The Basic Prosecution Office of Prishtina, in coordination with the Kosovo Police, has uncovered a massive SMS-based phishing (“smishing”) operation that has defrauded at least 150 citizens in the Prishtina region alone. Total financial damages are currently estimated at around €50,000, with authorities warning that both the number of victims and the total financial losses are expected to rise.
Following a swift law enforcement operation, authorities executed three search warrants across various locations. The raids resulted in the detention of two suspects on charges of fraud, while two other individuals allegedly involved in the scheme have been identified and remain at large.
How the Scam Worked
According to the joint official statement, the suspects operated in tandem since at least December 2025, sending fraudulent text messages tailored to mimic official notifications from major commercial banks operating in Kosovo, including NLB Bank, TEB Bank, and Raiffeisen Bank.
The phishing messages typically warned users of fraudulent activity to induce panic and force quick action:
“Suspicious activity has been detected on your account. Please log in to continue using the service…”
The text messages included a malicious hyperlink customized to match the victim’s specific banking institution. Once clicked, the link directed victims to a spoofed, lookalike website where they were prompted to input their sensitive online banking credentials. The fraudsters then used this data to access the accounts and drain the victims’ funds.
Seized Evidence and Ongoing Investigation
During the raids, police seized critical evidence linking the suspects to the cyber-fraud ring, including:
- A vehicle
- Multiple smartphones
- Numerous SIM cards
- Bank payment slips
Because the scam targeted widespread financial institutions, investigators believe the fraudulent messages reached citizens well beyond the capital. Law enforcement agencies are urging anyone who may have received similar messages or noticed unauthorized transactions to come forward and report them immediately as the investigation expands into other regions of Kosovo.
