Authorities across the GCC are warning residents about a growing fraud scheme in which criminals promise major discounts on bill payments, using compromised bank cards to complete transactions and leaving unsuspecting customers at risk of financial and legal consequences.
GCC Scam Warning: Criminals Offer Deep Discounts Using Stolen Bank Cards to Settle Bills.
GCC Residents Warned About Fraud Scheme Offering Huge Discounts on Government Bills
GCC Residents Warned of Fraud Scheme Offering Huge Discounts on Government Payments
Residents across the Gulf Cooperation Council (GCC) are being warned about a sophisticated fraud operation in which criminals use stolen bank card details to pay legitimate government fines and bills before collecting money from unsuspecting customers.
Cybersecurity company Group-IB uncovered the scheme, which allegedly allows fraudsters to turn stolen funds into seemingly legitimate payments by settling real traffic fines, utility bills and legal charges through official government platforms.
The criminals reportedly approach members of the public with offers that appear difficult to resist. They promise to clear a government payment for as little as 20 to 50 per cent of its original value, allowing customers to save between 50 and 80 per cent.
However, behind the apparent bargain is a much more serious operation.
Instead of using their own funds to settle the bill, fraudsters use compromised credit or debit card information to make the payment on an official portal. They then ask the customer to transfer the discounted amount to them, either through cryptocurrency or a local bank account.
The result is that the customer’s genuine government obligation is paid, while the criminal receives money from the customer in return.
According to Group-IB, the arrangement can be difficult for financial institutions to identify because the original payment is made to a legitimate government organisation for a genuine bill or fine.
Hundreds of cases identified across the Gulf
Group-IB’s Fraud Protection team identified approximately 300 incidents connected to the operation between October 2025 and August 2026.
The cases were detected across several major retail banks operating in GCC countries.
In a verified sample involving 80 compromised bank cards connected to three government institutions, the cybersecurity company calculated confirmed losses of approximately $2.01 million, equivalent to around Dh7.4 million.
The figures highlight how criminals can potentially exploit trusted digital services to disguise the movement of stolen money.
Rather than sending stolen funds directly to themselves, the fraudsters use them to pay legitimate obligations belonging to other people.
That additional layer can make the transactions appear less suspicious than a conventional transfer of stolen money.
How the discount scam works
The fraud begins with the criminals obtaining access to bank card information.
They then look for members of the public who have outstanding government payments, such as traffic penalties, utility charges or legal fees.
The criminals offer to settle those amounts at a substantial discount.
A customer who owes Dh1,000, for example, might be told that the payment can be cleared for only Dh200 to Dh500.
The customer transfers the agreed discounted amount to the fraudster.
The criminal then uses a stolen card to pay the full Dh1,000 to the government authority.
From the customer’s perspective, the bill has been successfully settled and the transaction has gone through an official government system.
But the money received by the fraudster from the customer effectively becomes the proceeds of the crime.
Why the transactions can appear legitimate
One of the most concerning elements of the operation is the way it takes advantage of genuine government payment systems.
The bill itself is real.
The government portal is genuine.
The payment is made to the correct institution.
And the person whose fine or charge is being paid may actually owe the money.
This combination can make the activity harder to detect through conventional fraud-monitoring systems.
Group-IB said financial institutions may not immediately identify the payment as suspicious because the stolen card is being used to complete a legitimate government transaction on behalf of a real customer.
The criminals are therefore not necessarily trying to make an obviously fraudulent payment.
Instead, they are attempting to make an unauthorised payment look normal by connecting it to a genuine obligation.
Security checks are being bypassed rather than broken
GCC banks commonly use 3D Secure, or 3DS, as an additional layer of protection for online card transactions.
Depending on the bank, customers may be asked to enter a one-time password or approve a payment through their banking application.
Group-IB said the fraudsters behind this operation are managing to complete those authentication steps.
In confirmed cases examined by the company, fraudulent payments successfully passed valid 3DS verification.
According to the investigation, criminals had already compromised victims’ phone numbers and banking accounts, allowing them to control the security notifications themselves.
As a result, a bank may see a transaction that has apparently been authenticated by the legitimate customer.
The problem is that the person approving the security request is actually the attacker.
The operation has several stages
Group-IB described the wider criminal operation as involving three interconnected stages.
The first stage focuses on stealing personal and financial information.
The second involves taking control of victims’ mobile and banking accounts.
The final stage uses stolen cards to generate money by paying legitimate bills and fines for other people.
Together, these steps allow criminals to obtain card information, defeat account security and ultimately convert stolen funds into money received from members of the public.
Fake websites used to collect information
According to Group-IB, the first stage involves a large network of fraudulent websites.
The company identified more than 400 fake websites using approximately 10 different disguise patterns.
These websites reportedly imitate government portals and insurance-related services.
The objective is to make visitors believe they are using an authentic online service.
Fraudsters reportedly promoted some of these websites through verified Google Search advertisements, targeting people in GCC countries.
The use of paid search advertising can make a fraudulent website appear more credible to an unsuspecting user.
Many people assume that a website appearing prominently in search results is trustworthy, but a sponsored result should not automatically be treated as an official government service.
Victims are asked to provide sensitive information
Once users visit the fraudulent websites, they may be asked to enter personal information and payment card details.
The information can then be used by criminals to gain further access to the victim’s accounts.
The investigation found that victims were also persuaded to approve security requests connected to fraudulent eSIM swaps.
An eSIM is a digital version of a traditional SIM card. If criminals successfully transfer a victim’s mobile number to a device they control, they may be able to receive one-time passwords and other security messages intended for the genuine account holder.
This can give attackers another route into banking and other online services.
Hijacked phone numbers help attackers access bank accounts
Once criminals gain control of a victim’s mobile number, they can attempt to take over online banking accounts.
Group-IB said attackers used hijacked eSIM numbers to intercept one-time passwords.
The investigation also found that criminals used techniques intended to make their actual location harder to identify, including GPS spoofing.
After obtaining access to banking accounts, attackers could reportedly increase transaction limits and approve security challenges required for online payments.
This makes the operation significantly more sophisticated than a simple stolen-card scam.
New devices were linked to account takeovers
Group-IB reported that around 90 per cent of the account takeovers it examined were associated with new iOS device fingerprints.
The company linked these devices to a cluster in Ramtha, Jordan.
A new device being used to access a banking account can normally be an important warning sign for financial institutions.
However, the criminals’ ability to combine several compromised elements — including phone numbers, banking accounts and authentication processes — can make detection more difficult.
Fraudsters recruit customers through Telegram
The final stage of the operation involves finding people who are willing to take advantage of the unusually large discounts.
Group-IB said specialised Telegram channels were used to recruit members of the public.
Potential customers were offered discounted assistance with payments such as traffic penalties, utility bills and legal charges.
For someone facing a large fine or bill, a promise to save half or even 80 per cent of the amount could appear attractive.
But accepting such an offer could mean becoming involved in the movement of illegally obtained funds, even if the customer does not realise where the money is coming from.
A cheap bill payment could carry serious consequences
Cybersecurity experts are warning residents not to assume that a discounted payment service is harmless simply because the final payment reaches a government authority.
The government may receive the correct amount, but the method used to make that payment could involve stolen financial information.
The person accepting the discount may also transfer money directly to a criminal.
This means the customer could potentially become part of a money-laundering operation without fully understanding what is happening.
The apparent financial benefit may therefore come with much greater risks.
UAE authorities have warned about changing online scams
The warning follows previous alerts from the UAE Cyber Security Council about the changing nature of digital fraud.
Authorities have highlighted how criminals increasingly exploit online platforms, digital government services, smart applications and connected networks to target members of the public.
Modern scams do not always involve obvious fake messages or suspicious-looking websites.
Instead, criminals can create convincing digital experiences that resemble legitimate services.
This makes it increasingly important for users to verify the source of a service before providing personal, financial or security information.
Cybersecurity requires cooperation
Dr Mohamed Hamad Al Kuwaiti, Head of Cybersecurity for the UAE Government, has previously stressed that cybersecurity cannot be handled by one organisation working alone.
The increasing complexity of online crime means government authorities, financial institutions, technology companies and international partners need to coordinate their efforts.
Fraud operations that cross national borders can involve infrastructure, victims, bank accounts and criminals in different jurisdictions.
Cooperation can therefore be important for identifying suspicious activity and stopping criminal networks.
How residents can avoid the scam
Group-IB is advising residents in the UAE and other GCC countries to be extremely cautious when they encounter unusually large discounts on government payments.
The simplest precaution is to use official government applications or websites when paying fines and other charges.
Residents should avoid accessing such services through unfamiliar links or advertisements.
The cybersecurity company specifically advised users to rely on official apps or websites saved in their browser bookmarks instead of assuming that the first sponsored search result is legitimate.
Sponsored search results are not automatically trustworthy
Fraudsters can use paid advertising to push fake websites higher in search results.
A website appearing at the top of a search page does not necessarily mean that it belongs to a government authority or another trusted organisation.
Users should verify the web address and, where possible, navigate to the service through the official government website or application.
Saving legitimate websites as bookmarks can also reduce the likelihood of accidentally visiting a fraudulent copy.
Be suspicious of unusually large discounts
Another warning sign is an offer that appears far cheaper than the official amount.
If someone claims they can pay a government fine or bill for 50, 60, 70 or even 80 per cent less, residents should stop and consider why such a discount is possible.
Government fines and official charges generally have established payment processes.
A private individual offering to settle such a payment for a fraction of its value should therefore be treated with caution.
Residents should not provide their card details, banking credentials, one-time passwords or other sensitive information to such individuals.
Never share banking security codes
One-time passwords and banking application approval requests are designed to protect accounts.
Users should never approve a transaction they did not initiate.
They should also avoid sharing security codes with people who claim they need them to process a payment or provide a discount.
If an unexpected authentication request appears, the safest approach is to reject it and contact the bank through an official channel.
Banks can strengthen their controls
Group-IB also outlined measures that financial institutions could adopt to make this type of fraud harder to carry out.
The company recommended treating certain account-recovery procedures that depend on card PINs and SMS-based authentication as high-risk.
It also suggested that banks could reassess high-value 3DS transactions involving government billers when those payments occur soon after suspicious account activity.
Examples include the registration of a new device, an eSIM change or an increase in transaction limits.
These events can provide additional context that may help identify suspicious behaviour even when a payment has successfully passed 3DS authentication.
Government portals can also introduce additional checks
The cybersecurity firm said government service operators have a role to play as well.
Government payment platforms could introduce additional risk controls designed to identify unusual patterns.
For example, unusually rapid repeated payments or very large settlements could trigger additional checks.
Such systems could help identify activity that differs significantly from normal customer behaviour.
The aim would not necessarily be to block legitimate payments but to identify transactions that warrant closer examination.
Better communication between institutions is needed
Group-IB also recommended creating dedicated communication channels between government service operators, banks and national cyber emergency response teams.
These channels could allow organisations to quickly report suspected fraudulent bill payments and share information about emerging threats.
Faster information-sharing could help financial institutions identify compromised cards and accounts sooner.
It could also assist authorities in identifying websites, communication channels and other infrastructure being used by fraud networks.
The scam relies on trust
Perhaps the most concerning aspect of the scheme is that it exploits the trust people place in official services.
A customer may see their fine disappear from a government system and assume everything is legitimate.
They may never realise that the payment was made using a stolen bank card.
This is what makes the scheme different from many conventional scams, where victims are directly asked to send money to a fake organisation.
Here, the government service itself can appear completely genuine.
The deception happens behind the scenes.
Why the offer can seem convincing
A large discount creates a powerful incentive for potential victims.
Someone facing an expensive traffic fine or other government charge may see an offer to save 50 to 80 per cent as an opportunity to reduce their financial burden.
The criminal may even provide reassurance by demonstrating that previous payments have apparently been completed successfully.
Once the customer sees the official bill marked as paid, they may have little reason to suspect that the transaction involved stolen funds.
However, the unusually low price should itself be treated as a major warning sign.
Criminals are exploiting legitimate digital infrastructure
The investigation illustrates how criminals can exploit legitimate digital systems without necessarily attacking those systems directly.
Government portals may be functioning normally.
Banks may correctly process authenticated transactions.
Customers may receive the service they expected.
The criminal activity happens through the misuse of legitimate services and compromised accounts.
This creates a complex challenge for banks, governments and cybersecurity teams.
The importance of digital awareness
As more government services move online, residents are increasingly required to manage payments, fines and other official transactions digitally.
Convenience also creates opportunities for criminals.
Users therefore need to develop habits that make it harder for fraudsters to exploit them.
Checking the source of a website, avoiding unsolicited offers, protecting mobile accounts and refusing unexpected banking approvals are all important precautions.
Residents should use official payment channels
The safest way to settle a government fine or bill is to use the official payment channel provided by the relevant authority.
If someone offers to make the payment on a resident’s behalf for an unusually low amount, the resident should verify the offer independently before proceeding.
They should not rely solely on a link, phone number or website supplied by the person making the offer.
Instead, they should contact the relevant government department using independently verified contact details.
What to do if you suspect fraud
Anyone who believes their bank card, mobile number or online banking account may have been compromised should contact their financial institution immediately.
The affected person should also avoid approving further authentication requests and should follow the bank’s instructions for securing the account.
If personal information was submitted to a suspicious website, the individual should inform the relevant financial institution and consider changing affected credentials where appropriate.
Reporting suspected scams can also help authorities and financial institutions identify wider fraud patterns.
A wider warning for GCC residents
The investigation serves as a reminder that fraud can take many forms.
Criminals are no longer relying solely on traditional fake investment schemes, phishing messages or fraudulent shopping websites.
They are also exploiting genuine government services and legitimate financial transactions.
The combination of stolen cards, compromised phone numbers, hijacked banking accounts and fake websites creates a sophisticated chain that can be difficult for ordinary users to recognise.
The key warning
A government fine or bill being successfully cleared does not automatically mean the person who offered to pay it used legitimate funds.
An offer promising an enormous discount should be treated with suspicion, particularly when the customer is asked to transfer money to an unknown individual through cryptocurrency or a personal bank account.
The potential saving may be small compared with the financial and legal risks associated with participating in a fraudulent transaction.
What residents should remember
The safest approach is straightforward:
- Use official government apps and websites to pay fines and bills.
- Avoid clicking on sponsored search advertisements unless the destination has been independently verified.
- Be suspicious of anyone promising a 50–80 per cent discount on an official payment.
- Never share one-time passwords, banking PINs or approval requests with another person.
- Reject unexpected authentication requests.
- Contact your bank immediately if you suspect your account, card or mobile number has been compromised.
- Verify payment offers independently through official government channels.
- Report suspected fraud so authorities and financial institutions can investigate.
The Group-IB findings underline how a seemingly attractive discount can conceal a much larger criminal operation. For GCC residents, the safest choice is to make government payments directly through verified channels rather than accepting unofficial offers that promise unusually large savings.
