Prepared by: Fatbardh Dema
Since June of this year, hibrid.info has verified four fraudulent SMS messages claiming to come from the Kosovo Post.
These SMS were sent to the phones of Kosovo citizens, but none of the phone numbers used belong to Kosovo's area code. Even the websites offered for clicking on have proven to be fraudulent.
What did these SMS contain?
Through these SMSes, a call is made to click on a link, with the justification that the home address should be updated in order to reorganize the delivery of the package.
In June, a short message (SMS) was sent to the phones of Kosovo citizens which read: “Your package has been placed on hold due to incomplete address information.".
After verification of the facts carried out by hibrid.info, it was confirmed that the number used to send this message to the phone has the prefix +63 which belongs to the country of the Philippines. Meanwhile, the link presented in the SMS is suspicious and aims to obtain and misuse the personal data of users. (see here verification performed by hibrid.info)
Regarding this SMS, the Kosovo Post itself reacted through its official Facebook page, through which it calls not to click on the link presented in the message. (see here)
The Kosovo Information and Privacy Agency has also called on citizens not to fall prey to scams aimed at obtaining and misusing their personal data. (see here)
On July 31, another SMS with the sender name “Posta e Kosova” called for clicking on a link, with the justification that the correct information should be provided, so that the order could be delivered within 12 hours. The link in this SMS appears as “postakosoves.online”.
After verification by hibrid.info, it was confirmed that the number that sent this message to the phone has the prefix +60 which belongs to the state of Malaysia. Meanwhile, the link presented in the SMS is suspicious and is not the official website of the Post of Kosovo. (see here verification performed by hibrid.info)
Another SMS during September was sent to citizens via an email address "abimobeka@91baojia.com". "Your package has arrived at our warehouse. We cannot deliver because the address information is incorrect.", writes this SMS, calling for clicking a link to “improve” the address data. This SMS also claims that its sender is the Kosovo Post.
The link provided in this SMS “bb2-xyhrch.top/post”, after verification carried out by hibrid.info, it turned out to be suspicious. (see here verification performed by hibrid.info).
Meanwhile, on November 1, an SMS with a similar claim contained another link. This time, the link used displays a page that imitates the website of the Post of Kosovo, where the same information is displayed as shown in the content of the SMS. However, the domain used is called “postakosoves-kos.click”, unlike the official domain of the Post of Kosovo, “postakosoves.com”.
Hibrid.info has researched the prefix of the number that sent the SMS (+44) and found that it belongs to the United Kingdom (see here verification performed by hibrid.info)
What did the Kosovo Police say?
The Pristina regional police, namely the investigation unit of the Qendra police station, upon the recommendation of the state prosecutor, had initiated an investigation into the criminal offense of "Interference in a computer system".
The investigation was initiated after a complaint from a complainant, who claimed that he had received a link with a post office logo on his phone and after clicking on it, he was redirected to another link where his personal banking details were requested.
After entering the data, the complainant reported that he had suffered significant monetary damage. (see here)
Hibrid.info has also published a video describing how these types of SMS are verified and how to distinguish them. (see video)
This content, according to the working methodology of the hibrid.info platform, is considered "Fraud".
The “Deception” rating is given to informational content that is manipulated in terms of visual (deepfake, cheapfake), audio, or textual content to deceive the audience. This form of deception is usually used to produce false and manipulated content.