Sophisticated Fraud Scheme Exploits Government Payment Gateways Using Stolen Credit Cards in GCC Region

How the Fraud Scheme Works

Three-Stage Operation

This sophisticated fraud scheme operates in the following three stages:

Stage 1: Phishing and Data Theft

• Criminals use legitimate Google search advertisements to direct victims to fake government websites
• Over 400 phishing sites mimicking government portals and insurance services were identified
• Victims enter personal information and credit card numbers
• Fraudsters trick victims into authorizing fraudulent eSIM (digital SIM) exchanges
• This stage harvests all data needed for the next phase

Stage 2: Bank Account Takeover

• By controlling the eSIM, attackers intercept one-time passwords (OTP) meant for the account owner
• Fraudsters gain access to online banking services
• They raise transaction limits without authorization
• They approve 3D authentication challenges within the bank's mobile app
• Investigation data showed that 90% of compromised accounts had new iOS device fingerprints originating from a geographically concentrated group in Al-Ramtha, Jordan

Stage 3: Money Laundering ("CIVIC DRAIN")

• Criminal groups use dedicated Telegram channels to recruit "customers"
• They offer discounts of 50-80% to pay legitimate government fines and utility bills
• Using stolen card data, fraudsters pay the full bill amount through official government payment gateways
• They collect the discounted amount from victims via cryptocurrency or local bank transfers
• This creates a money flow mixing stolen funds with legitimate payments from participating civilians

Why Detection is Difficult

Bypassing Security Authentication

GCC banks enforce 3D Secure (3DS) authentication, requiring cardholders to verify transactions. However, fraudsters don't bypass this protection—they fulfill it correctly. Since they control the victim's phone number and bank account, they simply approve the authentication requests themselves.

Exploiting Government Payment Gateways

Using legitimate government gateways is the scheme's genius:

• Payments go to verified government entities
• Transactions are connected to real citizens with actual financial obligations
• Security checks are passed legitimately
• Traditional banking monitoring systems classify these as legitimate government payments unlikely to be fraudulent

The Gap Between Security Systems

The scheme exploits fragmentation in detection capabilities:

• Banks see valid government payments
• Simultaneously, mobile carriers may detect fraudulent SIM swaps
• Device monitoring may detect logins from new devices
• Payment gateway monitors may flag unusual patterns
• When these signals aren't connected, fraud remains undetected

How to Protect Yourself

Safe Payment Practices

1. Use Official Channels Only

   • Access government services only through official apps or saved bookmarks
   • Never click on search results or paid advertisements to reach government services
   • Verify the URL directly with official government sources

2. Be Wary of Large Discounts

   • Offers to pay government bills at 50-80% discounts are red flags
   • Never use intermediaries to pay government obligations
   • Legitimate government services don't offer discounts through unofficial channels

3. Protect Your Mobile Access

   • Be alert to unexpected eSIM exchange requests (losing control of your phone number)
   • Never share authentication codes with anyone claiming to help with payments
   • Verify any unusual mobile activity directly with your carrier

4. Monitor Your Accounts

   • Review notifications for new device logins
   • Check alerts for transaction limit changes
   • Immediately contact your bank about unrecognized account changes
   • Enable all available authentication notifications

Where to Report Suspected Fraud

• Your bank's fraud department: Report suspicious transactions immediately
• Mobile carrier: Report unauthorized SIM swap attempts
• National cybersecurity agency: Report the fraud scheme
• Local law enforcement: File a fraud report and provide evidence
• Financial regulator: Report institutional security failures

Recommendations for Financial Institutions

Group-IB advises banks to:

1. Identify High-Risk Patterns

   • Flag account recoveries using card PIN and SMS OTP
   • Treat new device registrations followed by large government payments as suspicious
   • Monitor for eSIM changes preceding high-value transactions
   • Require additional verification when multiple risk indicators appear

2. Implement Cross-Channel Monitoring

   • Integrate data from web, mobile, and financial channels
   • Develop capability to detect patterns spanning multiple fraud stages
   • Share suspicious indicators across internal systems in real time

3. Coordinate with Government Agencies

   • Establish direct communication channels between payment gateway operators and fraud response teams
   • Create rapid alert systems for suspected fraudulent payments
   • Share indicator data to connect digital threats with financial crimes

The Broader Threat

As government and financial services increasingly digitize across the GCC region, security becomes more critical. Modern cybercriminals are evolving to execute complex multi-stage fraud that can't be detected by monitoring single systems or channels. Legitimate government payment infrastructure—meant to serve citizens—has become a tool for money laundering. The scheme demonstrates that even strong individual security measures (like 3D authentication) fail when attackers have comprehensive access to multiple systems. Defending against this threat requires unprecedented coordination between banks, mobile carriers, government agencies, and cybersecurity teams.