Listen to the episode
TLDR
CSIRT Italia has detected a smishing campaign impersonating the GLS courier to steal payment card data. The victim receives an SMS reporting a suspended delivery due to missing data and inviting them to click on a link (domain europe...
How it works
CSIRT Italia has detected a smishing campaign impersonating the GLS courier to steal payment card data. The victim receives an SMS reporting a suspended delivery due to missing data and inviting them to click on a link (domain europe...
Red flags
- Unsolicited SMS from a supposed courier with a link to an unknown, unofficial domain (europe italy[.]icu). Request for payment of a negligible amount (0.79 euros) to unblock a phantom delivery. Entering OTP code: no legitimate service requests OTP via web for deliveries. What to do Do not click the link and delete the SMS immediately. Verify the shipment only through the official website or GLS app using the real tracking number. Report the SMS to the Postal Police and CSIRT Italia, and block the card if data has been entered
What to do
- 1The victim receives an SMS reporting a suspended delivery due to missing data and inviting them to click on a link (domain europe italy[.]icu).
- 2Request for payment of a negligible amount (0.79 euros) to unblock a phantom delivery.
- 3Verify the shipment only through the official website or GLS app using the real tracking number.
Source
csirt-italia
Source reviewed by Mythos Forensic Team
https://www.acn.gov.it/portale/w/campagna-di-smishing-a-tema-glsFAQ
Is GLS themed smishing: Fake SMS requests 0.79 euros and steals credit card data a real scam pattern?
Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.
What are the first warning signs?
Unsolicited SMS from a supposed courier with a link to an unknown, unofficial domain (europe italy[.]icu). Request for payment of a negligible amount (0.79 euros) to unblock a phantom delivery. Entering OTP code: no legitimate service requests OTP via web for deliveries. What to do Do not click the link and delete the SMS immediately. Verify the shipment only through the official website or GLS app using the real tracking number. Report the SMS to the Postal Police and CSIRT Italia, and block the card if data has been entered
What should I do first?
The victim receives an SMS reporting a suspended delivery due to missing data and inviting them to click on a link (domain europe italy[.]icu).; Request for payment of a negligible amount (0.79 euros) to unblock a phantom delivery.; Verify the shipment only through the official website or GLS app using the real tracking number.
Can LegalAudit check my case?
Yes. Start a free chat and paste the message, link, sender, or payment details for triage.