"Suspicious activity has been detected on your account. Please log in to continue using the service."
This is the content of a phone message sent to phone users in Kosovo, from a number with a Kosovo prefix.
The message also contains a link where you can continue with the procedure requested in the sent content.
What's wrong with the message?
This message is a hoax.
The message lacks the name of the service or institution that claims to have sent it. Meanwhile, the domain of the attached link contains the name “raiffaeisen”, which coincides with the name of a bank that operates in our country.
To learn more, the link in the message was verified, but it was not accessible (see here). For this reason, assessing the reliability of the domain, through the website for the respective service, was impossible (see here).
Hibrid.info also attempted to find information about the number sending this message through online telephony applications (WhatsApp and Viber), but without success.
Because the link's domain included her name, hibrid.info checked the Facebook page of "Raiffeisen Bank".
Among the publications was a post published on Wednesday (22), which contained an image of a telephone message, similar to the one discussed in this content.
The message provided a warning notice, describing as fraudulent SMS, the circulating messages claiming to come from this bank. According to this notice, the purpose of these messages is to deceive customers and obtain personal or sensitive data. Customers were advised not to share any information with untrustworthy sites or sources and were presented with the bank's official website (see here).
This notification from the bank confirms that the message in question is part of a fraud scheme.
Hibrid.info has in the past dealt with fraudulent messages sent on behalf of banks or other services, analyzing cases and explaining the ways in which they aim to deceive citizens through various phishing and social engineering techniques (see here and here).
Analyze:
A phone message claims that suspicious activity has been detected in the user's account and requests that they identify themselves to continue using the service, along with a link for immediate action.
However, verifications show that it is a fraudulent (phishing) message, which does not contain the name of an official institution and uses a domain that imitates the name of a bank to create credibility.
Verification and the official announcement of the bank in question confirm that such messages are part of fraudulent schemes aimed at obtaining users' personal data.
Therefore, based on the working methodology, hibrid.info assesses this content as "Fraud".
Reasoning:
The “Deception” rating is given to informational content that is manipulated in terms of visual (deepfake, cheapfake), audio, or textual content to deceive the audience. This form of deception is usually used to produce false and manipulated content.