In Italy, a business doesn't just have a postal address: it has a "digital address" (domicilio digitale). This is a certified email address, PEC (posta elettronica certificata), which is mandatory and public, and whose messages carry the weight of a recorded-delivery letter with proof of receipt. The authorities send their notices to it, suppliers their formal demands, customers their complaints. It's convenient, and it has become an attack vector.
What is PEC?
An email service in which every message is time-stamped and comes with sending and delivery receipts. A message sent from one PEC mailbox to another "ha lo stesso valore legale di una tradizionale raccomandata con avviso di ricevimento": it has the same legal standing as recorded delivery with proof of receipt (AgID). The country had 16.2 million active PEC mailboxes at the end of 2024, up from 11.1 million at the start of 2020, and they exchanged nearly 2.9 billion messages over the year (AgID).
The PEC addresses of businesses and professionals are public, gathered in a national directory, INI-PEC, which anyone can search (INI-PEC). Private individuals who wish to can register a digital address in a separate directory, INAD, on a voluntary basis (AgID).
France has a less widespread equivalent: the lettre recommandée électronique, or electronic registered letter. It has the same legal effect as a paper registered letter, provided it goes through a provider qualified under the European eIDAS regulation, a status granted in France by ANSSI, the national cybersecurity agency; a business recipient does not have to agree to receive one, whereas an individual does (French Ministry of the Economy). But no French business is required to declare a dedicated address, and there is no public directory comparable to INI-PEC.
Who must have one?
Every business. The obligation has applied since 2008 to companies and since 2012 to sole traders; a 2020 decree-law renamed it "domicilio digitale" and toughened the penalties (Camera di Commercio di Reggio Calabria). Since 2025, some directors must also register a personal PEC address with the registry, separate from the company's: under a decree-law of October 2025, the obligation covers the sole director, the managing directors or, failing those, the chair of the board of limited companies (Camera di Commercio di Ferrara e Ravenna).
A business without a valid PEC faces a fine of €206 to €2,064 for a company and €30 to €1,548 for a sole trader, and the registry automatically assigns it a receive-only digital address in an online area belonging to the business owner (Camera di Commercio di Firenze). The procedure is still being enforced: in July 2026, the Reggio Calabria chamber of commerce started it against 2,463 businesses, 2,005 sole traders and 458 companies (Camera di Commercio di Reggio Calabria).
Why does PEC attract fraudsters?
Because it inspires trust, and the addresses are public. The Italian digital agency's security alert centre, CERT-AGID, recorded 103 malicious campaigns sent via PEC in 2025, up by about 80%: 77 phishing campaigns, mostly aimed at stealing banking credentials, and 26 spreading malware; most came from compromised legitimate mailboxes (CERT-AGID). Across all channels, the year's lures were the stuff of a business's daily routine: orders, invoices, payment notices, bank messages, with compressed archives, Office documents with macros or PDFs containing links attached (Cybersecurity360).
The crucial point lies elsewhere. In September 2026, CERT-AGID described a campaign of fake reminders for unpaid invoices, with changing subject lines such as "Sollecito pagamento fattura scaduta" (overdue invoice payment reminder), sent from genuine hacked PEC mailboxes: a ZIP archive contained an HTML file which, in several stages, installed remote-control or data-stealing software. CERT-AGID points out the system's limit: "La presenza di una PEC certifica il processo di trasmissione e consegna del messaggio". PEC certifies that the message was sent and delivered, not that its sender is honest (CERT-AGID).
That is the most useful lesson from Italy: a certified channel certifies the channel, not the content. A message that arrives by PEC, through a business email service or from a supplier's usual address may come from a compromised mailbox.
Are new businesses targeted?
Yes, just as in France. Italian chambers of commerce regularly publish warnings about letters that mimic their name or logo, pre-filled payment slips, listings in private directories and fake PECs headed "Esazione diritto annuale" (collection of the annual fee). They point out that this fee is "l'unico importo che le imprese iscritte al Registro Imprese versano annualmente alla Camera di Commercio", the only sum that registered businesses pay the chamber each year, and that it can only be paid with the F24 form or through PagoPA, the public payments platform (Camera di Commercio Riviere di Liguria, Camera di Commercio di Sassari). The competition authority, AGCM, calls this ploy "il trucco del bollettino" (the payment-slip trick) and warns that newly registered businesses are particularly exposed (AGCM).
The parallel with the fake letters French businesses receive after registration is striking (see After registration, the fake letters).
What about an equivalent of the Kbis?
The Italian business registry issues two documents, where France has the Kbis extract. The visura camerale sets out the business's details but has no certifying value; the certificato, on the other hand, can be relied on against third parties and is valid for six months. Online, a visura costs €3 to €5 depending on the type of business, and directors get their own business's visura free of charge in the impresa italia online area, which they access with their digital identity (Registro Imprese). They also find their articles of association and latest accounts there.
Visure carry a QR code. You scan it with the free R.I. QR Code app, or enter the protocol number and the six-digit code printed next to the QR code on the registry's website, to download the original archived document and compare it with your copy; the app flags a code that does not come from an official document (Registro Imprese). The principle is the same as the verification code on the French Kbis (see Kbis: how to spot a fake).
And digital identity?
Italy has two: SPID, supplied by private providers, and the electronic identity card (CIE). In October 2025, the country had 55 million CIEs and 41 million SPID identities; the government talks of supporting "la transizione verso l'identità digitale unica", the transition to a single digital identity (AgID). In the meantime the two coexist, and several SPID providers now charge a few euros a year for it: €6 from the second year at Poste Italiane since January 2026 (Poste Italiane).
What can an entrepreneur in France take from this?
An official address is no guarantee. PEC is as formal a channel as there is, and it is used to deliver malware. An email from a supplier's usual address may, likewise, come from a hacked mailbox. When a message demands urgent payment or announces a change of bank details, check through another channel (see Fake invoice, fake bank details).
A ZIP archive or an HTML file posing as an invoice is a warning sign. A real invoice is a PDF or a structured file, not a program; in Italy, invoices between businesses go through the tax authority's platform anyway (see Italy: seven years of e-invoicing). For a dubious PDF, Inspect PDF detects in your browser, without sending it to a server, the mechanisms booby-trapped files use: JavaScript, an action on opening, a program launch, attached files. It flags and counts links, without showing their addresses; it is not an antivirus, and it opens neither ZIP archives nor HTML files.
Check a document at its source. The Italian visura and the French Kbis each have a verification code: that is what you should check, not how the document looks.
PDFKami neither sends nor receives PECs and does not verify visure; it lets you inspect the PDFs you receive without uploading them.
Glossary
PEC (posta elettronica certificata): Italian certified email, whose messages have the weight of a recorded-delivery letter.
Domicilio digitale: the legal electronic address of a business or person in Italy, usually a PEC.
INI-PEC: public directory of the PEC addresses of Italian businesses and professionals.
INAD: directory of the digital addresses of private individuals who choose to register one.
CERT-AGID: the IT security alert centre of Italy's digital agency.
Visura camerale: extract from the Italian business registry, with no certifying value, unlike the certificato.
SPID: Italy's public digital identity system, supplied by approved providers.
Inspect a PDF you've received without sending it to a server: PDFKami, in your browser.