Cybercrime Southeast Europe Newsletter No. 91

New SMS Scam Targeting Citizens Across the Balkans – Fake Traffic Fines and Data Theft

In recent days, citizens across Serbia and other Balkan countries have reported receiving SMS messages claiming they have unpaid traffic fines that require immediate payment.

The messages are written in a formal tone, reference government institutions, and threaten serious consequences such as suspension of vehicle registration or revocation of a driver’s license. However, this is a coordinated phishing campaign aimed at stealing personal and banking information.

How does the scam work?

The fraud typically relies on three key elements:

1. Creating urgency
   The message states that payment must be made immediately to avoid additional penalties or administrative measures. This pressure is designed to prevent recipients from verifying the information calmly.
2. Impersonating public institutions
   Criminal groups use the names of local public companies or government authorities to make the message appear legitimate. In reality, government institutions do not collect fines through SMS links, nor do they request card details via unofficial websites.
3. Redirecting to fake web domains
   The link included in the message leads to domains that have no connection to official government portals. Instead of institutional domains (.gov, .gov.rs, or similar official extensions), scammers use random international domains such as .homes, .online, or .top. These websites are often visually convincing but are designed solely to capture card details or personal data.

In some cases, recipients are asked to reply with a specific letter (such as “Y”) to activate the link. This tactic allows scammers to confirm that the phone number is active and may be targeted further.

Why are these scams increasing?

Criminal networks now use automated systems to send thousands of messages simultaneously. The text is customized for each country by adjusting the name of the institution or referencing local regulations, while the underlying fraud mechanism remains the same.

These campaigns operate on a statistical basis even if only a small percentage of recipients respond, the scam becomes financially profitable.

How to protect yourself

• Do not open links in messages demanding urgent payment.
• Check the sender’s number international or unusual numbers are often a warning sign.
• Never enter card details on websites accessed through unsolicited SMS messages.
• If in doubt, verify the information directly through official government websites or by contacting the institution through verified channels.

A simple rule applies: if a message demands urgent payment, comes from an unfamiliar number, and directs you to an unknown web domain, it is almost certainly a scam.

Your DefendMe Team