Wrote: Etrit Rexhepi
SMS messages have been sent to phone users, the content of which states that from a certain date (usually the date the message was sent), they will not be able to use their bank account. Therefore, in this phone message, through an attached link, users are asked to activate the update as soon as possible.
In both examples that hibrid.info possesses, the sender of the message has a phone number with the prefix +386, which belongs to Slovenia.
The truth?
Based on research conducted by Hibrid.info, it was found that such SMS messages are fraudulent.
Hibrid.info has clicked on the link to verify what it is really about. After clicking on it, a window opens bearing the “NLB Banka” logo, where personal data such as ID number and phone number are requested.
Because the message was sent from private numbers, which are not associated with "NLB Banka", we have placed fictitious data in the relevant fields, where after clicking for further processing, the next page displayed requires the year of birth to be written.
After filling in this field, another page opens with a description, which also contains a spelling error, "Please stop..."
This page remains loaded, not proceeding to the next step, which has made it impossible to further identify the content and purpose of this message.
Hibrid.info has analyzed the initial link "https://mklik-nlb.click/kos/client/", through platforms for identifying the authenticity of websites such as "Scamdoc.com" and "Scamadviser.com".
"Scamdoc" has rated the link as SUSPICIOUS, while according to "Scamadviser.com" it Redirecting at "google.com".
Hibrid.info found that the domain of the official website of the NLB bank is "nlb-kos.com", while this bank also offers electronic banking services under the name "NLB eClick"as well as the application "mClick NLB Kosovo".
“NLB eKlik” platform
“mKlik NLB Kosovo” application
Furthermore, the bank itself reacted to this phenomenon on Saturday (January 10) on the official "NLB Banka" Facebook page, where caution is required regarding these SMS messages that are being sent in its name, while the bank has described this publication as fraudulent (see hereThe post also contains a link where more details about safety in such cases are provided (see here).
The bank has also sent the same message to its users on the "mKlik" application.
Post by "NLB Banka"
"Over the past few days, fraudulent SMS messages targeting NLB Banka customers have been identified.
These messages usually contain fake links and ask for account logins or personal information. Please do not open them or share confidential information.
For your safety:
Don't click on suspicious links.
Access banking services only through official NLB Banka channels.
Do not share one-time codes (OTPs), passwords, or banking details via SMS.
"Notify the bank immediately of any suspicious messages or communications."
A post A similar warning has been issued by another bank operating in Kosovo, "Raiffeisen Bank".
To further prove that SMS messages can be fraudulent, hibrid.info researched through the "ChatGPT" chatbot, sending it an image of the page that opened after clicking the link in the phone message.
Even search results on this platform show that these SMS messages can be fraudulent.
Meanwhile, the Central Bank of Kosovo has also reacted, through the "Financial Education" page.
"The Central Bank of the Republic of Kosovo (CBK) advises citizens to be careful of a fraudulent campaign that is currently circulating through SMS messages. The messages are falsely presented as notifications from commercial banks, with the aim of defrauding and stealing financial data."
"These messages may contain fake links and urgent requests for action. So don't be fooled," the notice reads. CBK.
Analyze:
Citizens across the country are being sent SMS messages falsely claiming that users' "NLB Banka" bank accounts will be blocked, urging them to click on a link to update their data.
The link directs users to a page that imitates "NLB Banka" and requests personal data, while the domain does not match the bank's official website.
Analysis through website verification platforms and official warnings from "NLB Banka" itself confirm that these SMS are fraudulent.
Based on its work methodology, hibrid.info assesses this content as "Fraud".
Reasoning:
The “Deception” rating is given to informational content that is manipulated in terms of visual (deepfake, cheapfake), audio, or textual content to deceive the audience. This form of deception is usually used to produce false and manipulated content.