Fake Government Travel-Form Sites: What to Know and What to Do

Many countries offer free online traveler, customs or entry declarations. Copycat websites imitate these official services, rank high in search results, and turn a free process into a paid one, while collecting far more personal data than any government form would ask for. Business travelers, and financial-sector executives in particular, are exactly who they hope to catch.

In June 2026, WinTech Security investigated and reported a live example targeting travelers to Panama. We turned what we found into two short guides that you can download and share freely within your organization.

A live example: Panama

Panama's traveler declaration is free and is completed on the government's own site, declaraciondeviajero.ana.gob.pa. The copycat we reported, declaracionpanamaform.com, charged a fee for the same declaration while collecting passports, face photos and full card details. The same template operates against other countries, and the same red flags give it away.

Six red flags

• Not a government domain. Official services end in .gob.pa, .gov.lc, .gouv.fr and similar. A .com or .org "declaration" site is a commercial operator.
• A fee for a free process. The real declaration costs nothing, or is no longer required at all.
• "Mandatory" pressure. Urgency, deadlines and "all travelers" claims. Few declarations are mandatory, and official sources say so plainly.
• Everything in one form. Passport, face photo, date of birth, itinerary, accommodation and full card details. A visa application may legitimately ask for some of this; a simple traveler declaration does not, and no official form asks for your card's security code.
• The fine print admits it. Somewhere in the footer or the terms: "not affiliated with any government."
• It came to you as a link. In an email, a message or a forwarded notice, rather than through the official site you typed yourself.

One habit beats them all: never reach a travel form through a link or a search ad. Type the official government or airport address yourself, or follow the link from your airline or embassy.

Why financial-sector travelers are prime targets

The fee is the smallest part of the loss. A bank officer's passport details, identity and corporate card open the door to executive impersonation, business email compromise and fraud against the institution itself. Once a copycat site has your name, employer and travel dates, the follow-up messages can look very convincing.

For organizations, a few measures go a long way:

• Brief traveling staff and executives before trips, and circulate the official links for common destinations.
• Verify any "required form plus fee" travel notice at the source before forwarding it to a distribution list. A forwarded notice carries your credibility with it.
• Block known impersonation domains at the email and web gateway, and tell staff where to report suspicious travel sites.

If you already submitted your details

Exposure is not the same as harm, and acting quickly sharply reduces the risk. Work in this order:

• Today: your cards. Call your card issuer, report the card as compromised and ask for a replacement with a new number. Dispute the charge. For a corporate card, also notify your card administrator.
• This week: passport, identity and logins. Ask your passport authority whether to flag or replace the passport. Where available, place a fraud alert or credit freeze. Turn on multi-factor authentication for your email and banking.
• The coming weeks: stay alert. Expect targeted follow-up about your trip or your "declaration". Verify any payment, wire or credential request through a separate, known channel, and monitor your statements for several months.

Keep the evidence, report the site to your consumer protection or cybercrime authority, and tell your organization's security or fraud team so they can watch for impersonation attempts.

Download the guides

Both guides go into more detail than this article and can be shared freely within your organization.