A new wave of fraudulent messages is circulating in the names of public institutions, as the State Police has issued a warning about the risk of theft of personal and banking data. According to the official version, the scheme uses well-known names such as the Municipality of Tirana, DPSHTRR and Albanian Post to push citizens to click on fake pages.
Messages impersonating institutions
According to the Police, the Directorate for the Investigation of Cybercrime has identified new fraud campaigns carried out through SMS messages, known as smishing. The messages appear as if they come from Albanian public institutions or services, but the aim is to direct citizens to fake websites.
From the monitoring cited by the authorities, messages have been identified in the name of the Municipality of Tirana and the parking service, claiming unpaid fees; in the name of DPSHTRR regarding fines or traffic violations; and in the name of Albanian Post for address updates related to parcel delivery.
How the smishing scheme works
At its core, the scheme relies on the link accompanying the message. According to the official notice, the citizen is directed to pages that imitate the appearance of the relevant institutions in order to obtain personal and banking data.
The Police say the perpetrators’ objective is to obtain the card number, expiration date, CVV/CVC security code and verification codes. This data can then be used for unauthorized transactions and the draining of bank accounts.
False urgency as a pressure tactic
According to the authorities, the perpetrators use a familiar formula: unpaid obligations, short deadlines or problems with postal deliveries. This creates a sense of pressure and pushes citizens to react without verifying whether the message is real.
This mechanism has also appeared before, when according to the Police, fraud attempts were identified in the name of banking institutions through fake websites on the internet.
What should be avoided
The Police are calling on citizens not to click on suspicious links sent by SMS, regardless of the name of the institution shown in the message.
Likewise, the main advice is under no circumstances to enter bank card details, CVV/CVC codes or verification codes on pages opened from these messages.
These cases show that the name of a public institution is being used as a cover of credibility for schemes that directly target citizens’ money.
In such conditions, any message requesting immediate payment, an address update or confirmation of banking details should be treated with the utmost suspicion.