Wrote: Fatbardh Dema
Several phone messages (SMS) have been sent to Kosovo citizens claiming to come from the Kosovo Post.
This institution, announced through the official Facebook page that these SMS are fraudulent and asks citizens not to click on any links sent through these messages.
These SMS messages allegedly request information updates with the description "Your package has been held due to an incomplete address. Please update your information within 3 days to prevent a return."
At the end of this SMS, a link is placed claiming that there is an opportunity to update this data.
Where do these SMS come from?
In the images of these SMS published by the Kosovo Post, it is noticeable that the numbers do not have the Kosovo prefix (+ 383).
In two of them, the numbers that sent the message have the prefix +31, which, after research conducted by hibrid.info, was confirmed to belong to the state of Netherlands.
While the other number that sent the similar message has the prefix +44, which is United Kingdom.
What do links contain?
Hibrid.info clicked on these links presented in these SMS, and then a web page was opened containing the Kosovo Post logo, as well as an option to continue updating the data.
However, the domain of this website is not the real one of the Post of Kosovo. This website contains the domain postakosoves.world, while the official website of this institution is Postakosoves.com.
Hibrid.info has checked through "scamdoc.com", a platform that assesses the authenticity of websites. After checking, through the results presented by this platform, it can be assessed that this link is suspicious.
This is not the first time that such SMS are sent to the citizens of Kosovo, misusing the Kosovo Post. Hibrid.info has dealt with such SMS several times. (see here)
Analyze:
Some Kosovo citizens have received fraudulent SMS messages claiming to be from the Kosovo Post, requesting updates on a package that was left behind due to an incomplete address.
The Kosovo Post has reacted by warning citizens not to click on the links sent, as these messages do not come from them.
The senders' numbers have foreign prefixes, such as +31 (Netherlands) and +44 (United Kingdom). Hibrid.info has confirmed that the links lead to fake pages that misuse the logo of the Post of Kosovo, but not the official domain. The website has been assessed as suspicious by the website verification platform “Scamdoc.com”.
Based on its work methodology, hibrid.info evaluates these SMS as "Scam".
Reasoning:
The “Deception” rating is given to informational content that is manipulated in terms of visual (deepfake, cheapfake), audio, or textual content to deceive the audience. This form of deception is usually used to produce false and manipulated content.