The Financial Monitoring Agency a Group Sending Phishing SMS Messages Posing as Banks and Mobile Operators

The Financial Monitoring Agency of the Republic of Kazakhstan (the FMA), in coordination with the General Prosecutor’s Office and with the participation of cybersecurity specialists from the mobile operator «ТELE2», has disrupted activities of a criminal group that carried out mass mailing of phishing messages using specialized equipment to subsequently steal confidential data and citizens’ funds.

The perpetrators used a special device — a so-called SMS blaster — that imitates the operation of cellular base stations. It generated a strong signal near users (within a radius of up to 300 meters), causing mobile phones to automatically connect to it and switch to a less secure network.

As a result, subscribers instantly received fake SMS messages. This device allowed the criminals to bypass telecom operators’ protections and send up to 100,000 messages per hour.

To expand their reach and maintain secrecy, the equipment was installed in vehicles and used while in motion, mainly in crowded areas such as markets and near shopping and entertainment centers.

The messages were sent under the guise of companies «Beeline» and «Halyk Bank», offering to redeem accumulated bonuses. Following the link led users to phishing websites where they were prompted to select goods, after which personal data was requested, including phone number, full name, bank card details, CVV code, and SMS confirmation codes.

In this way, the perpetrators gained access to citizens’ confidential information and their bank funds.

Thanks to the FMA’s timely operational and investigative actions, the group was identified and detained at an early stage of the scheme’s implementation, preventing large-scale fraud and significant financial losses for citizens.

Currently, four suspects have been detained and placed in custody.

The investigation is ongoing.

Press Service of the Financial Monitoring Agency