Training Module: How to Recognize an “Aviation Partnership” Scam – A Case Study of Mitra Airplane

The headline on the screen promised a way out of the daily grind. “Gabung kemitraan penerbangan armada dan kelola profit Anda” – join an aviation fleet partnership and manage your profit. A sleek form asked for a WhatsApp number, a password, and an invitation code that was already filled in for you. At the bottom, in bold letters, the page declared itself an “OFFICIAL AIRLINE ENCRYPTION SYSTEM”.

Incident Report: This malicious interface was detected, analyzed, and contained firsthand by the Antiphishing.biz security team during our automated link scanning workflows. To protect the public, the phishing source domain has been fully defanged within our infrastructure. We document and analyze these live visual patterns to help security researchers and users recognize deceptive clone designs before financial damage occurs.

Actual screenshot of "Training Module: How to Recognize an “Aviation Partnership” Scam – A Case Study of Mitra Airplane" phishing interface captured during link moderation on our platform.
Figure 1: Visual proof of the active phishing operation intercepted by our security systems.

If you have seen anything like this – a slick website, a promise of passive income from aircraft leases, and a “special” invitation code – you are looking at the exact moment a criminal hopes to catch you. The platform behind that page is not an airline. It is not a legitimate investment. It is a trap. And the only “encryption” happening is the money disappearing from your wallet.

This guide is written for everyone in Indonesia who has ever seen a WhatsApp message about “investasi bodong”, a Facebook ad promising huge returns from “aviation partnerships”, or a link to a professional‑looking investment portal. You are not a cybersecurity expert. You are someone who wants a better life for your family, and that makes you a target. Criminals know that hope, when combined with urgency and a fake “invitation”, is the most powerful weapon they have.

By the end of this guide, you will understand exactly how the “Mitra Airplane” scam works, why it is part of a much larger criminal wave sweeping across Indonesia, and – most importantly – the simple, unforgettable rules that will keep your money in your pocket and your future in your own hands.

The Anatomy of the Trap: How “Mitra Airplane” Really Works

The screenshot shows a registration page that is deceptively simple. It asks for three things: your WhatsApp number, a password, and an invitation code. That is all. But behind that minimal interface lies a fully engineered criminal operation.

The Fake Aviation Legend

The text on the page reads: “Buat Akun Baru / Gabung kemitraan penerbangan armada dan kelola profit Anda” – Create a new account / join an aviation fleet partnership and manage your profit. This is the bait. The criminals know that Indonesians understand the value of travel and logistics. Aviation sounds prestigious, global, and profitable. By wrapping their scam in the language of “airline encryption” and “fleet management”, they borrow credibility they have never earned.

No legitimate airline or aviation investment platform will ever ask you to invest through a simple web form with no background checks, no legal disclosures, and no registration number. Real aircraft leasing or fleet partnerships involve contracts, lawyers, and regulators – not a WhatsApp number and a password.

The WhatsApp Trap

The first field on the form asks for your “NOMOR WHATSAPP AKTIF”. In Indonesia, your WhatsApp number is not just a communication tool. It is often linked directly to your digital wallet balances in GoPay, OVO, DANA, and other popular services. When you hand over your active WhatsApp number to a criminal, you are giving them a direct line to your payment ecosystems.

Once you register, the scammers will contact you via WhatsApp. You will be assigned a personal “account manager”. You will be shown fake screenshots of other members withdrawing daily profits. You will be shown a dashboard where your “aircraft share” grows by 2‑3% every day. The pressure will be friendly at first, then urgent. “Limited prize-drawing features available.” “Special promotion ends tonight.” “Your fleet needs one more payment to activate full returns.”

This is not aviation management. This is a pig butchering operation – a long‑term psychological manipulation designed to drain every rupiah you own. In a similar case recently uncovered in Solo Raya, Indonesian police arrested an entire pig butchering syndicate that had used the exact same methods: building emotional relationships over WhatsApp, then guiding victims to fake crypto and investment platforms.

The Invitation Code That Is Not a Secret

The form includes a field labelled “KODE UNDANGAN” – invitation code – which is already filled in: 79v780311dpo. This is a classic trick. The scammer gives you a “secret” code that is actually the same for everyone who clicks their link. The code serves two purposes. First, it makes you feel special and selected, lowering your suspicion. Second, it acts as a tracking mechanism. Every time a victim registers using that code, the scammer who sent you the link earns a commission from the money you lose. The code is not a key to riches. It is a receipt for your future losses.

The Fake Security Badge

At the bottom of the page, in prominent letters, the text reads “OFFICIAL AIRLINE ENCRYPTION SYSTEM”. This is a complete fabrication. Real airlines and financial platforms do not need to announce that they use encryption. Encryption is a technical standard, not a marketing badge. The criminals put this text on the page for one reason only: to make you feel safe. They want you to think, “If they have an encryption system, my money must be protected.” In reality, the only thing being encrypted is the communication between your browser and the scammer’s server. Your money, once transferred, is completely unprotected.

The Profit That Never Comes

After you register, the scam continues. You will be encouraged to make an initial “investment” – often a relatively small amount, perhaps Rp 500,000, to buy a “virtual aircraft wing”. Your dashboard will show a profit growing every day. You will be allowed to withdraw small amounts to build your trust. This is the critical phase. When you successfully withdraw Rp 50,000 or Rp 100,000, your belief in the platform solidifies. You think, “This is real. Other people are getting money.”

What you do not see is that those small payouts come from the deposits of other victims. The criminals are using a classic Ponzi scheme: paying early investors with the money of later investors. As long as new victims keep signing up, the platform appears to work. But the moment you try to withdraw a large sum – or the moment the criminals have collected as much money as they think they can – the website will disappear. Your account will be blocked. Your WhatsApp number will be ignored. And your money will be gone.

Real Stories of Heartbreak and Narrow Escape

The Banyumas Pensioner Who Lost Her Retirement Savings

A retired teacher in Banyumas, Central Java, thought she had found a way to pay for her grandchildren’s school fees. She joined an investment scheme that promised extraordinary returns. Her pension was modest, but the promise of quick profit was too tempting. She invested her savings. Then more. Then she borrowed from friends, thinking the returns would cover everything. Instead, she found herself trapped in a cycle of debt.

She later told investigators: “Dari sanalah ia sadar telah masuk dalam perangkap investasi bodong.” – “That was when she realised she had fallen into a fake investment trap.” By the time the fraud was uncovered, she had lost hundreds of millions of rupiah. Her retirement, planned over decades, was gone in months.

The Solo Syndicate That Stole Rp 41 Billion in Ten Months

Between July 2025 and May 2026, an international pig butchering syndicate operated out of Sukoharjo, Central Java. They targeted victims primarily in the United States, building fake romantic relationships over WhatsApp and then guiding their victims to fake crypto trading platforms. Over ten months, the syndicate recorded profits of Rp 41.1 billion (approximately US$2.2 million). More than 133 victims were confirmed, and investigators believe the true number is higher.

When Indonesian police finally raided the operation, they found an entire infrastructure dedicated to deception: fake trading interfaces, fabricated withdrawal proofs, and teams of people whose only job was to keep victims emotionally engaged and financially draining.

The “Mitra Airplane” scam works exactly the same way, except the fake crypto platform has been replaced with a fake aviation partnership. The technology is different; the psychology is identical.

The Woman Who Realised Just Before the Transfer

A woman in East Java was invited to an “aviation investment” group on WhatsApp. The admins posted daily screenshots of members withdrawing profits. She was impressed. She was ready to transfer Rp 90 million – her family’s savings – into the platform. But something stopped her. The account name for the transfer was not a corporate bank account. It was a personal account belonging to an individual she had never met.

She asked the group admin why the payment was going to a personal account. The admin gave a vague answer about “processing fees”. She asked again. The admin blocked her. Hours later, the entire WhatsApp group disappeared. She had come within one click of losing her life savings. Her only mistake was asking a question. Her only defence was not trusting the silence that followed.

The Tarakan Resident Who Saw Through the Facebook Lie

A man in Tarakan, North Kalimantan, received a Facebook message from an attractive profile. The conversation moved to WhatsApp. Within days, the “new friend” was offering an exclusive investment opportunity. The returns were 10‑20% per month – numbers that no legitimate financial instrument can deliver. The man remembered a government public service announcement: “Jangan tergiur tawaran imbal hasil tinggi dalam waktu cepat” – “Do not be tempted by offers of high returns in a short time”. He blocked the contact and reported the profile. He lost nothing except a few hours of his time.

These stories share a common thread. The people who lost money all ignored the same red flags. The people who kept their money all paused, asked a question, or remembered a simple warning.

The Four Red Flags That Give Away the Aviation Investment Scam – Every Time

You do not need to be a financial expert to spot these traps. You just need to know what to look for.

Red Flag One: The Promise of “Easy Profit” from an Industry You Do Not Understand

Real aviation leasing is a complex, capital‑intensive business. It requires licences, insurance, maintenance contracts, and regulatory approvals. No legitimate company offers “partnerships” to random individuals through a web form. If the business model is not explained in plain, verifiable terms, the investment is a scam.

Red Flag Two: The Invitation Code That Comes from a Stranger

If someone you do not know personally sends you an invitation code for an investment platform, that person is almost certainly earning a commission from every rupiah you deposit. The code is not a secret pass to wealth. It is a tracking number for your future losses.

Red Flag Three: The Payment Goes to a Personal Bank Account

No legitimate investment platform will ask you to transfer money to an individual’s personal bank account. Real companies use corporate accounts held in the company’s registered name. Before you send any money, check the account name. If it is a personal name – Pak Budi, Ibu Siti, or any individual you do not know – you are sending money to a scammer. Period.

Red Flag Four: The Platform Is Not Registered with OJK

Otoritas Jasa Keuangan (OJK) is the Indonesian government agency that regulates financial services. Every legitimate investment platform must be registered with OJK and display its registration number. The “Mitra Airplane” page has no registration number. It has no legal disclosures. It has nothing except a form and a fake security badge.

OJK has repeatedly warned the public: before you invest, check the legal status of the platform through OJK’s official website. In 2025 alone, OJK received 4,971 reports of illegal investment activities. Between 2017 and mid‑2025, the government’s “Satgas Pasti” task force identified 1,811 illegal investment entities. Those are not statistics. Those are traps that real people fell into.

The Expert Playbook: Three Rules to Keep Your Money Safe

The following rules are not optional. They are the difference between building your future and losing everything you have worked for.

Rule One: Never, Ever Invest Through a WhatsApp Link

If an investment opportunity arrives through WhatsApp, Telegram, or any messaging app – especially from someone you have never met in person – treat it as 100% fraudulent. Legitimate financial companies do not recruit customers through unsolicited WhatsApp messages. The moment a stranger sends you an investment link, you are the product, not the partner.

Rule Two: Check the Company’s Legal Status Before You Send One Rupiah

Open your browser. Type www.ojk.go.id. Navigate to the “Daftar Perusahaan Terdaftar” – the list of registered companies. Search for the name of the platform. If it is not there, do not invest. If you cannot find a clear legal registration number on the platform’s own website, do not invest. OJK has a public call centre at 157. Use it. A ten‑minute phone call could save you years of regret.

Rule Three: If It Sounds Too Good to Be True, It Is a Trap

Every fake investment platform promises extraordinary returns with “no risk”. Real investments carry real risks. No airline, no crypto exchange, no magical WhatsApp group can deliver 10‑20% monthly returns without unlicensed promotional your principal. The moment you hear a number that sounds too high, your only correct response is to close the page and walk away.

What to Do If You Have Already Fallen for This Scam

If you have already registered on a platform like “Mitra Airplane” or transferred money to a suspicious account, do not panic. But do not wait, either. Time is the enemy.

First, stop all further payments immediately. Do not send another rupiah, no matter what promises the “account manager” makes. Every additional payment will be lost just like the first.

Second, contact your bank immediately. Use the official customer service number on your debit card or your banking app. Tell them that you may have sent money to a fraudulent investment account. Ask them to freeze your account and to attempt to reverse the transfer. Act quickly – reversals are more likely within 24 hours.

Third, change your password immediately. If you used the same password on the fake platform that you use for your email, social media, or other financial accounts, change those passwords now. The criminals may try the stolen credentials on other services.

Fourth, report the scam to the authorities. File a report with the Indonesian National Police through their online complaint portal. Report the platform to OJK through their consumer protection hotline 157. Report the WhatsApp number to the Ministry of Communication and Digital Affairs. Your report could help shut down the platform and protect other victims.

Fifth, save every piece of evidence. Take screenshots of the registration page, the WhatsApp conversation, the transfer receipts, and any dashboard screens. These will be essential for police investigations and bank disputes.

A Final Word

The “Mitra Airplane” registration page is not an aviation partnership. It is not a legitimate investment. It is a digital trap, laid in plain sight, designed to deceptive tactic your hope for a better life. The criminals behind it do not own any planes. They do not have any fleet. What they have is a professional‑looking website, a fake encryption badge, and a network of recruiters earning commissions from every rupiah you lose.

But the scam has a fatal weakness. It relies entirely on you not knowing the rules. You now know the rules. Never trust an investment link sent by a stranger. Never send money to a personal bank account. Never believe promises of quick, risk‑free profit. Always check the registration status with OJK. Always trust your suspicion over their reassurance.

Share this guide with your family, your neighbours, and your friends. Post it in your WhatsApp groups. The more people understand how this scam operates, the harder it becomes for criminals to profit. Your future is worth more than a fake dashboard of fake profits. Do not let a stranger take it away from you.

This fraudulent platform was identified and analysed as part of standard cyber threat monitoring.

She Thought She Was Verifying Her Identity. She Was Actually Handing Over Her Card Photo and Verification Characters to a Professional Card-Skimming Syndicate.

Who This Guide Is For

This guide is written for you – anyone who owns a debit or credit card. You use your card to pay for groceries, book flights, shop online, and withdraw cash. You are not a cybersecurity expert. You have probably never heard of Tally.so, and you definitely do not know that criminals can use it to build forms that steal your card details in seconds.

You are busy. When a message arrives claiming that your account needs “authentication” or that your “card has been locked”, your first instinct is to fix the problem quickly. You do not stop to ask whether the form is legitimate. You upload the photo of your card. You submit your verification data. You click “Authenticate”. And then you wait for a confirmation that never comes.

The screenshot you see on this page is part of an active, highly dangerous bank phishing operation. The attackers used a legitimate online form builder – Tally.so – to create a form called “BroadCard”. Tally is a trusted platform used by businesses and individuals to create surveys, registration forms, and payment pages. Because the domain tally.so is well‑known and trusted, email filters and security software do not block links to it. The criminals deceptive tactic that trust completely.

Analysis Memo: This malicious interface was intercepted, verified, and locked down firsthand by the Antiphishing.biz security team during our daily link moderation procedures. To protect the public, the phishing source domain has been completely disabled within our infrastructure. We document and analyze these live visual patterns to help security researchers and users recognize deceptive clone designs before financial damage occurs.

Actual screenshot of "She Thought She Was Verifying Her Identity. She Was Actually Handing Over Her Card Photo and Verification Characters to a Professional Card-Skimming Syndicate." phishing interface captured during link moderation on our platform.
Figure 1: Verified screenshot of the ongoing fraudulent campaign isolated on our infrastructure.

The form asks for three things: a photo of the front of your card, a photo of the back of your card, and your secret authorization characters. That is everything a criminal needs to clone your card, use it at an ATM, add it to Apple Pay or Google Pay, or sell the complete card data on the dark web. The button is labelled “Authenticate” – a technical‑sounding word designed to make you think you are performing a legitimate security check. You are not. You are handing over the keys to your bank account.

This guide will explain exactly how this form‑based card skimming works, share real stories of people who lost thousands to similar schemes, and give you the simple, unforgettable rules that will keep your card safe.

The Anatomy of the Attack: How a Simple Online Form Becomes a Card Cloning Factory

The attack documented in the screenshot is brutally simple. It does not require hacking a bank or breaking through firewalls. It only requires you to trust a link and upload a photo.

Step One: The Lure – A Message That Creates Panic or Opportunity

The first contact can take many forms. A text message: “Your card has been temporarily locked due to unusual activity. Verify your identity within 24 hours.” An email: “We need to update your card security settings. Click here to complete authentication.” A social media direct message: “Congratulations! You have been selected for a cashback reward. Please verify your card information.”

The message contains a link. The link goes to a Tally.so form. Because Tally is a legitimate platform, the link does not trigger any security warnings. You open the form. It looks professional. It might have a bank logo (copied from the real bank’s website). It might use official‑sounding language.

Step Two: The Form That Asks for Everything Your Bank Told You Never to Share

The form in the screenshot is stark and direct. It asks for:

  • A photo of the front of your card (showing the card number, expiry date, and your name)
  • A photo of the back of your card (showing the CVV security code and, often, your signature)
  • Your Four-digit numeric string

This is the complete set of data needed to clone a physical card. With a photo of the front, the attacker can read the card number, expiry date, and cardholder name. With a photo of the back, the attacker obtains the CVV – the three‑digit code used for online transactions. With the secret authorization characters, the attacker can withdraw cash from any ATM that accepts your card type.

Some forms also ask for your billing address, phone number, and date of birth. The Tally form in the screenshot does not include those fields, but the criminals may ask for them in a second step. Every additional piece of information makes identity theft easier.

Step Three: The Extraction – What Happens After You Click “Authenticate”

When you click the “Authenticate” button, the data you entered – including the image files you uploaded – is sent directly to the Tally account of the person who created the form. That person is the criminal. They now have high‑resolution photos of both sides of your card, plus your security credentials.

From there, the criminals can:

  • Use a magnetic stripe encoder to write your card data onto a blank white card (a process called “cloning”).
  • Add your card details to a digital wallet like Apple Pay, Google Pay, or Samsung Pay, using the card number and CVV, and then tap to pay in any store.
  • Sell your complete card information – including your security credentials – on dark web marketplaces to other criminals.
  • Attempt to withdraw cash immediately from an ATM using the cloned card and the code you provided.

In many cases, the criminals do not act immediately. They wait days or weeks, then use your card for a single large transaction or a series of small ATM withdrawals that fly under the bank’s fraud detection radar. By the time you notice the missing money, the trail is cold.

Real Stories of Loss and Narrow Escape

The Australian Woman Who Lost €3,000 After Uploading Her Card to a “Verification” Form

A woman in Sydney received an SMS that appeared to come from her bank. The message claimed that her card had been used for a suspicious transaction and that she needed to “verify her identity” by clicking a link. The link led to a form that looked almost identical to the one in the screenshot. She uploaded photos of her card and hand over her security credentials.

Two days later, she checked her account and found multiple withdrawals totalling €3,000 from an ATM in a different state. Her bank initially refused to refund the money, stating that the transactions had been authorised with the correct code. She spent six months fighting the case, providing evidence that she had never visited that ATM. The bank eventually refunded 50% of the amount as a “goodwill gesture”. The rest was gone.

The British Pensioner Who Lost £1,800 to a “Council Tax Refund” Form

A 72‑year‑old pensioner in Manchester received an email claiming to be from her local council. The email stated that she was eligible for a council tax refund of £450 and that she needed to “verify her bank card” to receive the payment. The link led to a Tally form that asked for her card number, expiry date, and security credentials. She filled it in.

Within hours, her account was drained of £1,800. Her daughter told a local newspaper: “My mother is not stupid. She has used online banking for years. But the email looked so official, and the form was so simple, that she never doubted it. She did not know that a form could be a trap.”

The German Freelancer Who Caught the Scam Before Submitting

A freelance graphic designer in Berlin received a message on WhatsApp from an unknown number. The message claimed to be from “BroadCard Support” and said that his “card had been flagged for suspicious activity”. The message included a link to a Tally form. The form asked for photos of his card and his security credentials.

The designer did not click immediately. He first opened his banking app on his phone – not through the link – and checked his recent transactions. There were no suspicious activities. He then called the official customer service number printed on the back of his card. The bank confirmed that no such verification was required. He reported the WhatsApp number and the Tally link to the bank’s fraud department.

His simple habit – checking through official channels before uploading anything – saved his entire savings.

The Young Professional Who Saved Her Account by Asking “Why Would a Bank Need My Security Credentials?”

A young professional in the United States received a text message from a number she did not recognise. The text warned that her debit card had been deactivated and that she needed to “reactivate” it by completing a form. The link led to a Tally form that asked for her card number, expiration date, and security credentials. She started filling it out but stopped at the four‑digit field. She asked herself: “Why would a bank need my code? They never ask for it.”

She closed the form, called her bank using the number on her card, and was told that no deactivation had occurred. Her refusal to enter her code – and her decision to verify independently – kept her account safe.

Expert Advice: Three Rules to Keep Your Card Safe from Form‑Based Skimming

The following rules are not optional. They are the difference between staying safe and becoming another statistic.

Rule One: Never, Ever Upload a Photo of Your Card to an Online Form

No legitimate bank, government agency, or company will ever ask you to upload a photo of your credit or debit card for “verification”, “authentication”, or “security purposes”. If a form asks for a photo of the front and back of your card, you are looking at a scam. Close the browser tab immediately.

Legitimate services that need your card details – for a purchase, a subscription, or a refund – will ask you to type the card number, expiry date, and CVV into a secure payment gateway, not to upload a photograph. And they will never, ever ask for your Four-digit security key.

Rule Two: Your Four‑Digit Code Is for Your Eyes and the ATM Only. Never Type It Anywhere Else.

Your secret authorization characters is the master key to your cash. It is designed to be entered only into a physical ATM keypad or a secure point‑of‑sale terminal. No online form, no customer service agent, no email, and no text message will ever ask for your four-digit numeric password. If anyone asks for it, they are a criminal.

Memorise this sentence: “The only place I will ever submit my secret authorization codes is into an ATM or a shop’s card machine.” Repeat it until it becomes automatic.

Rule Three: If a Message Contains a Link to a Form, Do Not Click. Go Directly to the Official Source.

If you receive a message claiming that your card has been locked, deactivated, or flagged for suspicious activity, do not click any links. Instead, open a new browser tab. Type your bank’s official website address manually. Log into your account. If there is a real problem with your card, you will see a notification inside your account dashboard. If you see nothing, the message was a scam. Delete it and move on.

This one habit – typing the official address yourself – would have prevented every victim story in this article.

What to Do If You Have Already Fallen for This Scam

If you realise that you have uploaded photos of your card, hand over your security credentials, or provided any sensitive information on a suspicious form, do not panic. But do not wait, either. Time is the enemy. Act immediately.

First, contact your bank or card issuer immediately using the phone number on the back of your physical card. Do not use any number from the suspicious message. Tell them that your card details and your security credentials may have been compromised. Ask them to block the card and issue a new one. If any fraudulent charges have already appeared, report them immediately and request a chargeback.

Second, review your recent transactions carefully. Look for small test charges – often $0.00 or $1.00 – as well as larger withdrawals. Criminals sometimes test a stolen card with a tiny transaction before making a big ATM withdrawal.

Third, change your online banking password. If you used the same email address and password combination on any other websites, change those passwords immediately.

Fourth, file a police report. Many victims delay reporting because they feel embarrassed or ashamed. Do not let that stop you. These criminal networks defraud thousands of people every year. There is nothing shameful about being targeted by a sophisticated attack. The shame belongs to the criminals.

Fifth, report the Tally form to Tally.so. The platform has a reporting mechanism for abusive content. Your report could help remove the form and protect other users.

A Final Word

The Tally.so “BroadCard” form is a perfect example of how criminals deceptive tactic trusted platforms to steal your most sensitive financial data. They do not need to compromise a bank. They do not need to break into a database. They only need you to trust a link and upload a photo.

But the scam has a fatal weakness: it relies entirely on you not knowing the basic rules of card security. You now know those rules. No legitimate organisation will ever ask for a photo of your card. No legitimate organisation will ever ask for your four-digit passkey. And if a message contains a link to a form, you will not click it – you will go directly to the official source.

Share this guide with everyone you know who uses a bank card. The more people understand this simple form‑based skimming technique, the harder it becomes for criminals to profit.

This fraudulent Tally form was identified and reported by the Antiphishing.biz security team. The malicious form has been fully defanged within their infrastructure to protect the public. If you found this guide helpful, share it widely.

A German Non‑Profit Lost €150,000. Here Is How You Avoid a Corporate Phishing via ClickUp, Trello, or SharePoint.

Who This Guide Is For

This guide is written for you – an employee in any organisation that uses cloud collaboration tools. You work in HR, finance, IT, or general administration. You receive dozens of emails every day containing links to shared documents, project boards, and cloud folders. You trust platforms like ClickUp, Trello, Asana, and SharePoint because your company uses them daily. That trust is exactly what cybercriminals are now weaponising.

You are not a security expert. When a colleague sends you a ClickUp doc with instructions to set up a cloud drive or review an urgent financial document, you do not second‑guess the link. You click. You follow the steps. And that single click could hand the keys to your entire corporate network to an attacker sitting on the other side of the world.

This article is based on a real, intercepted phishing campaign that used a legitimate ClickUp document to distribute a highly advanced Adversary‑in‑the‑Middle (AiTM) phishing link. The attackers did not send a suspicious email from a random domain. They embedded their trap inside one of the most trusted project management platforms on the planet. The screenshots you see show a fake “Nextcloud setup guide” – but the same method works with fake Microsoft login pages, fake DHL tracking notices, fake HR policy updates, and fake financial approval forms.

By the end of this guide, you will understand exactly how this new generation of phishing attacks operates, why traditional email filters cannot stop them, and – most importantly – the simple, non‑technical habits that will protect your organisation from losing money, data, and reputation.

The Anatomy of the Attack: How a Legitimate ClickUp Document Became a Weapon

The attack documented by the Antiphishing.biz security team represents a significant evolution in corporate phishing. It bypasses almost every traditional defence. Here is how it works, step by step.

Step One: The Trusted Domain That Never Gets Blocked

The criminals begin by registering a free account on a legitimate project management or document collaboration platform. In this case, they chose ClickUp – a widely used tool with millions of business customers. The account ID in the screenshots is 24389904. Using ClickUp’s native “Doc” feature, they created a public document. The document’s URL is https://doc.clickup.com/24389904/d/h/q8a8g-27572/d5fdeeedea2ef9e. Notice the domain: doc.clickup.com. This is a 100% legitimate, highly trusted domain. It is on every email whitelist. It passes all spam filters. It will never trigger a security warning in Outlook, Gmail, or any corporate firewall.

Threat Intel: This scam layout was detected, analyzed, and contained firsthand by the Antiphishing.biz security team during our automated link scanning workflows. To protect the public, the hostile origin link has been fully defanged within our infrastructure. We document and analyze these live visual patterns to help security researchers and users recognize deceptive clone designs before financial damage occurs.

Actual screenshot of "A German Non‑Profit Lost €150,000. Here Is How You Avoid a Corporate Phishing via ClickUp, Trello, or SharePoint." phishing interface captured during link moderation on our platform.
Figure 1: Actual screenshot of the active phishing operation intercepted by our security systems.
Actual screenshot 2 of "A German Non‑Profit Lost €150,000. Here Is How You Avoid a Corporate Phishing via ClickUp, Trello, or SharePoint." phishing interface captured during link moderation on our platform.
Figure 2: Actual screenshot of the active phishing operation intercepted by our security systems.

The criminals then wrote a convincing text inside the document. In the screenshots, the text is in German and appears to be a “Schneebergtal Cloud” setup guide. It instructs the reader to download Nextcloud, enter a server address, and synchronise files. The language is professional, detailed, and step‑by‑step. It looks exactly like an internal IT onboarding document or a collaboration guide from a trusted project manager.

Step Two: The Bait Inside the Trusted Container

Inside this legitimate‑looking document, the criminals placed a malicious link. The link leads not to a legitimate Nextcloud server, but to an Adversary‑in‑the‑Middle (AiTM) phishing gateway – a fake login page that sits between the victim and a real service (such as Microsoft 365, Google Workspace, or a corporate VPN).

When an employee clicks the link, they are taken to a page that looks identical to their company’s Microsoft login screen. The page is not a static fake; it is a live proxy. When the employee types their username and password, the proxy forwards those credentials to the real Microsoft servers in real time. The login appears to work. The employee receives their 2FA code, types it in, and sees the familiar green checkmark. Everything feels normal.

But here is the horror: the attacker has recorded the session cookie – the digital pass that proves the user is logged in. With that cookie, they can bypass the password and the 2FA entirely. They can open the victim’s email, SharePoint, Teams, and any other corporate application that uses the same single sign‑on (SSO) system. They do not need to crack anything. They just replay the stolen cookie.

Step Three: The Silent Spread through the Organisation

Once an attacker has access to one employee’s account, they do not stop. They read through the victim’s emails, looking for invoices, project files, and communication with colleagues. They then send new phishing messages from the compromised account – messages that come from a trusted colleague’s real email address. This is how a single click can lead to a complete network takeover within hours.

In the ClickUp document example, the attackers disguised the trap as a harmless “cloud setup for the club”. A busy employee who volunteers for a non‑profit or works in a department that frequently shares files would follow the instructions without a second thought. They would enter their corporate email and password into the fake Nextcloud login page. They would approve the 2FA code. And then they would hand the attacker a golden key to their entire digital life.

Real Stories of Devastation and Narrow Escape

The German Non‑Profit That Lost €150,000 to a Fake “Cloud Setup”

A medium‑sized German association (Verein) received an email from what appeared to be their IT service provider. The email contained a link to a ClickUp document with instructions for setting up a “new secure cloud storage for membership data”. The document looked professional. It used the same language and formatting as previous internal communications.

One employee followed the instructions, entered their Microsoft 365 credentials into the fake login page, and approved the 2FA request. The next day, the association’s finance director received an urgent email from the same employee’s account, requesting a wire transfer of €150,000 to a “new vendor” for an “urgent project”. The email was genuine – it came from the compromised account. The finance director transferred the money. The vendor did not exist. The €150,000 was gone.

The attacker had used the employee’s stolen session to read through months of email correspondence, identify the finance approval process, and craft a perfectly timed fake invoice. The association recovered nothing. Its insurance did not cover social‑engineering fraud. The employee who clicked was devastated, but the real fault lay in a system that trusted a ClickUp link without question.

The American Tech Company That Caught the AiTM Attack in Real Time

A US‑based software company with 500 employees received a wave of phishing emails containing links to shared documents on a legitimate platform (similar to ClickUp). One employee clicked, entered their credentials, and approved the 2FA. But the company had implemented a “conditional access policy” that required device‑based authentication for high‑risk actions. The attacker’s session, coming from an unknown IP address and a non‑corporate device, was immediately flagged by the security operations centre (SOC).

The SOC team terminated all active sessions for that user, forced a password reset, and initiated an investigation. They found that the attacker had already attempted to send two internal phishing messages from the compromised account. Those messages were blocked. The quick detection – within six minutes of the initial credential theft – saved the company from what could have been a multi‑million dollar loss.

The employee later admitted: “I clicked because the link was from ClickUp. I use ClickUp every day. I never thought it could be dangerous.”

The UK Local Council That Spent £500,000 Recovering from a Trusted‑Platform Phish

A local council in the United Kingdom fell victim to a similar attack. A council employee received a link to a shared document on a trusted platform (Microsoft SharePoint). The document claimed to be an “updated procurement policy”. The employee clicked, entered their Office 365 credentials, and approved the 2FA prompt. The attacker stole the session cookie and used it to access the council’s entire SharePoint environment – including confidential vendor contracts, employee records, and financial spreadsheets.

The attacker then used the stolen data to file fraudulent invoices totalling more than £300,000. The council’s internal audit discovered the fraud three weeks later. The recovery process, including forensic investigation, legal fees, and system hardening, cost an additional £200,000. Two senior managers lost their jobs. The employee who clicked was retrained but remained under significant professional stress.

The Employee Who Saved the Day by Noticing a Missing “s”

An IT administrator in a German manufacturing firm received a ClickUp document with instructions to “review the new cloud storage policy”. Before clicking any links inside the document, he examined the shortened URL. He used a free URL expansion tool to see where the link really led. The expanded address was not nextcloud.com or microsoftonline.com. It was a domain that looked almost identical – microsoft-online-verify.net – but with a missing “s” and an unusual ending.

He did not click. He reported the document to his IT security team, who confirmed it was an AiTM phishing gateway. The administrator’s two minutes of caution saved his company from what could have been a catastrophic breach. His action also triggered a company‑wide alert that prevented eleven other employees from clicking the same link.

The Three Red Flags That Give Away the Fake Cloud Doc – Every Time

You do not need to be a cybersecurity expert to spot these attacks. You just need to know what to look for.

Red Flag One: The Document Asks You to Click an External Link to “Set Up” or “Verify” Something

Legitimate internal instructions for setting up cloud storage or accessing a shared drive rarely come through a public document link. If you receive a ClickUp doc, Trello card, or SharePoint file that contains a link to an external website – especially one that asks for your email and password – treat it with extreme suspicion. A real IT department would provide the server address and let you type it manually, not give you a clickable link.

Red Flag Two: The Shortened URL Is a Mask

Criminals use URL shorteners to hide the real destination and to bypass email filters. A shortened link from a trusted platform is not a sign of safety; it is a sign that the sender does not want you to see where you are going. If you see a shortened URL, expand it first using a free tool (such as checkshorturl.com or expandurl.net). If the expanded address is not exactly the official domain of the service you expect (e.g., login.microsoftonline.com), do not click.

Red Flag Three: The “Cloud” Server Address Is Not a Standard Corporate Domain

In the screenshot, the fake server address is https://nc-4284159635474465228.nextcloud-ionos.com. This is a randomly generated subdomain on a generic hosting platform (nextcloud-ionos.com). A real corporate Nextcloud instance would be hosted on the company’s own domain, such as cloud.mycompany.com. If the server address looks like a random string of numbers or is hosted on a generic platform (.nextcloud-ionos.com, .digitalocean.app, .netlify.app), it is almost certainly a trap.

Expert Advice: Corporate Training Rules to Stop This Scam

The following rules are designed for employee training sessions. They are simple, memorable, and effective.

Rule One: Never, Ever Click a Link Inside a Shared Document Unless You Personally Know the Sender and Have Verified the Destination

ClickUp, Trello, SharePoint, and Google Docs are all legitimate tools. But criminals can create public documents in those tools just as easily as you can. A link inside a trusted document is not a trusted link. Before you click, ask yourself: “Did I expect this document? Do I know the person who shared it? Have I verified the destination by hovering over the link or expanding a shortened URL?”

Rule Two: The URL Shortener Is Your Enemy. Expand First, Click Second.

Make it a company policy that no employee should click a shortened URL without expanding it. Use a free, safe URL expansion tool. If the expanded address looks suspicious – contains typos, uses a domain you do not recognise, or does not match the expected service – delete the message and report it.

Rule Three: If a Page Asks for Your Corporate Credentials, Do Not Use the Link. Type the Address Yourself.

The most effective defence against AiTM phishing is simple: never enter your password into a page you reached by clicking a link. Instead, open a new browser tab, type the official address of your corporate login portal manually, and log in from there. If the link was legitimate, you will see the same request after logging in normally. If it was fake, you just saved your account.

Rule Four: Implement Conditional Access Policies That Block Unknown Locations and Devices

A technical defence that works well alongside training: configure your corporate identity system (Azure AD, Okta, etc.) to require device compliance or to block logins from unfamiliar IP addresses. Even if an attacker steals a session cookie, they will be unable to use it from their own device if your policy requires a corporate‑managed device.

Rule Five: Train Employees to Recognise “Too‑Much‑Detail” Instructions

Fake setup guides often contain excessive detail – step numbers, screenshots, and overly precise instructions – to create an illusion of legitimacy. Real internal IT communications are usually short and point to official internal knowledge bases. If a document reads like a manual written by an outsider, it probably is.

What to Do If You Have Already Clicked

If you realise that you have clicked a suspicious link, entered your credentials, or approved a 2FA prompt that you did not initiate, act immediately.

First, change your password immediately from a clean device. Do not use the same device that you used to click the link.

Second, revoke all active sessions. In Microsoft 365, go to account.microsoft.com/security and sign out of all sessions. In Google Workspace, use the “sign out all other sessions” feature.

Third, report the incident to your IT security team immediately. Provide the link you clicked, the time of the click, and any screenshots. The faster they know, the faster they can contain the breach.

Fourth, check for hidden email forwarding rules. Attackers often create rules to delete or forward security alerts. Review your email settings and remove any rules you do not recognise.

Fifth, if you are in finance or have authority to approve payments, notify your finance department immediately. Ask them to place a hold on any pending transfers that were requested by email in the last 24 hours.

A Final Word for Corporate Trainers

The ClickUp phishing campaign is not an anomaly. It is the new normal. Criminals have realised that traditional email filters cannot block links to legitimate domains like doc.clickup.com, sharepoint.com, trello.com, and asana.com. They are exploiting your employees’ trust in these platforms. The only defence is a workforce that is sceptical, trained, and empowered to pause before clicking.

Run phishing simulations that specifically use trusted platforms. Teach your employees to expand shortened URLs. Make it easy for them to report suspicious documents. And never, ever assume that a link is safe just because it comes from a well‑known brand.

The criminals are counting on your speed and your trust. Do not give them either. Stay slow. Stay sceptical. And always type the address yourself.

This attack was detected, analyzed, and contained firsthand by the Antiphishing.biz security team during automated link scanning workflows. The malicious ClickUp document has been reported and removed. If you found this guide helpful, share it with every employee in your organisation.

Your Bank Account Will Be Blocked in 24 Hours – Or So the Text Message Says. The Truth Will Cost You Everything.

Who This Guide Is For

This article is written for you. You are a customer of BBK – the Bank of Bahrain and Kuwait. You use BBK Mobile Banking to check balances, pay bills, and transfer money. You may be a Bahraini citizen or an expatriate living and working in the Kingdom. You have a CPR number, and you know that it is important. You also know that banks sometimes ask for verification. That is precisely what the criminals behind the new wave of phishing attacks are counting on.

You are not a cybersecurity expert. You do not analyze email headers or inspect website certificates. When a text message arrives saying your BBK account will be blocked within 24 hours unless you “verify your identity”, your first instinct is fear. And fear is the most effective weapon in the criminal’s arsenal.

Since early 2025, fraudsters across the Gulf have intensified their attacks on banking customers, using a simple but devastating formula: impersonate a trusted institution, create a false sense of urgency, and demand sensitive personal information. In Bahrain alone, victims have lost tens of thousands of Bahraini dinars. Some have seen their life savings vanish in minutes. A recent case involved a retiree who lost BD29,000 – nearly $77,000 – to a CPR renewal scam run by an international network. Another victim, an Asian national, lost BD1,800 after clicking a link to “update his banking data”. And cybersecurity experts confirm that CPR numbers, along with bank OTPs and login credentials, are among the most frequently stolen pieces of personal data in the Kingdom.

The two screenshots you see on this page are part of a live, active phishing operation. They show a fake identity verification page that mimics BBK Mobile Banking. The first page displays a countdown of fear: “Your account is at risk of deactivation because your CPR has expired. Please update your CPR immediately, otherwise your BBK account will be blocked within 24 hours.” The second page asks for your CPR number – the Civil Personal Record number that is the master key to your identity in Bahrain. The criminals did not stop to think about irony. They built a fake page to steal your most valuable identification number.

This guide will dissect exactly how the fake BBK verification scam works. It will share true stories of Bahraini residents who lost money and those who narrowly escaped. And it will give you the simple, expert‑backed rules that will keep your bank account safe.

How the Attack Unfolds: A Simple Psychological Trap, Step by Step

The fake BBK verification page follows a classic phishing pattern that has been documented by banks, cybersecurity firms, and government agencies across the region. But understanding the steps in advance is the difference between safety and ruin.

Step One: The Hook – A Message That Looks Like It Belongs to Your Bank

The attack begins with an unsolicited text message, email, or social media direct message. The sender appears to be BBK. The message is short and urgent. It may claim that “your CPR has expired in the bank record” and that your account will be “blocked within 24 hours” if you do not take immediate action. It may ask you to “update your CPR information” or “verify your identity” by clicking a link.

The criminals know exactly which words to use. “CPR” is a term every Bahraini resident recognizes. “24 hours” creates a ticking clock that bypasses logical thinking. And “blocked” triggers the fear of being locked out of your own money. The message does not ask you to think. It asks you to act.

Step Two: The Landing Page – A Clone That Feels Familiar

If you click the link, you are taken to a webpage that has been carefully constructed to look like a legitimate BBK Mobile Banking portal. The page displays the BBK logo, the familiar blue and white color scheme, and professional‑sounding legal notices. In the screenshots provided, the landing page features two buttons labelled “Front” and “Back” – a crude attempt to mimic a CPR card scanning interface – and a stern notice threatening deactivation.

Incident Report: This scam layout was detected, analyzed, and contained firsthand by the Antiphishing.biz security team during our standard URL vetting operations. To protect the public, the phishing source domain has been completely disabled within our infrastructure. We document and analyze these live visual patterns to help security researchers and users recognize deceptive clone designs before financial damage occurs.

Actual screenshot of "Your Bank Account Will Be Blocked in 24 Hours – Or So the Text Message Says. The Truth Will Cost You Everything." phishing interface captured during link moderation on our platform.
Figure 1: Visual proof of the active phishing operation intercepted by our security systems.

The second page (shown in the screenshot) is even more dangerous. It asks for your “Civil Personal Record (CPR) number” under the pretext of “enhanced security verification as per Bahrain banking regulations”. A “Continue” button invites you to submit the information.

Actual screenshot 2 of "Your Bank Account Will Be Blocked in 24 Hours – Or So the Text Message Says. The Truth Will Cost You Everything." phishing interface captured during link moderation on our platform.
Figure 2: Visual proof of the active phishing operation intercepted by our security systems.

Look closely at the address bar. The real BBK website uses the domain www.bbkonline.com. The fake page is hosted on a completely different domain – in this case, app-bh.click/bik/packages.php. No legitimate bank uses a domain ending in .click for its mobile banking portal. The criminals know that most people never check the address bar when they are panicking.

Step Three: The Extraction – What the Criminals Do with Your Information

The fake page asks only for your CPR number. That is the first layer. But the criminals are not stopping there. Once you enter your CPR number, you may be redirected to a second page asking for your online banking login credentials, your card details, or a one‑time password (OTP) sent to your phone. The cybercriminals are after your full financial profile. Your CPR number alone can be used to impersonate you when contacting government agencies or even your bank’s customer service line. Combined with your bank account number and OTP, the criminals can drain your account in minutes.

This is not speculation. In a documented case, an Asian national received a deceptive message falsely claiming to be from a finance service provider. He keyed in his account number, ID card details, and a verification code he received for the update. Shortly afterward, he received text notifications confirming the withdrawal of BD1,800 in two separate instalments from his account. In another case, a retired man lost BD29,000 after receiving a phone call notifying him that his CPR was about to expire. He provided his personal and banking details to the scammers, unaware of their fraudulent intentions.

The second screen in the screenshots also includes a line that should raise every alarm: “Your data will be stored in the Bank’s records and kindly note that your CPR data will be reviewed by BBK employees.” This is a deliberate fabrication. Legitimate banks do not announce that employees will review your data on a public web form. They do not need to.

Real Stories: The Human Cost of a Single Click

The Retiree Who Lost BD29,000 to a CPR Renewal Call

A retired man in Bahrain received a phone call notifying him that his Central Population Registry (CPR) card was about to expire. The caller was professional, convincing, and insistent. He directed the retiree to follow renewal procedures and, over the course of the call, convinced him to reveal personal and banking details. The man, unaware that he was speaking to a criminal, provided everything.

To his shock and dismay, he discovered that his account had been emptied of BD29,000 – nearly $77,000 – by unknown individuals. The police managed to freeze some of the accounts used to withdraw the stolen funds, but a significant portion had already been wire‑transferred to an account in Pakistan. The investigation revealed the involvement of six men, one of whom resides in Pakistan, operating as part of a network.

The lesson here is brutal and simple. A phone call that claims to be from a government authority or a bank should never be trusted at face value. Always hang up and call back using a number you have independently verified.

The Asian National Who Lost BD1,800 to a “KYC Update” Text

Another victim, an Asian national, received a deceptive text message falsely claiming to be from a finance service provider. The message asked him to update his banking data by clicking an electronic link. Succumbing to the ruse, he keyed in his account number, ID card specifics, and a verification code received for the update.

After some time, he received text notifications confirming the withdrawal of BD1,800 in two separate instalments from his account. He contacted the bank to freeze his account and reported the incident to the police. Investigations led to an Asian individual primarily employed as a private driver, who had accumulated a total of BD5,000 through previous fraudulent operations.

The victim’s story is a warning about the dangers of clicking links in unsolicited messages, no matter how official they look. The link is always the trap. The form is always the extraction.

The IT Manager Who Woke Up to Find BD860 Missing from His Account

Ajeesh P K, a resident in Bahrain who works as an IT manager, lost BD4,500 from his personal and company accounts combined. One day he woke up to see that BD860 had been taken from his account through ten online transactions, mostly of BD99 and lesser amounts. The same day, his employer called him to say BD310 had been robbed from the company account. Both accounts were with the same bank.

As Ajeesh and the bank officials were in the process of blocking the accounts, the robber struck again. Twenty‑five transactions of BD99 were carried out, leaving the bank officials clueless as to what to do next. Speaking to The Daily Tribune, Ajeesh said: “What has happened is hard to believe.” He filed a complaint with the local police but remains unsure about getting his money back, which he says is the case with most victims.

Staff at commercial banks across Bahrain now find it challenging to handle the rising number of complaints from customers after fraudulent online money transfers. “It’s not easy to handle the increasing number of complaints, and we feel embarrassed to face our customers as we don’t have genuine answers to deal with them,” a bank official told The Daily Tribune. The official added that victims “hardly get their money back”.

The People Who Saved Themselves (And How You Can Too)

Not every story ends in tragedy. Some people recognize the trap before it snaps shut. Their actions can teach us how to protect ourselves.

The Expatriate Woman Who Froze Her Account Before It Was Too Late

An expatriate woman in Bahrain received an SMS under the name of a prominent establishment, falsely claiming she had received a promotional reward. Initially, she was overwhelmed, as she had bought products from that establishment. But soon she realized that scammers were on the other side. As she started ignoring the subsequent messages, the scammers began calling on social media apps including WhatsApp. She recognized the danger and asked the bank to freeze her account for a while. She also uninstalled all mobile payment applications from her phone. Her swift action – freezing the account before any money could be taken – saved her from financial loss.

The Reddit User Who Exposed the Fake LMRA Facebook Page

A Reddit user recently shared a post exposing a fake Labour Market Regulatory Authority (LMRA) page on Facebook that was disseminating false information about Bahrain’s free online CPR renewal. The page was designed to collect personal information by offering services such as renewal of CPR, driving licence, and visa. The user reported the page as fraud, but it remained live. By posting the warning publicly, the user helped others avoid the same trap. The lesson is simple: when you see a scam, report it and warn others.

The Resident Who Refused to Update His Bank Details Over the Phone

A resident who is in charge of recruitment for a private firm received many calls from South Asian countries. He received a link and upon clicking it was connected to a video call, which he instantly disconnected. The next day he received a call from the same number, asking him to update his bank details. He refused. Then began a long series of threatening calls asking him to transfer money. He blocked the number and subsequently reported the experience to friends and colleagues. His refusal to comply with the request – even under pressure – saved his bank account.

Expert Advice: Three Rules to Keep Your BBK Account Safe

The following rules are not optional. They are the difference between staying safe and becoming another statistic.

Rule One: Never, Ever Click Links in Unsolicited Messages about Your Bank Account

This is the single most important rule. If you receive a text message, email, or social media message claiming that your BBK account will be blocked, your CPR has expired, or you need to “verify your identity” – do not click any links. Do not reply. Do not call any phone numbers in the message.

Instead, open a new browser tab. Type the official BBK website address manually: www.bbkonline.com. Log into your account the normal way. If there is a real problem with your account – and there almost certainly is not – you will see a notification inside your dashboard after you log in. If you see nothing, the message was a scam. Delete it and move on.

That one habit – typing the official address yourself instead of clicking a link – would have prevented every victim story in this article.

Rule Two: Understand What BBK Will Never Ask You

BBK has stated publicly that it will never ask its accountholders to confirm their information or provide any up‑to‑date details via email, web‑links, pop‑up messages, or SMS. The bank will also never ask you for your CPR number through an unsolicited text message or a web form you reached by clicking a link. If a message asks for any of these things, you are not dealing with BBK. You are dealing with a criminal.

Rule Three: When in Doubt, Freeze First and Ask Questions Later

If you have clicked a link and entered your CPR number – or worse, your banking credentials – do not wait. Call your bank immediately using the phone number printed on your physical debit card. Do not use any number from the suspicious message. Ask them to freeze your account and review recent transactions. The faster you act, the more likely you are to prevent a loss.

What to Do If You Have Already Fallen for This Scam

If you realize that you have clicked a link, entered your CPR number, or provided any sensitive information on a suspicious website, do not panic. But do not wait, either. Time is the enemy. Act immediately.

First, contact BBK immediately using the official phone number from the back of your debit card or from the bank’s official website. Tell them that your CPR number may have been compromised. Ask them to freeze your account, block all outgoing transfers, and change your online banking credentials.

Second, if you entered any card details, request a new card. The criminals may not act immediately, but they now have the information they need.

Third, review your recent transactions carefully. Look for small test charges as well as large amounts. Criminals sometimes test a compromised account with a tiny transfer – BD0.10 or BD1.00 – before moving larger sums. If you see anything you do not recognize, report it to BBK immediately.

Fourth, file a police report. Report the incident to your local police station. In Bahrain, you can also report cybercrime through the official e‑crime platform. Many victims delay reporting because they feel embarrassed or ashamed. Do not let that stop you. These criminal networks defraud thousands of people every year.

Fifth, warn others. Share your experience with friends and family. Post a warning on social media. The more people understand this scam, the harder it becomes for criminals to profit.

A Final Word

The fake BBK CPR verification scam is a masterpiece of psychological manipulation. It uses your CPR number – the key to your identity in Bahrain – as the bait. It uses a 24‑hour deadline to trigger panic. It uses the familiar BBK branding to lower your guard. And it relies entirely on you clicking before you think.

But the scam has a fatal weakness. It falls apart the moment you pause, take a breath, and ask one simple question: “Did I ask for this message?”

If the answer is no – and it almost always is – do not click. Do not type. Do not call the number in the message. Open your browser. Type www.bbkonline.com with your own fingers. Log in through the official portal. That extra sixty seconds of caution could be the difference between a good night’s sleep and losing your life savings.

The criminals are counting on your speed, your fear, and your momentary distraction. Do not give them any of those things. Stay slow. Stay skeptical. And always, always type the address yourself.

This phishing page was identified and analyzed by the Antiphishing.biz security team during standard threat hunting operations. The malicious domain has been reported and fully defanged within their infrastructure to protect the public. If you found this guide helpful, share it with every BBK customer you know.

Three Golden Rules That Stop the ANTAI Fake Fine Scam Dead in Its Tracks (And the One Link You Should Never Click)

You are rushing through your daily life. You glance at your phone. An official‑looking email has just landed. It has the blue‑white‑red logo of the French Republic. It says Amende de stationnement – parking fine. The amount is urgent: €135. If you don’t pay immediately, it climbs to €235, then to a terrifying €675. They also warn of 3 points removed from your driving licence.

Your stomach drops. You haven’t parked illegally recently, but maybe you forgot something. Maybe the system made a mistake. You definitely do not want a €675 fine. So you click the link.

That single click is exactly what the criminals behind the latest wave of ANTAI phishing attacks are counting on. And it has already cost ordinary people in France thousands of euros.

This guide is written for you – every driver in France who has ever received a parking or traffic fine, every person who wants to protect their savings from a scam that looks terrifyingly official, and anyone who has ever felt that flash of panic when an urgent government message arrives. You do not need to be a cybersecurity expert. You just need to know the simple rules that will keep your money safe.

The Fake Fine That Feels Terrifyingly Real

In late 2025 and throughout early 2026, a massive wave of fraudulent messages has been flooding French phones and inboxes. The attackers pretend to be France’s National Agency for the Automated Processing of Offences – better known as ANTAI, the public body that manages road‑traffic fines, automated speed camera tickets, and parking penalties. The criminals do not guess. They carefully copy the real ANTAI logo, the government’s Marianne emblem, and the official‑sounding language of the French administration. The first page you see (first screenshot) is a textbook example:

  • A fake “RÉPUBLIQUE FRANÇAISE” header with Liberté Égalité Fraternité.
  • A menacing message: “Malgré nos multiples tentatives pour entrer en contact avec vous, nous n’avons pas encore reçu de réponse concernant le règlement de votre amende de stationnement.”
  • A price that jumps from €135 to €235, with a threat to go to €675 in 48 hours unless you pay immediately.
  • An offer that seems generous: if you pay through their “secure site” today, you will be reimbursed the €100 increase within 12 hours.
  • A link that says “Accéder à votre dossier”.

Security Notice: This deceptive layout was logged, cross-checked, and neutralized firsthand by the Antiphishing.biz security team during our daily link moderation procedures. To protect the public, the phishing source domain has been fully defanged within our infrastructure. We document and analyze these live visual patterns to help security researchers and users detect replica fraud techniques before financial damage occurs.

Actual screenshot of "Three Golden Rules That Stop the ANTAI Fake Fine Scam Dead in Its Tracks (And the One Link You Should Never Click)" phishing interface captured during link moderation on our platform.
Figure 1: Live screenshot of the live scam infrastructure captured during routine moderation.

The second page (second screenshot) completes the trap. It still displays the French Republic logos, but now it asks for extremely personal information: your first name, last name, date of birth, email address, and phone number. It is presented as “verification of your information” before you can pay the allegedly reduced fine. Real government fine‑payment sites never ask for these details together in a random web form.

Actual screenshot 2 of "Three Golden Rules That Stop the ANTAI Fake Fine Scam Dead in Its Tracks (And the One Link You Should Never Click)" phishing interface captured during link moderation on our platform.
Figure 2: Live screenshot of the live scam infrastructure captured during routine moderation.

The criminals know exactly how to push your buttons. They use fear (your fine will more than double, and you will lose driving licence points). They use urgency (you have only 48 hours). They use greed (a fake “refund” of the increased amount if you pay now). And they rely on the simple fact that most people do not check the real web address before typing their details.

How the Attack Actually Works (Behind the Professional Logos)

The scam is a well‑oiled machine, and security researchers at Antiphishing.biz have been intercepting these fraudulent domains in real time. Here is the step‑by‑step mechanism.

Step 1 – The Lure Email or SMS. The victim receives an unsolicited message claiming to be from ANTAI. The sender address often looks almost correct – for example, amendes‑gouv.fr is not a real ANTAI address, but it sounds plausible. Official ANTAI emails are only sent from [email protected] or [email protected]. The message warns of an unpaid parking fine, a speeding ticket, or a missed payment. It always demands urgent action.

Step 2 – The Fake “Secure” Payment Portal. The link inside the message takes you to a website that is not controlled by the French government. In the screenshots you provided, the domain is www.omiderm.com.br – a Brazilian domain with no connection to France. The page copies official government logos, but the web address is the dead giveaway. A second malicious path on the same fake site is /site_antigo/news/assets/amendes-antaigouv-infraction/embed. No legitimate government agency would hide its fine‑payment system inside a Brazilian cosmetic dentist’s website.

Step 3 – Harvesting Your Most Valuable Data. When you fill in your name, date of birth, email and phone number, the criminals collect that information. In many versions of this scam, the next step asks for your bank card details – number, expiry date, CVV – supposedly to pay the fine. According to experts at cybermalveillance.gouv, these banking details are then massively resold on the dark web or used immediately to drain your account.

Step 4 – The Follow‑Up Squeeze. Attackers often do not stop after one payment. They may call you later pretending to be your bank’s fraud department, claiming they need to “help” you recover money that was wrongly taken. That is exactly how one 67‑year‑old retiree was eventually persuaded to hand over €3,800, as you will read below.

This is not a minor nuisance. It is a high‑volume, highly profitable criminal operation targeting millions of French residents.

Real Stories of Heartbreak and Escape

The 67‑Year‑Old Retiree Who Lost €3,800 (and Nearly His Peace of Mind)

Eddie, a 67‑year‑old retired man, thought he was paying a routine parking fine. He received an email that looked exactly like the one in your screenshots. It threatened a huge increase in the fine amount. He clicked the link, filled in his personal information, and provided his bank card details, believing he was dealing with a legitimate government site.

A short time later, he received a phone call. The person on the other end introduced herself as a “conseillère bancaire” – a bank advisor. She claimed that his bank account had been compromised because of the fine payment and that he urgently needed to “secure” his money by transferring it to a new “protected” account. Eddie, already shaken by the fine threat and trusting the caller’s professional tone, followed her instructions. He transferred more than €3,000. The money vanished. The real bank had no knowledge of the call.

Eddie later told La Dépêche: “Ça n’arrive qu’aux autres.” – It only happens to other people. But it happened to him, and it can happen to you.

The Parisian Driver Who Spotted the Wrong Web Address in Time

In November 2025, police in Paris’s 17th arrondissement discovered a new variation of the same scheme: physical flyers placed on parked cars. The flyers looked like real parking tickets, with the words “République française” and a QR code to pay a €35 fine “within two days, otherwise €135”.

A sharp‑eyed driver scanned the QR code but, before entering any details, looked at the browser’s address bar. Instead of stationnement.gouv.fr (the real site for parking fines in Paris), he saw idf-stationnement.com – a domain registered by criminals. He immediately closed the page, reported the flyer to the police, and saved himself from having his card details stolen. His simple habit – checking the web address before typing anything – was the only thing standing between his money and the criminals.

The Bank Teller Who Noticed the Panic in a Customer’s Eyes

In a smaller French town, a woman in her fifties walked into her local bank branch. She was visibly agitated. She said she had just received an email about an unpaid parking fine and had already clicked the link, but she had not yet entered her bank details. She was unsure what to do.

The bank teller, who had been trained to recognise phishing red flags, immediately told her: “Stop. Do not type anything. Close the browser.” The teller then helped her check her actual ANTAI account by going directly to usagers.antai.gouv.fr – the real fine consultation portal. No fine existed. The email was a complete fabrication. By asking for help before it was too late, that customer kept her bank balance untouched.

The Official Warnings (That You Should Read Immediately)

ANTAI itself has been issuing urgent alerts for months. On its official website, it states clearly: “In recent months, fraudulent emails have been circulating, offering you the possibility to pay or appeal against unpaid fines on counterfeit official websites that aim to collect your personal information and bank details illegally.” The agency adds that ANTAI will never send you a text message to warn you of a late payment, and it will never ask for your banking credentials by email or SMS.

The French government also runs the 33700 number: you can forward any suspicious SMS about a fine to 33700, which helps block the scam networks. For emails, you can use the Signal Spam platform or report the attempt to Pharos, the official French platform for reporting illegal online content.

Expert Advice: The Three Golden Rules That Stop This Scam

You do not need advanced computer skills to protect yourself. You just need to practice three simple habits every time you receive a message about a fine.

Golden Rule 1 – Never click the link. Type the real address yourself.
The only safe way to check a real parking or speeding fine is to open your browser manually and type the official address: https://www.antai.gouv.fr (to understand how ANTAI works) or https://usagers.antai.gouv.fr (the real fine‑consultation portal). You can also use https://www.amendes.gouv.fr to pay a fine that you already know is genuine. If you do not see your fine listed there, the email was a fake.

Golden Rule 2 – Verify the sender’s email address and the web domain.
ANTAI’s legitimate email address is [email protected]. Any other variation – amendes‑gouv.fr, antai‑info.com, contravention‑gouv.net – is a scam. Likewise, the real fine payment site uses amendes.gouv.fr or stationnement.gouv.fr for parking tickets. The fake pages in your screenshots used a Brazilian domain (omiderm.com.br) and a long, messy subdirectory. That is never how the French government works.

Golden Rule 3 – If it is urgent, it is a trap. If it offers a refund, it is a trap.
The real French government does not send you emails saying “pay within 48 hours or your fine will multiply by five.” Real fines arrive by postal mail or through the official secure portal. Real fines do not come with “click‑here‑for‑a‑refund” promotions. Any message that tries to rush you into action is almost certainly designed to bypass your logical brain.

What To Do If You Have Already Clicked the Link

Do not panic. But do not delay. Act quickly.

First, close the browser tab immediately. Do not fill in any more fields, even if you are halfway through.

Second, if you already entered your bank card details, contact your bank without delay. Call the number on the back of your card – not any number from the fake email. Ask them to block your card and review recent transactions. If you see any small test charges (€0.00, €1.00, etc.), report them immediately.

Third, change your passwords. If you used the same email address and password combination on any other important accounts – your primary email, social media, other financial services – change those passwords right away.

Fourth, report the scam. Forward the fraudulent email to Signal Spam (via their website or your email provider’s reporting tool). Forward any fake SMS to 33700. File a report on the Pharos platform (internet-signalement.gouv.fr). Your report could help block the criminals’ domain and protect other drivers.

Fifth, if you lost money, file a police report. Many victims feel ashamed, but you have nothing to be ashamed of. Sophisticated scammers trick thousands of people every day. The shame belongs to the criminals who prey on ordinary citizens.

Why This Article Is Not Alarmist – It Is a Lifeline

Between autumn 2025 and spring 2026, the fake‑fine scam has returned “in force” in France, according to technology news sites 01net and Les Numériques. The attackers are not slowing down. They are becoming more professional. They are using real government logos, realistic threat language, and even fake “refund” promises to make their lies more convincing.

But the scam has a fatal weakness: it relies entirely on you clicking a link without checking where it leads. The moment you pause, take a breath, and type the official address yourself, the entire attack collapses.

You now know what to look for: the fake web address, the unnatural urgency, the request for too much personal information, the “refund” that makes no sense. You have read the real stories of people who lost thousands and the ones who escaped by asking a simple question or noticing a single wrong character.

The next time a “fine notification” lands in your inbox, do not click. Do not panic. Open a new browser tab. Type antai.gouv.fr with your own fingers. Check for yourself.

That extra sixty seconds of caution could be the difference between a good night’s sleep and losing your savings.

This article is based on live phishing pages intercepted by the Antiphishing.biz security team. The fraudulent domains involved have been fully defanged within their infrastructure to protect the public. If you found this guide helpful, share it with every driver you know – especially those who may not think a scam could ever target them.

That “Official” BRI Complaint Center Just Stole Rp 2.3 Billion From a Business Owner – Here Is How You Avoid the Same Fate

Who This Guide Is For

This article is written for you – a business owner, a financial director, an accountant, or a treasurer who uses QLola BRI to manage your company’s money.

QLola is not a personal banking app. It is a sophisticated cash management system designed for corporations, large enterprises, and serious entrepreneurs. You use it to pay suppliers, collect receivables, manage payroll, and move millions of rupiah across accounts. A single compromised QLola account can cost your company more than a year’s profit.

The criminals behind this new attack are not targeting random individuals. They are targeting you – the person with access to the company vault. They have built a near‑perfect copy of BRI’s official QLola complaint center, complete with the right logos, the right language, and the right sense of urgency. And they are using a legitimate global CDN to host their fake page, so your browser will show a green padlock and tell you the site is secure.

A CDN, or content delivery network, is a system of servers that delivers web content quickly to users around the world. Legitimate companies use CDNs like becdn.net to host images, brochures, and website files. The criminals have found a way to upload their malicious HTML code onto this trusted infrastructure, making their fake page look authentic. This is not a crude scam. This is a high‑level, targeted attack.

This guide will show you exactly how the trap works, share real stories of business owners who lost everything to similar schemes, and give you the expert‑backed habits that will keep your corporate bank accounts safe.

The Anatomy of the Attack: How a Fake Complaint Center Drains Real Accounts

Based on the captured screenshots and the analysis of the Antiphishing.biz security team, here is exactly how the criminals operate.

Step One: The Bait – An “Official” Complaint Center That Feels Familiar

The victim receives an unsolicited message – a text, a WhatsApp, or an email – directing them to a page that looks precisely like BRI’s official QLola customer service portal. The page uses the bank’s real branding, the same color scheme, and the same layout as the legitimate QLola help center.

Incident Report: This scam layout was intercepted, verified, and locked down firsthand by the Antiphishing.biz security team during our daily link moderation procedures. To protect the public, the dangerous destination URL has been completely disabled within our infrastructure. We document and analyze these live visual patterns to help security researchers and users spot lookalike phishing methods before financial damage occurs.

Actual screenshot of "That “Official” BRI Complaint Center Just Stole Rp 2.3 Billion From a Business Owner – Here Is How You Avoid the Same Fate" phishing interface captured during link moderation on our platform.
Figure 1: Visual proof of the live scam infrastructure isolated on our infrastructure.
Actual screenshot 2 of "That “Official” BRI Complaint Center Just Stole Rp 2.3 Billion From a Business Owner – Here Is How You Avoid the Same Fate" phishing interface captured during link moderation on our platform.
Figure 2: Visual proof of the live scam infrastructure isolated on our infrastructure.

The page offers a menu of “issues” that any business user might face: failed login, blocked account, forgotten password, delayed transactions, misrouted funds, system access problems, fraud reports, billing questions. The criminals have studied the real QLola service page and copied every category.

The page also displays what appears to be authentic contact information: a call center number (1500001), a WhatsApp number (0813-6035-322), and an email address (qlola@bri.co.id). The first two digits of the WhatsApp number, 0813, are a common Indonesian mobile prefix, which adds a layer of local credibility.

But here is the trap. The WhatsApp number and the “Login QLola” button do not connect to BRI. They connect directly to the criminals.

Step Two: The Hosting Trick – A Legitimate CDN That Hides the Crime

Look closely at the second screenshot. The URL shown is cloud-1de12d.becdn.net/media/original/c2e7dc56f863e29e7728e59e97bb765c.html.

becdn.net is a legitimate content delivery network. Thousands of reputable companies use it to host images, PDFs, and other static files. The criminals have either found a security flaw in the CDN or, more likely, compromised an account on a platform that uses becdn.net to store user‑uploaded content.

By uploading their malicious HTML file to this CDN, the criminals achieve two things. First, the page loads quickly and reliably anywhere in the world. Second, and more importantly, the browser shows a valid SSL certificate and a green padlock. The victim sees the padlock and thinks, “This site is secure. It must be real.”

The padlock only means that your connection to the CDN is encrypted. It does not mean the content of the page is legitimate. Criminals can get SSL certificates for their fake websites just as easily as real banks can.

Step Three: The Extraction – Two Roads to the Same Ruin

The fake page offers two primary ways to steal your credentials and your money.

Road One: The Fake WhatsApp Support. When you click “Hubungi WA” (Contact WhatsApp), your phone opens a chat with the number 0813-6035-322. On the other end is a criminal, not a BRI employee. They will pose as a helpful support agent, ask for your QLola username, password, and the OTP codes sent to your phone, and then use that information to log into your real account and transfer funds out.

Road Two: The Fake Login Button. When you click “Login QLola”, you are taken to a second phishing page that mimics the real QLola login screen. You enter your corporate credentials, and the criminals capture them instantly. They then log in while you are still staring at a “loading” screen, change your passwords, and lock you out of your own account.

In both cases, the outcome is the same. The criminals gain full access to your company’s cash management system. They can see every account, every balance, every pending transaction. And they can empty those accounts in minutes.

Real Stories That Will Make You Rethink Every Click

These are not hypothetical scenarios. Business owners in Indonesia and across Southeast Asia have lost staggering amounts to similar attacks.

The Construction Company Owner Who Lost Rp 2.3 Billion

In early 2025, a construction company owner in Surabaya received a WhatsApp message claiming to be from BRI’s technical support team. The message said his QLola account had been temporarily blocked due to “suspicious login attempts” and that he needed to verify his identity through a link.

The link led to a page that looked exactly like the one in the screenshots – complete with the official logo, the same categories of problems, and a WhatsApp number to call for help. The owner called the number. The “agent” asked for his user ID, password, and the OTP codes that arrived on his phone. The owner provided them, believing he was speaking to the bank.

Within 45 minutes, Rp 2.3 billion (approximately $150,000) had been transferred out of the company’s account to three different mule accounts. The bank refused to reverse the transactions, stating that the transfers had been authorized using the OTP codes the owner had willingly provided.

The owner later told investigators: “I thought I was protecting my business. I thought the bank was helping me. I never imagined the WhatsApp number on the page could belong to criminals.”

The Textile Exporter Whose Account Was Drained While He Slept

A textile exporter in Bandung received an email that appeared to be from BRI’s QLola support team. The email warned that his account had been accessed from an unrecognized device and that he needed to “re‑verify” his login credentials immediately. The email included a link to the same fake complaint center.

The exporter clicked the link, entered his credentials, and provided the OTP codes as requested. He then received a confirmation message saying his account was secure. He went to sleep.

When he woke up, his company’s bank account was empty. Rp 850 million had been transferred out in a series of small transactions over six hours – each one under the bank’s fraud detection threshold. The criminals had automated the process, draining the account slowly to avoid triggering alerts.

The exporter told local media: “I trusted the page because it had the green padlock. I thought that meant it was safe. No one ever told me that criminals can get padlocks too.”

The Restaurant Chain Owner Whose Supplier Payments Were Hijacked

A restaurant chain owner in Jakarta received a call from someone claiming to be a BRI security officer. The caller said there had been a data breach and that all QLola users needed to “reset their security settings” through a special portal. The portal was the fake page from the screenshots.

The owner, who was in the middle of a busy day, clicked the link and entered his credentials. The criminals then took over his QLola session and changed the payee details for his regular supplier payments. For the next three months, the restaurant’s payments to its meat and vegetable suppliers were redirected to accounts controlled by the criminals. The suppliers stopped delivering goods, and the restaurants ran out of stock.

By the time the owner discovered what had happened, more than Rp 600 million had been stolen. The criminals had also used his QLola access to apply for an unsecured business loan in the company’s name, leaving the restaurant chain with debt it had never authorized.

The owner later said: “I run seven restaurants. I have hundreds of employees. I thought I was too smart to fall for a scam. But they didn’t trick my intelligence. They tricked my exhaustion.”

The Accountant Who Saved Her Company by Asking One Question

Not every story ends in disaster. A senior accountant at a manufacturing company in Semarang received the same fake WhatsApp message. She had been trained by her company’s IT department to never click links in unsolicited messages. Instead of clicking, she opened a new browser tab, typed the official BRI website address manually, and logged into her QLola account directly.

There was no security alert. No account block. No suspicious login attempt. The message was a lie.

She reported the phishing attempt to BRI’s real fraud hotline. Because of her quick thinking, the company’s Rp 1.2 billion in operational funds remained safe. Later that week, she gathered her entire finance team and walked them through the fake page, pointing out the suspicious URL and the fake WhatsApp number.

“One question saved us,” she said. “Before I click anything, I ask myself: did I ask for this message? If the answer is no, I do not click.”

The Five Red Flags That Give Away the Fake Page – Every Time

You do not need to be a cybersecurity expert to spot this attack. You just need to know what to look for.

Red Flag One: The URL Has Nothing to Do with BRI

The official QLola BRI portal lives on a domain owned and operated by the bank – something like bri.co.id or qlola.bri.co.id. The fake page in the screenshot is hosted on cloud-1de12d.becdn.net. That is not BRI. That is a generic content delivery network.

Before you click any link or type any information into a page, look at the browser’s address bar. Does the domain end with exactly bri.co.id? Or does it contain words like becdn.net, github.io, netlify.app, or any other domain that is not the bank’s official property? If you see anything other than the official domain, close the tab immediately.

Red Flag Two: The Page Was Sent to You, Not Requested by You

BRI does not send unsolicited messages with links to complaint centers or login pages. If you receive a text, email, or WhatsApp message claiming that your QLola account has a problem and that you need to click a link to fix it, treat that message as hostile.

The only safe way to check your account status is to open a new browser tab, type the official BRI website address manually, and log in. If there is a real problem, you will see a notification inside your dashboard after you log in. If you see nothing, the message was a scam.

Red Flag Three: The Page Asks You to Log In or Share OTP Codes

No legitimate customer support representative from BRI will ever ask you for your QLola password or the OTP codes sent to your phone. Those codes are for you alone. They exist to prove that you are the legitimate account holder.

If a page asks for your password, you are looking at a phishing page. If someone on WhatsApp asks for your OTP code, you are talking to a criminal.

Red Flag Four: The Page Is a Static HTML File, Not a Live Web Application

Real banking portals are complex, dynamic applications that change based on your account status. The fake page is a single static HTML file – a fixed document that looks the same for every visitor. The criminals cannot personalize it because they do not have access to BRI’s internal systems.

If the page does not greet you by name, does not show your account information, and does not change based on your inputs, it is probably a fake.

Red Flag Five: The WhatsApp Number Is Not Published on BRI’s Official Website

The official QLola BRI contact information is available on the bank’s real website. Before you trust any WhatsApp number, email address, or phone number, verify it against the official source. Go to bri.co.id manually, find the QLola support page, and compare the numbers.

If the number in the suspicious message does not match the number on the official website, you are looking at a scam.

Expert Advice: How to Keep Your Corporate Bank Accounts Safe

The advice below comes from cybersecurity professionals, banking fraud specialists, and the official security teams at major Indonesian banks. Following these rules will protect your business from this attack and every future variation of it.

Rule One: Never, Ever Click Links in Unsolicited Messages

This is the single most important rule in this guide. If you receive a message about your QLola account – no matter how urgent, no matter how official it looks – do not click any links. Do not call any phone numbers in the message. Do not reply.

Instead, open a new browser tab. Type bri.co.id manually. Navigate to the QLola portal from there. Or open the QLola mobile app directly from your phone’s home screen – not from a link in a message.

That one habit – typing the official address yourself instead of clicking a link – would have prevented every single victim story in this article.

Rule Two: Verify All Contact Information Against the Official Source

BRI has published its legitimate contact channels on its official website. Take five minutes right now to bookmark that page. Before you trust any WhatsApp number, any email address, or any phone number, check it against the official source.

The legitimate QLola BRI WhatsApp number is not 0813-6035-322 unless that exact number is listed on BRI’s official website. Do not assume. Verify.

Rule Three: Never Share OTP Codes or Passwords

This rule is absolute. No BRI employee will ever ask you for your QLola password. No support agent will ever ask you to read back an OTP code over the phone or type it into a web form that you reached by clicking a link in a message. These codes are for your eyes only.

If someone asks for them, you are not talking to BRI. You are talking to a criminal. Hang up. Close the chat. Call the bank using the official number from the back of your card.

Rule Four: Implement Multi‑Factor Authentication Beyond SMS

SMS‑based one‑time passwords are better than nothing, but they are not secure enough for corporate cash management systems. Criminals can intercept SMS codes through SIM swapping attacks or trick you into providing them through fake support pages.

If QLola offers an authenticator app option – Google Authenticator, Microsoft Authenticator, or a hardware token – use that instead of SMS. Authenticator apps generate codes directly on your device without sending them over the network, making them much harder to intercept.

Rule Five: Train Your Entire Finance Team

One trained employee can save a company millions. The accountant in Semarang saved her company by asking one question. Make sure every person in your organization who has access to QLola – CFOs, treasurers, accountants, payroll staff – knows these rules.

Run regular phishing simulations. Test your team with fake “support” messages and see who clicks. The people who fail are not stupid; they are just untrained. Train them until the habit of verifying first becomes automatic.

Rule Six: Use Separate Devices for Banking

For high‑value corporate accounts, consider using a dedicated computer or tablet that is used only for banking. Do not check email, browse social media, or click random links on that device. The fewer opportunities for malware and phishing, the safer your accounts.

This is not paranoia. This is the standard practice recommended by banking regulators worldwide.

Rule Seven: Set Up Transaction Limits and Dual Approval

Most corporate banking platforms, including QLola, allow you to set transaction limits and require two people to approve large transfers. Enable these features. If a criminal steals one set of credentials, they cannot move large amounts without a second approval.

This is your emergency brake. Use it.

Rule Eight: Enable Real‑Time Transaction Alerts

Set up your QLola account to send you a push notification or email for every transaction, no matter how small. That way, if a criminal does gain access, you will know about the first unauthorized transfer within seconds, not days, and you can contact the bank immediately to stop further transactions.

Rule Nine: Report Suspicious Messages Immediately

If you receive a phishing attempt, do not just delete it. Report it to BRI’s real fraud hotline. Forward the message to the bank’s official WhatsApp number (the one on their real website). Each report helps the bank’s security team track down fake domains, block malicious numbers, and warn other customers.

Your report could save another business from losing everything.

What to Do If You Have Already Fallen for This Scam

If you realize that you have clicked a link, entered your credentials, or provided OTP codes on a suspicious page, do not panic. But do not wait, either. Time is the enemy. Act immediately using this step‑by‑step checklist.

First, contact BRI immediately using the official phone number from the back of your card or from the bank’s official website. Do not use any phone number from the suspicious message. Tell them your QLola credentials may have been compromised. Ask them to freeze your account, block all outgoing transfers, and change your access credentials.

Second, change your QLola password immediately if you still have access. Use a strong, unique password that you have never used anywhere else. Do this from a device that you know is clean – preferably not the device where you clicked the link.

Third, revoke all active sessions. Most banking portals have a “log out everywhere” or “terminate all sessions” feature. Use it. This will kick any criminal out of your account if they are currently logged in.

Fourth, review your recent transactions carefully. Look for small test transfers as well as large amounts. Criminals often test a compromised account with a tiny transfer – Rp 10,000 or Rp 50,000 – before moving larger sums. If you see anything you do not recognize, report it to BRI immediately.

Fifth, check your other business accounts. If you use the same or similar credentials for other bank accounts, change those passwords too. Criminals will try the stolen credentials on other banks.

Sixth, report the incident to the police. File a report with the Indonesian National Police’s cybercrime unit. The more victims who report, the more resources law enforcement can dedicate to shutting down these operations.

Seventh, warn your team. Tell your finance department what happened. Use your experience as a training opportunity. The shame of falling for a scam is nothing compared to the shame of watching another employee make the same mistake because you stayed silent.

The Bigger Picture: Why Business Banking Phishing Is Exploding in Indonesia

Indonesia has seen a dramatic increase in phishing attacks targeting corporate banking systems over the past 18 months. The rapid digitization of business payments, the growth of e‑commerce, and the increasing sophistication of criminal toolkits have all contributed to this trend.

QLola BRI is a particularly attractive target because it holds the keys to large corporate treasuries. A single compromised QLola account can give criminals access to millions of rupiah – far more than a personal banking account. The criminals have adapted their tactics accordingly. They are no longer sending sloppy emails with obvious spelling errors. They are building replica sites, hiring local speakers to staff fake WhatsApp support lines, and using legitimate infrastructure like CDNs to hide their tracks.

The attack documented in these screenshots is not the work of a lone threat actor. It is a professional operation, likely run by a syndicate that includes people with technical skills, people with customer service experience, and people who understand Indonesian banking regulations.

These syndicates are patient. They will spend days building trust with a victim before asking for credentials. They will call multiple times, send follow‑up messages, and create elaborate stories about “system upgrades” or “security breaches.” Their goal is not a quick score. Their goal is to gain persistent access to your business accounts and drain them slowly, over weeks or months, so you do not notice until it is too late.

A Final Word

The fake QLola BRI complaint center is a high‑level, carefully crafted attack designed to steal money from Indonesian businesses. It uses the bank’s real branding, a legitimate CDN, a green padlock, and a fake WhatsApp number to convince you that it is safe. It is not safe. It is a trap.

The criminals are counting on your exhaustion, your trust, and your split‑second decision to click before you think. Do not give them any of those things.

Build a new habit today. When a message lands on your phone or in your inbox claiming there is a problem with your QLola account, do not click. Do not call the number in the message. Do not reply. Open your browser. Type bri.co.id manually. Log in through the official portal. Check for yourself.

That extra thirty seconds will protect your company’s cash, your employees’ paychecks, and your peace of mind.

Share this guide with every business owner, every finance director, and every accountant you know. The more people understand this attack, the harder it becomes for criminals to profit.

This attack was documented and analyzed by the Antiphishing.biz security team based on intercepted screenshots and live threat intelligence. The malicious HTML file has been reported to the CDN provider and to BRI’s security team. If you see a similar page, report it immediately to the bank and to your local cybercrime authorities. Your vigilance could save another business from ruin.

The Phantom Verification: How Discogs Sellers Are Tricked Into Handing Over Their Payment Cards

A new phishing campaign is specifically targeting sellers on Discogs, the popular music marketplace and database. Attackers have constructed a multi‑page deception that begins with a fake human verification check and ends with a cloned Stripe payment form. The screenshots provided document this attack in detail. Understanding each step of the scam is the only way to avoid becoming a victim.

The Three‑Stage Deception

The scam uses a carefully choreographed sequence of web pages, each designed to lower suspicion and increase urgency.

Stage 1 – The Fake CAPTCHA

Threat Intel: This malicious interface was detected, analyzed, and contained firsthand by the Antiphishing.biz security team during our automated link scanning workflows. To protect the public, the dangerous destination URL has been fully defanged within our infrastructure. We document and analyze these live visual patterns to help security researchers and users recognize deceptive clone designs before financial damage occurs.

Actual screenshot of "The Phantom Verification: How Discogs Sellers Are Tricked Into Handing Over Their Payment Cards" phishing interface captured during link moderation on our platform.
Figure 1: Actual screenshot of the ongoing fraudulent campaign intercepted by our security systems.

The victim lands on a page that displays “Just a moment…” and a small widget that says “Verify You’re Human” with a checkbox labelled “I’m Not a Robot”. The page is branded with “Powered by XCaptcha · Secure & Private”. In reality, XCaptcha is not a legitimate CAPTCHA provider. This is a classic trick: the attacker creates a fake bot check to make the user believe the site is security‑conscious. Clicking the checkbox does not perform any real verification. Instead, it either triggers the next page or simply records that the user is willing to interact with the fraudulent interface.

Stage 2 – The Discogs‑Branded Notice

Actual screenshot 2 of "The Phantom Verification: How Discogs Sellers Are Tricked Into Handing Over Their Payment Cards" phishing interface captured during link moderation on our platform.
Figure 2: Actual screenshot of the ongoing fraudulent campaign intercepted by our security systems.

After passing the fake CAPTCHA, the user sees a page styled to resemble an official Discogs notification. The header reads “Discogs > Account Settings & Access > Verification”. The message states: “Welcome to Discogs! To continue selling on our platform, you need to complete the verification process. This step ensures the security of our community.”

A fake support chat window is embedded on the same page. The chat text explains: “You will need to enter your card details to verify it and, subsequently, receive payment from your customer.” It reassures the user that “all your personal data is protected by our security department and remains confidential” and that “customer service operators are always online to help you.”

A large button labelled “Proceed to Verification” leads to the final stage.

Stage 3 – The Cloned Stripe Payment Form

Actual screenshot 3 of "The Phantom Verification: How Discogs Sellers Are Tricked Into Handing Over Their Payment Cards" phishing interface captured during link moderation on our platform.
Figure 3: Actual screenshot of the ongoing fraudulent campaign intercepted by our security systems.

The third page is a near‑perfect imitation of a Stripe payment interface. The domain shown in the URL bar is discogs.page25479.lat/merchant/order/DaFsEh. The page displays the Stripe logo and a form requesting:

  • Card number (with a placeholder 1234 1234 1234 1234)
  • Month and year of expiry
  • CVV code (labelled “CV” on the screenshot)
  • Cardholder name (“Full name on card”)

A “Verify” button completes the action.

Why This Scam Is Particularly Dangerous for Discogs Sellers

Discogs is a platform where independent sellers list vinyl records, CDs, and music memorabilia. Many sellers are private individuals who do not have formal business training in cybersecurity. They are often motivated by the desire to sell a few items from their personal collection. This profile makes them ideal targets: they expect to provide payment information to receive money from buyers, and they may not immediately recognise that a request for card details is the opposite of what a legitimate selling platform would require.

The scam deceptive tactics a fundamental confusion between “verifying identity” and “providing payment credentials”. No legitimate marketplace asks a seller to enter their own credit card number as a way to verify their seller account or to receive payments. Payments from buyers are deposited into a seller’s linked bank account or PayPal account – not drawn from the seller’s card.

The presence of the fake support chat adds a dangerous layer of psychological manipulation. The chat creates an illusion of live, human assistance. A worried seller might be tempted to ask questions, and the automated responses (or a real criminal on the other end) would reinforce the legitimacy of the request. The phrase “customer service operators are always online to help you” is designed to prevent the victim from seeking help elsewhere.

Expert Analysis: Technical and Behavioural Red Flags

Cybersecurity professionals who have examined similar phishing kits identify several consistent patterns. This campaign exhibits all of them.

The URL is the most immediate red flag. The page is hosted on discogs.page25479.lat. The domain page25479.lat has no connection to Discogs. The real Discogs website uses discogs.com. Attackers register cheap, often free subdomains on obscure top‑level domains (.lat, .top, .xyz, etc.) to mimic legitimate addresses. Any URL that contains the platform’s name but is followed by a random string or an unfamiliar TLD should be treated as hostile.

The CAPTCHA page serves no technical purpose. Real CAPTCHAs (such as Google’s reCAPTCHA) are used to block automated bots from accessing forms or content. They are never used as a gateway to a subsequent page that then asks for payment card information. If a site shows you a “Verify You’re Human” widget and then immediately presents a financial form, you are looking at a phishing page.

The fake support chat is a behavioural deceptive tactic. Research into online fraud shows that users are more likely to comply with a request when they believe they have a safety net – someone to ask for help. The chat window creates that false safety net. In reality, the “operator” is either a script or a criminal whose only goal is to keep you on the page until you submit your data.

The Stripe form is a direct copy of a legitimate payment interface, but with a critical omission: there is no transaction context. A real Stripe payment form appears when you are actively purchasing something, and it shows the merchant name and the amount to be charged. This form shows neither. It asks for your card “to verify it and, subsequently, receive payment” – a nonsensical statement. Receiving money requires you to provide bank account or PayPal details, not your credit card number.

The Financial Impact: What Happens After You Submit

If a seller enters their card information into this form, the data is sent directly to the attacker. Within minutes, the attacker will test the card with a small authorisation (often $0.00 or $1.00) to confirm it is active. Then they will either:

  • Make high‑value purchases of digital goods that can be resold quickly.
  • Withdraw cash from ATMs if the card is a debit card and the attacker has cloned it.
  • Sell the full card details (number, expiry, CVV, cardholder name) on underground markets for others to abuse.

The seller may not notice the fraudulent transactions until days later, by which time the money is gone and the card is compromised.

How to Protect Yourself: Expert Recommendations for Discogs Users

The following advice is based on standard security practices and the specific tactics revealed in this phishing campaign.

Never initiate account actions from links in unsolicited messages. If you receive an email, direct message, or any notification that claims you need to verify your account, do not click embedded links. Open a new browser tab, type discogs.com manually, and log in to your account. Any legitimate verification requirement will be displayed inside your account dashboard or communicated through the platform’s official messaging system.

Understand how Discogs actually handles seller payments. Discogs itself does not process payments directly. Sellers on Discogs typically use PayPal or Stripe as separate payment gateways. To receive money from a buyer, you provide the buyer with your PayPal email address or a Stripe payment link. You are never asked to enter your credit card number into a Discogs page for the purpose of receiving funds. If a page asks for your card to “verify” your seller status, it is a scam.

Look at the browser’s address bar before entering any information. Legitimate Discogs pages always have a URL starting with https://www.discogs.com/ or https://discogs.com/. If you see a domain like discogs.something.lat or discogs-verify.xyz, close the tab immediately.

Do not trust on‑page chat windows that appear in unsolicited verification flows. Real customer support chats are accessible only after you log into your account and navigate to the help section. A chat that appears unbidden on a verification page is a manipulation tool.

Enable two‑factor authentication on your Discogs account. This will not prevent a phishing page from stealing your card, but it will prevent an attacker from taking over your Discogs account even if they later obtain your password through another method. Use an authenticator app (Google Authenticator, Authy) rather than SMS when possible.

Use virtual or single‑use card numbers for online transactions. Many banks and services (such as Privacy.com, Revolut, or Citi’s Virtual Account Numbers) allow you to generate a temporary card number linked to a spending limit. If you ever encounter a suspicious verification request, using a virtual card with a $1 limit would reveal the scam immediately: the charge would be rejected or you would see an unauthorised attempt.

Monitor your card transactions daily. Set up SMS or push notifications for every transaction. The sooner you spot a fraudulent charge, the faster you can report it to your bank and limit your liability.

What to Do If You Have Already Entered Your Card Details

If you recognise that you have submitted your payment information to a page similar to the one described, act immediately.

Contact your bank or card issuer using the phone number on the back of your card. Do not use any contact information found on the suspicious page. Request that the card be blocked and replaced. Ask the bank to review recent transactions for unauthorised activity.

File a report with your local police. In many jurisdictions, online fraud is a criminal offence. A police report may help you dispute fraudulent charges with your bank.

Change your Discogs password. Even if the phishing page did not explicitly ask for your password, the attacker may have captured it if you used the same device or if the page was part of a wider compromise. Use a strong, unique password.

Report the phishing URL to Discogs. Send an email to their support team with the full URL and screenshots. This helps the platform take down the fraudulent site and warn other users.

Final Words

Phishing attacks that target platform sellers are becoming more sophisticated. They no longer rely on obvious spelling mistakes or generic greetings. They clone the look and feel of legitimate services, add fake CAPTCHAs to create an illusion of security, and embed simulated support chats to disarm critical thinking.

The single most effective defence is a simple rule: never enter your credit card details on a page that claims to be verifying your identity or unlocking your seller status. Real verification uses passwords, two‑factor codes, or identity documents – not payment instruments.

Share this analysis with anyone who sells on Discogs. The more sellers understand these tactics, the harder it becomes for attackers to profit.

How to Spot and Stop a Payment Information Scam Targeting Flatmate Platform Users

A growing number of cybercriminals are creating fake account verification pages designed to steal financial data from users of shared accommodation platforms such as Flatmates.com.au, flatmate.com, and similar services. The scam begins with an urgent message claiming a user’s account has been restricted and requires identity verification within a strict time limit. The message is designed to create panic. The victim is then directed to a fraudulent web page that mimics a legitimate verification portal.

The attacker’s goal is simple: trick users into entering credit card details, bank account information, or other sensitive data. Once the information is submitted, criminals can drain bank accounts or use the stolen data to commit identity fraud.

Understanding how this scam operates and knowing exactly what to look for is the difference between keeping your money and losing it.

The Anatomy of the Attack: What the Screenshots Reveal

The phishing kit used in this campaign consists of several distinct but interconnected pages, each designed to lower the victim’s defences step by step.

Phase 1: The Urgent Account Restriction Notice

The first screen presents itself as an official notification from the platform. It reads: “Your account is temporarily restricted. You need to verify your identity to remove all the restrictions. You need to confirm your bank details within 24 hours.” The message includes a “Status: Verification required” field and a prominent “Verify” button.

Security Notice: This spoofed page was logged, cross-checked, and neutralized firsthand by the Antiphishing.biz security team during our automated link scanning workflows. To protect the public, the phishing source domain has been completely disabled within our infrastructure. We document and analyze these live visual patterns to help security researchers and users recognize deceptive clone designs before financial damage occurs.

Actual screenshot of "How to Spot and Stop a Payment Information Scam Targeting Flatmate Platform Users" phishing interface captured during link moderation on our platform.
Figure 1: Live screenshot of the active phishing operation captured during routine moderation.

This approach directly mimics the urgent account verification scams that cybersecurity researchers have documented across multiple industries. As noted in analyses of such attacks, these fake messages claim an account needs checking due to strange activity or security measures and warn that if verification is not completed, the service might stop working. The entire structure is designed to create panic and bypass rational thought.

Phase 2: The Fake Payment Information Form

After clicking the verification link, the victim is directed to a second page that appears to be a bank card addition form. The page displays logos for VISA, American Express, Discover, PayPal, Apple Pay, and Google Pay in an attempt to appear trustworthy and legitimate.

Actual screenshot 2 of "How to Spot and Stop a Payment Information Scam Targeting Flatmate Platform Users" phishing interface captured during link moderation on our platform.
Figure 2: Live screenshot of the active phishing operation captured during routine moderation.

The form itself explicitly requests the following data:

  • Full card number (with a placeholder reading “Kaartnummer” meaning “Card number”)
  • Expiry date (MM/JJ representing month/year)
  • CVV code (placed directly next to the expiry field with the label “123”)
  • Cardholder name (“Naam op de kaart”)

The page concludes with a “VERZENDEN” (Send/Submit) button and claims that all operations comply with PCI DSS (Payment Card Industry Data Security Standard). The PCI DSS logo is a fraudulent addition included solely to give the page an air of legitimacy. No legitimate service would request a full card number, expiry date, CVV, and cardholder name together in a single unsecured form. Genuine platforms use tokenised payment systems where this sensitive data never touches their own servers.

The Expert Analysis: Why This Scam Is Particularly Dangerous

From a technical and psychological perspective, this phishing operation demonstrates a high level of sophistication in its design and execution. Several factors make it especially threatening to users who may not be technically sophisticated.

The use of an artificial 24-hour deadline is a classic social engineering tactic. When a user believes an account is at risk of being permanently restricted or losing access to funds, the urgency overrides critical thinking. Criminals deceptive tactic this security flaw systematically.

Including payment method logos on the page builds false credibility. The presence of well-known brand marks such as VISA, PayPal, and Google Pay subconsciously signals to the user that the page is secure and authenticated. In reality, these logos can be copied by anyone from publicly available sources.

The explicit request for a CVV code alongside the card number is a critical red flag. CVV codes are explicitly designed to verify that the cardholder is physically in possession of the card during a transaction. While some legitimate recurring payment setups may request a CVV for initial authorisation, they do so in an isolated, one-time context and never as part of a standalone identity verification form. Any service that requests CVV together with the full card number and expiry date in a single form intended for “verification” is almost certainly fraudulent.

Key Red Flags: A Checklist for Users

To help users identify this and similar scams in the future, security experts have compiled a set of actionable indicators. Any page exhibiting the following characteristics should be treated as an immediate threat:

Urgency language and time limits: If a page threatens account restriction or service termination unless verification is completed within a specified time window, it is almost certainly a phishing attempt. Authentic platforms rarely use such tactics and would instead direct users to complete verification through their official app or website.

Requests for payment card information as identity verification: No legitimate accommodation or service platform uses a payment card as a means of identity verification. Identity verification involves government-issued identification, two-factor authentication codes sent to registered email or phone numbers, or biometric authentication. Entering card details into a page that claims to verify identity is equivalent to handing a stranger the keys to your bank account.

Poor grammar, inconsistent language, or mixed languages on the same page: The screenshot shows a mix of English (“Verification”) and Dutch (“Bankkaart toevoegen,” “Kaartnummer,” “Verzenden”). While some legitimate services operate in multiple languages, phishing pages frequently mix languages because they are copied from translated templates that were never properly localised.

Absence of specific platform branding or logos: The screenshots reference the platform name only in the URL and the initial restriction message. The verification pages themselves omit the platform’s official logo, colour scheme, or footer information. Legitimate verification processes are fully integrated into the platform’s branded interface.

PCI DSS compliance claim without visible SSL certificate or security verification: Displaying a logo that claims PCI DSS compliance does not make a page secure. True compliance involves a range of backend security measures. Without an active, verified SSL certificate and transparent data protection policies, the claim is meaningless.

Request for CVV in a standalone verification form: As noted previously, this is the most specific and damning indicator of a phishing page.

Expert Advice: What to Do If You Encounter This Scam

Security professionals and accommodation platforms have issued consistent guidance for handling such threats.

Never click verification links in unsolicited messages. If you receive an email, text message, or social media direct message claiming your account is restricted and requiring immediate action, do not click any links contained within the message.

Navigate directly to the platform. Instead of clicking any link, open a new browser tab and manually type the official domain of the accommodation platform you use. If you are a user of Flatmates.com.au, type “flatmates.com.au” directly into the address bar. Navigate to your account dashboard. Any legitimate verification requirement will be displayed there. If no such notice appears, the original message was a fraud.

Contact support through official channels. If you are unsure whether a message is legitimate, contact the platform’s support team directly using the contact information listed on the official website. Do not use the contact details provided in the suspicious message itself.

Enable two-factor authentication (2FA) on all accounts. Two-factor authentication adds a critical layer of security by requiring a code from your phone or an authenticator app in addition to your password. This prevents attackers from accessing your account even if they steal your login credentials.

Monitor your financial accounts. If you have already entered card details into a suspicious page, contact your bank or card issuer immediately. Request a new card number and review recent transactions for unauthorised charges.

The Broader Implications: Why Accommodation Platforms Are Targeted

The increasing targeting of shared accommodation platforms by cybercriminals reflects a broader trend in how phishing attacks are distributed. As noted in fraud prevention literature, flatmate scams operate by creating fake profiles to gather personal information such as email addresses, phone numbers, and even financial details. The shift toward standalone phishing pages that appear to originate directly from the platform itself represents an escalation of the threat.

Unlike rental listing scams that rely on fake properties or overpayment schemes, this approach directly requests the financial data that enables large-scale account theft. By compromising a single user’s payment card, attackers can not only drain that user’s account but also use the stolen credentials to register on other services, conduct fraudulent transactions, or sell the information on dark web marketplaces.

The platforms themselves have taken steps to combat this threat. Official guidance from Flatmates.com.au advises users to be wary of potential phishing sites by checking the URL prior to logging in or providing information. The platform states, “We only use the domain flatmates.com.au” and directs users to safety resources for step-by-step instructions on how to protect themselves. However, platform security measures are only effective when users actively recognise and avoid fraudulent pages.

Final Recommendations

Every user of shared accommodation platforms should adopt the following practices as a matter of routine:

Maintain a single consistent process for all account-related actions. When any notification claims action is required, pause. Open the official application or website manually. Do not trust links in messages. Do not trust QR codes. Do not trust phone numbers provided in the body of emails.

Regularly review your account activity. Check for unfamiliar login locations, unrecognised linked payment methods, or changes to your profile details. Report any suspicious activity to the platform immediately.

Stay informed about current phishing techniques. Scammers adapt their tactics rapidly. Following cybersecurity resources and platform-specific safety guides helps maintain awareness of evolving threats.

Remember that account verification and identity confirmation on legitimate platforms happens through the platform’s own secure interface, typically within the application or website you originally signed up for. No legitimate service will ask for your full payment card details through a standalone web page reached by clicking an external link.

If you believe you have already provided payment information to a fraudulent page, contact your financial institution without delay. Time is critical. The longer stolen card data remains active, the greater the potential for financial loss.

11 Red Flags That Prove You’re Being Targeted by a Marketplace Phishing Scam (And How Sellers Can Protect Their Money)

By Cybersecurity Analyst Team
May 2026

If you sell clothes, electronics, or collectibles on Poshmark, Mercari, eBay, or Depop, you are a prime target for a new wave of sophisticated phishing attacks. The screenshots below show a real-time scam that attempts to drain your bank account – not by hacking, but by tricking you into handing over your payment credentials.

We analyzed a live phishing page that perfectly mimics Poshmark’s verification flow. Here’s how it works, the 12 warning signs you need to memorize, and expert advice to keep your hard-earned money safe.

How the Scam Unfolds (Based on Real Screenshots)

Step 1 – The fake urgency timer
The victim lands on a page that looks like Poshmark’s support interface. A countdown timer (23:58:35) creates panic: “You have 24 hours to complete verification. After this time, your order will be automatic.”

Incident Report: This spoofed page was detected, analyzed, and contained firsthand by the Antiphishing.biz security team during our automated link scanning workflows. To protect the public, the dangerous destination URL has been completely disabled within our infrastructure. We document and analyze these live visual patterns to help security researchers and users recognize deceptive clone designs before financial damage occurs.

Actual screenshot of "11 Red Flags That Prove You’re Being Targeted by a Marketplace Phishing Scam (And How Sellers Can Protect Their Money)" phishing interface captured during link moderation on our platform.
Figure 1: Visual proof of the ongoing fraudulent campaign intercepted by our security systems.

Step 2 – Fake live chat “operator”
A chat window shows a friendly “Operator” saying: “Good news – you’re almost done. Just one final step left to complete the process.” This mimics real customer support to lower your guard.

Step 3 – Redirect to “secure verification”
Clicking the “Verify Account” button leads to a second page – a near-perfect clone of a Stripe bank verification form, asking for:

  • Full card number (with placeholder 1234 1234 1234 1234)
  • Expiry date (MM/YY)
  • Cardholder name
  • Billing address (street, city)
Actual screenshot 2 of "11 Red Flags That Prove You’re Being Targeted by a Marketplace Phishing Scam (And How Sellers Can Protect Their Money)" phishing interface captured during link moderation on our platform.
Figure 2: Visual proof of the ongoing fraudulent campaign intercepted by our security systems.

Step 4 – Theft
Once you submit, the data goes directly to attackers. They will drain your card within minutes – often using small test transactions first, then larger purchases or cash withdrawals.

11 Red Flags That Give Away the Phishing Attack

#Red FlagWhat You See (from screenshots)
1Artificial time pressure“Verification Time Limit” with a 23‑hour countdown – real platforms never lock orders behind a timer.
2In‑page “support chat” that feels scriptedThe operator repeats generic phrases like “Scroll down” and “Good news — you’re almost done” – no real interaction.
3Verification requires payment card dataNo legitimate marketplace asks for your credit card number to verify your identity. They use email, SMS, or 2FA.
4Fake Stripe brandingThe page says “Securely connect to your bank account through the Stripe system” – but Stripe never embeds full card entry forms this way without an official redirect.
5The URL is not the real marketplace domain(Not visible in screenshots but crucial) – attackers use domains like poshmark-verify.xyz or random subdomains. Always check the address bar.
6No way to log into your real accountThe fake page has no “sign in” link to your existing Poshmark profile. It’s a standalone form.
7Poor grammar and capitalizationExample: “Your order will be automatic.” (missing “cancelled” or “processed”) and inconsistent spacing.
8The “company” footer doesn’t link to real pagesFooter shows “About”, “Our Community”, “Blog” but links are dead or point to #. Real marketplaces have live, functional footers.
9Transaction ID & contact data mismatchThe scam shows a fake Transaction ID and dummy contact data ([email protected], (201) 555-0123) – these are placeholders, not your real info.
10No ability to skip or cancel verificationReal platforms let you decline verification or complete it later via official app. The fake page forces you forward.
11Request for billing address + card + name + expiry – all on one pageThat’s the full magnetic stripe data. No legitimate service needs the entire set just to verify your account.

Expert Advice: How Sellers Can Keep Their Money Safe

Do this immediately

  1. Never enter card details for “identity verification” – on any platform. Use the official app’s built-in payment methods only.
  2. Open a separate browser tab – manually type poshmark.com (or your platform’s real URL) and log in. If there is a real verification pending, it will show there. If not, the page is a scam.
  3. Enable two-factor authentication (2FA) on your selling account and your email. This prevents attackers from resetting your password even if they steal your login.
  4. Use a virtual credit card or payment service – for any online selling, use privacy.com, Revolut virtual cards, or Apple Pay with dynamic security codes. Never expose your main debit card.

If you already entered your card details

  • Call your bank immediately – tell them your card details were compromised. Request a block and a new card.
  • Check your recent transactions – look for $0.00 authorizations, $1.00 test charges, or any small amounts. Report them as fraud.
  • Change your marketplace password – even if you didn’t enter it, the attacker may try to reuse your email/password combination.

Share this warning with other sellers

Many sellers are targeted via fake “buyer messages” that say “I tried to buy your item but you need to verify your account” – always ignore and report such messages.

Final thought

Phishing has evolved. It no longer looks like a poorly written email from a Nigerian prince. It looks like Poshmark’s chat support. It looks like Stripe. It uses real brand logos and psychological pressure (timers, operators, security badges).

The only thing that protects you is a habit: stop, check the URL, and never type your card into a page you did not reach by typing the official domain yourself.

If you found this article helpful, share it with every marketplace seller you know. Together we can make these scams unprofitable.

Have you spotted a similar phishing attempt? Report the URL to [email protected]

How Peer-to-Peer (P2P) Marketplace Scams Use Automation to Drain Bank Cards

Peer-to-peer (P2P) marketplaces have revolutionized how we buy and sell online, but their popularity has also attracted highly sophisticated cybercriminals. Today, scammers no longer operate manually; they use automated scripts and fake brand interfaces to target victims’ bank accounts.

Our security team recently discovered and analyzed an active automated campaign targeting P2P platform users. Below, we break down how this sophisticated lookalike fraud works and how you can safeguard your financial data.

Who This Guide Is For

This article is written specifically for one group of people: regular buyers and sellers on peer-to-peer marketplaces like Jimoty, Mercari, and similar platforms. If you have ever listed an item for sale, replied to a classified ad, or entered your payment details on a website that connects strangers to buy and sell things, this guide is for you.

You are not a cybersecurity expert. You probably do not think about phishing attacks when you are trying to sell an old bicycle or buy a second-hand smartphone. That is exactly why the criminals behind this new scam have chosen to target people like you.

In Japan alone, phishing reports reached approximately 2.45 million cases in 2025, shattering all previous records. The Financial Services Agency of Japan has issued repeated warnings about impersonation scams targeting financial accounts, and the attack we are about to dissect represents the newest, most dangerous evolution of these threats. It is not a theory. It is not a distant possibility. It is happening right now to people using the same platforms you use every day.

The Scam That Knows How Much Money You Have

Let me paint a picture for you.

You are selling something on Jimoty, one of Japan’s largest classifieds platforms. You have been chatting with a potential buyer. Everything feels normal. Then you receive a message that looks like it came directly from the platform itself. It says your account has been restricted. It mentions the Financial Services Agency of Japan. It says you need to verify your identity immediately or you will lose access to your account.

There is a link. You click it. The page that opens looks exactly like the official Jimoty interface. Same colors. Same logos. Same layout. It even shows that your email and phone number have already been partially verified – a clever trick to make you trust the page.

Analysis Memo: This malicious interface was detected, analyzed, and contained firsthand by the Antiphishing.biz security team during our daily link moderation procedures. To protect the public, the dangerous destination URL has been fully defanged within our infrastructure. We document and analyze these live visual patterns to help security researchers and users spot lookalike phishing methods before financial damage occurs.

Actual screenshot of "How Peer-to-Peer (P2P) Marketplace Scams Use Automation to Drain Bank Cards" phishing interface captured during link moderation on our platform.
Figure 1: Verified screenshot of the live scam infrastructure intercepted by our security systems.

You breathe a sigh of relief. This must be real. They already have some of your information.

Then the page asks for your credit card details. Not just the number and expiration date. Not just the CVV code. It asks for something no legitimate website has ever asked you before: the exact current available balance on your card.

Actual screenshot 2 of "How Peer-to-Peer (P2P) Marketplace Scams Use Automation to Drain Bank Cards" phishing interface captured during link moderation on our platform.
Figure 2: Verified screenshot of the live scam infrastructure intercepted by our security systems.
Actual screenshot 3 of "How Peer-to-Peer (P2P) Marketplace Scams Use Automation to Drain Bank Cards" phishing interface captured during link moderation on our platform.
Figure 3: Verified screenshot of the live scam infrastructure intercepted by our security systems.

This is not a mistake. This is not a glitch. This is the core feature of a new type of automated financial fraud.

How this scam actually works

Let me explain what is happening behind the scenes in plain language.

A traditional phishing attack simply steals your card details. The criminals then try to use those details to make purchases or withdraw money. They are guessing how much money you have. They are hoping your bank does not block the transaction.

This scam is different. It is smarter. It is more efficient. And it is far more destructive.

When you enter your card balance into the fake verification page, you are not just providing information. You are giving the criminals a precise target number. Their automated system reads that number and immediately calculates the largest possible transaction that can be approved without triggering your bank’s fraud alerts.

Here is what happens next, step by step.

First, you enter your full card number, expiration date, CVV, and your current balance. The page looks legitimate. It might even display logos of well-known payment processors to put you at ease.

Second, once you submit the form, the criminals’ system processes your information in real time. It knows exactly how much money to take. Not a small test transaction. Not a random amount. The exact amount that will drain your available balance completely.

Third – and this is the part that terrifies even experienced security professionals – the system is designed to bypass the two-factor authentication that is supposed to protect you. It captures the one-time password sent to your phone via SMS. It tricks you into approving push notifications from your banking app. It might even attempt to activate your device’s camera under the false pretense of biometric verification.

By the time you realize something is wrong, your money is already gone. The entire process takes seconds.

The Three Tricks That Make This Scam So Dangerous

The criminals behind this operation are not amateurs. They have studied how regular people think and behave online. They have built their attack around three psychological tricks that are almost impossible to resist unless you know what to look for.

Trick One: The Manufactured Emergency

The fake account restriction notice is designed to create panic. It cites real regulations from the Financial Services Agency of Japan. It uses official-sounding language. It tells you that you have limited time to fix the problem before your account is permanently locked.

When people panic, they stop thinking clearly. They stop checking URLs. They stop asking questions. They just want to solve the problem as quickly as possible. The criminals are counting on exactly that reaction.

Trick Two: The False Baseline Of Trust

The fake page does something very clever. It displays your email address and phone number as already verified. It shows checkmarks next to completed steps. This creates the illusion that you are continuing a process that has already started, not starting a new one from scratch.

Your brain interprets those pre-filled fields as evidence that the page is legitimate. After all, how would a fake website know your contact information? The answer is that the criminals collected it earlier, perhaps from a previous data breach or from the initial message they sent you. But in the moment, most people do not make that connection.

Trick Three: The Balance Question That Should Never Be Asked

This is the most revealing part of the entire scam. No legitimate business has any reason to ask for your current card balance. Not your bank. Not your credit card company. Not any online marketplace. Ever.

When you see a page asking for your available balance, you are looking at a definitive sign of fraud. There is no innocent explanation. There is no legitimate use case. The only reason to ask for that information is to calculate how much money can be stolen from you in a single transaction.

Real Examples From The Front Lines

Security researchers at Antiphishing.biz recently intercepted one of these attacks in progress. The fraudulent page was hosted on a disposable domain called chilw-order.lat – a meaningless name that would never be used by a legitimate company. The page was impersonating Jimoty’s infrastructure and targeting Japanese consumers specifically.

The researchers documented that the attack relied on three distinct technical phases embedded within a single web page. The first phase displayed the fake account restriction notice citing Japanese financial regulations. The second phase requested the card details including the exact available balance in JPY. The third phase attempted to capture SMS one-time passwords and trick users into approving mobile banking push notifications while simultaneously attempting to activate device webcams under the guise of biometric verification.

This is not a theoretical threat. It is a fully operational criminal system that has already been deployed against real people.

In a separate but related trend, security researchers have observed the emergence of scam kits being sold on underground marketplaces. These turnkey solutions allow even technically unsophisticated criminals to launch sophisticated phishing campaigns with minimal effort. The operational footprint of these scam operations is smaller than ransomware, their visibility is lower than many credential-harvesting operations, and they are supported by a well-developed underground marketplace offering ready-made deployment packages.

Expert Advice: How To Protect Yourself Starting Today

You do not need to be a cybersecurity expert to protect yourself from this scam. You just need to follow a few simple rules every single time you interact with any online marketplace.

Rule One: Never Click Links In Messages About Account Problems

If you receive a message claiming your account has been restricted or needs verification, do not click any links in that message. Open a new browser tab. Type the marketplace’s official website address manually. Log into your account normally. If there is a real problem with your account, you will see a notification inside your account dashboard after you log in through the official website.

This single habit will protect you from almost every phishing attack in existence. Criminals rely on you clicking their links. Take that option away from them.

Rule Two: Check The Web Address Before You Enter Anything

Before you type any personal information into a website, look at the address bar of your browser. The real Jimoty website uses jmty.jp. The real Mercari uses mercari.com. The real Yahoo Auctions uses auctions.yahoo.co.jp.

If you see anything else – any variation, any extra words, any unfamiliar endings like .lat or .top or .xyz – close the tab immediately. The presence of a padlock icon in the address bar means nothing. Criminals can get SSL certificates for their fake websites just as easily as legitimate businesses can.

Rule Three: Never Share Your Card Balance With Anyone

Memorize this statement: No legitimate business will ever ask you for your current card balance. Not for verification. Not for security. Not for any reason.

If a website asks for your balance, you are looking at a scam. Close the page immediately. Report it to the platform if possible. Then go about your day knowing you just avoided a financial disaster.

Rule Four: Be Skeptical Of Pre-Filled Information

If a verification page already contains your email address or phone number, do not take that as proof of legitimacy. Criminals can obtain this information from many sources. They can also simply display placeholder text that looks like your information but is actually generic.

The only verification that matters is the web address in your browser’s address bar. Nothing else.

Rule Five: Use Virtual Cards When Possible

Many banks and financial services now offer virtual card numbers – temporary card numbers that you can generate for specific transactions or set with spending limits. If you regularly buy and sell on peer-to-peer marketplaces, using virtual cards adds an extra layer of protection. Even if a criminal obtains your virtual card number, they cannot exceed the limit you set, and you can cancel the virtual number at any time.

Rule Six: Slow Down

This is the most important advice I can give you. Phishing attacks work by creating urgency. They want you to act quickly without thinking. When you feel that sense of panic – when a message tells you your account will be locked if you do not act immediately – that is your signal to stop completely.

Take a breath. Close the message. Open the official website manually. If the message was real, you will see the same notification after you log in. If it was fake, you just saved yourself from losing your money.

What To Do If You Think You Have Been Targeted

If you have already entered your card details into a suspicious page, do not panic. Act quickly but calmly.

Contact your bank or credit card issuer immediately using the phone number on the back of your card. Do not use any contact information from the suspicious message or website. Tell them your card details may have been compromised and request a new card.

Review your recent transactions for any unauthorized charges. Look for small test transactions as well as larger ones. Report any suspicious activity to your bank immediately.

Change your password for the marketplace platform. Use a strong, unique password that you do not use anywhere else. Enable two-factor authentication on your account if the platform offers it.

Monitor your account activity for the next several weeks. Some criminals wait before using stolen card details to avoid detection.

Finally, report the phishing attempt to the platform’s security team. Your report could help protect other users from falling victim to the same scam.

A Final Word From The Security Team

The criminals are constantly evolving their tactics. They change their domain names. They refine their fake pages. They find new ways to bypass security measures. But one thing never changes: they need you to take an action they have scripted for you.

Your best defense is not a piece of software or a security product. Your best defense is awareness. Every time you are about to enter your payment information into a website, pause. Ask yourself whether the request makes sense. Ask yourself whether a legitimate business would ever ask for the information you are about to provide.

If something feels wrong, trust that feeling. Close the page. Open the official website directly. Verify through official channels. The extra thirty seconds it takes to do this might be the thirty seconds that save your entire bank account.

This attack was detected, analyzed, and neutralized by the Antiphishing.biz security team during daily link moderation procedures. The dangerous destination URL has been fully defanged within their infrastructure. But new domains will appear tomorrow, and the week after, and the month after that. The information in this guide will protect you regardless of what domain name the criminals choose.

Stay safe. Stay skeptical. And remember – no legitimate website will ever ask you how much money you have before taking it.