documents. If a supposed invitation asks for payment, bank details or a passport scan, treat it as suspicious.

Why these messages deserve caution

The Fundación Princesa de Asturias has warned about impersonation linked to invitations for its forthcoming awards ceremony and associated events. Its warning follows reports of people receiving messages that appear to use the Foundation’s name and the appeal of an event attended by the Spanish Royal Family.

The Princess of Asturias Awards ceremony is scheduled for 23 October at Teatro Campoamor in Oviedo. A high-profile event, limited access and an international audience give fraudsters a convincing story to exploit.

These messages are not confined to Spain. Fraudulent emails, texts and social-media messages can be sent to people in the UK and elsewhere, often using copied images, formal language and names that sound official.

A prestigious event is not proof that a message is genuine. What matters is who sent it, what it asks you to do and whether it demands money or sensitive information.

The three checks for a supposed invitation

The Foundation has set out three key points to help recipients identify suspicious messages.

1. It should come directly from the Foundation

The Fundación Princesa de Asturias says valid invitations are issued by the Foundation itself, not by the Spanish Royal Household or a third-party organisation.

Do not rely on the display name alone. A sender can call themselves “Royal Events Office” or “Protocol Department” while using an unrelated email address. Look at the complete address after the @ symbol, and be cautious of domains with added words, hyphens or small spelling changes.

2. There is no fee to attend

According to the Foundation, attendance does not involve a charge. A request for a booking fee, donation, administration cost, security deposit or courier payment is a serious warning sign.

Even a small amount matters. Criminals may use a modest payment to test whether a card works, collect banking information or make a later, larger request appear more credible.

3. You should not need to send ID documents

The Foundation says it does not ask invitees to provide scans of official identity documents as a condition of attendance. Do not send a copy of your passport, driving licence, proof of address, bank statement or a selfie holding ID in response to an unsolicited invitation.

Identity documents can be misused to support further fraud or to make later contact look more convincing. If you have any doubt, verify the request independently before sharing anything.

Red flags in emails, texts and direct messages

A scam does not have to be badly written. Some messages are carefully formatted, use genuine event photographs and copy the tone of official correspondence. Assess the request as a whole rather than trusting its appearance.

Watch for:

• a payment request before your place can be confirmed;
• a link to a payment page or a form requesting passport details;
• requests for card details, bank transfers, cryptocurrency or gift cards;
• pressure to respond immediately because your place will supposedly be released;
• a sender address that does not match the organisation’s genuine website;
• instructions to continue the conversation through WhatsApp, Telegram or a personal email account;
• unexpected attachments, especially files asking you to enable macros, editing or content;
• offers to sell, transfer or upgrade invitations.

Be especially cautious if someone claims to be from a protocol office, security team or travel coordinator. An impressive job title does not override the Foundation’s stated position that invitations are free and issued directly by it.

How to check a message without taking risks

Do not click a link simply to find out where it leads. A convincing-looking webpage may be built to collect passwords, card details or identity information.

1. Stop and keep the evidence

Do not reply. Take screenshots showing the sender, date, message and any payment instructions. Keep the email or message rather than deleting it straight away.

If there is an attachment, do not open it to investigate. A file can contain malicious software, even if it appears to be a PDF or event programme.

2. Find contact details independently

Use a search engine or type the Foundation’s web address into your browser yourself. Do not use telephone numbers, links or reply addresses supplied in the suspicious message.

On a computer, you can hover over a link to inspect its destination without selecting it. On a phone, avoid tapping or opening unfamiliar links; it is usually safer simply to leave them alone.

3. Report the impersonation to the Foundation

The Fundación Princesa de Asturias asks people who spot irregularities to report them at [email protected]. You can provide screenshots or forward the suspicious message without replying to the apparent sender.

Where possible, forward an email as an attachment so that its technical details are retained. Do not open a suspicious attachment before reporting it.

4. Use UK fraud-reporting routes if needed

If you are in the UK and have lost money or shared card or bank details, contact your bank immediately using the number on the back of your card or the contact route in its official app.

Suspected fraud can also be reported through Report Fraud, the UK’s national fraud-reporting service for England, Wales and Northern Ireland. In Scotland, report fraud to Police Scotland through its online reporting options or by calling 101 where appropriate.

Reporting a scam is not embarrassing. These messages are designed to exploit excitement, time pressure and trust in a well-known name.

If you have already paid or shared details

Act promptly, but be wary of anyone who contacts you unexpectedly and promises to recover your money for a fee.

• You shared card or bank details: contact your bank straight away and explain that they may have been obtained through a scam. Follow its instructions on card security and monitoring transactions.
• You made a payment: contact your bank or card provider as soon as possible. It cannot guarantee recovery, but early reporting gives it more opportunity to investigate.
• You sent identity documents: make a note of exactly what you sent, when and to whom. Seek guidance from the issuer of the document if you are concerned about misuse.
• You entered a password: change it immediately through the genuine website or app, not via a link in the message. Change it anywhere else you reused it, and turn on two-step verification where available.
• You opened a suspicious attachment: disconnect from the internet if you notice unusual behaviour, run an up-to-date security scan and consider asking a trusted IT professional for help.

Common mistakes to avoid

These mistakes are understandable, particularly when an invitation appears exclusive or time-sensitive.

• Treating a glossy PDF as proof. Letterheads, signatures, QR codes and logos can all be copied.
• Paying a “refundable” deposit. Calling it refundable does not make a payment request legitimate.
• Sending ID to speed up a security check. Do not send sensitive documents unless you have independently confirmed a genuine need.
• Replying to ask if the offer is real. This can confirm that your email address or phone number is active.
• Calling the number in the message. Find official contact details separately.
• Posting the invitation online. Images may reveal names, reference numbers, QR codes or other details that can be abused.

A safer habit for every event invitation

Awards ceremonies, concerts, charity dinners and sporting events are often used as phishing bait because scarcity creates urgency. Make verification routine whenever an invitation asks for money, personal information or login details.

Keep passwords unique, use two-step verification where you can and be careful about publicly sharing travel plans or interest in a particular event. That information can help scammers tailor a message to you.

For this warning, the test is clear: a genuine Princess of Asturias Awards invitation should come directly from the Fundación Princesa de Asturias, cost nothing and not require you to provide an ID scan. If it fails any of those checks, do not engage. Keep the evidence, report it to [email protected], and contact your bank promptly if you have already shared financial information.