Last month, a scam attempt that started with an SMS to my own mother saying "You have a message from e-Government" once again demonstrated how widespread and targeted these types of attacks have become. Such scams are usually designed to steal bank account information, personal data, or e-Government passwords, and have shown a significant increase in Turkey in recent years. Especially SMS and e-Government impersonation tactics target a wide range of users, from those without technical knowledge to corporate employees with busy schedules.
In this post, I will explain, based on my field experience, why SMS and e-Government scams are so prevalent in Turkey, what techniques attackers use, and how we can protect ourselves against them, both individually and corporately. Understanding the social engineering and technical vulnerabilities behind these scams is vital to protecting ourselves and our surroundings.
Why Are SMS Scams So Prevalent?
SMS scams are quite common in Turkey because they are a low-cost and high-impact method for attackers. These attacks typically aim to make users unknowingly click on malicious links by targeting their immediate panic or curiosity. Attackers use techniques like SMS spoofing to make messages appear as if they are coming from a "official" source.
For example, when I was working on supply chain integrations for our company during my time in a manufacturing ERP, I saw similar "cargo delayed" or "you have an invoice debt" themed SMS messages being sent even to our own company employees. This situation can create a potential insider threat by targeting not only end-users but also personnel within the corporate network. The brevity and directness of the messages increase users' tendency to act quickly.
ℹ️ What is SMS Spoofing?
SMS spoofing is the alteration of the sender's phone number or name to make it appear as if the message is coming from another source. This allows scammers to mislead users by sending messages with trusted institutional names like "e-Government", "PTT", or "Your Bank".
How is e-Government Impersonation Possible?
Impersonating critical platforms like e-Government is one of scammers' favorite tactics because e-Government is a platform almost every citizen of the Republic of Turkey uses and trusts. Two main techniques are generally used in such attacks: SMS spoofing and phishing sites. With SMS spoofing, the message appears to genuinely come from e-Government.
These messages then direct the user to a fake copy of e-Government. These fake sites are designed to look almost identical to the real e-Government interface, aiming to steal users' login credentials. While analyzing the security of one of my side products, I examined similar phishing sites and saw that attackers often register domains very similar to e-devlet.com.tr or turkiye.gov.tr, such as e-devletim.org or turkiye-gov.net, using domain squatting or typo-squatting techniques. When DNS records are examined, it becomes clear that these sites have no connection to the real e-Government servers.
What Techniques Are Used in Phishing Attacks?
Phishing attacks use various psychological and technical tricks to deceive users. One of the most common techniques I've encountered in these attacks is URL manipulation and the use of link shorteners. Scammers use services like bit.ly or tinyurl.com to hide or complicate real URLs, making it difficult for the user to understand where the link leads.
Additionally, fake login pages are designed to look identical to e-Government or bank login screens. These pages, after critical information like username and password is entered, usually display an error message or redirect the user to the real site, so the victim doesn't realize what happened. While testing a spam blocker application I developed for mobile, I personally saw how skillfully these fake sites were prepared and how difficult it was for an ordinary user to distinguish them from the real ones. Even on platforms using modern authentication patterns like JWT or OAuth2, users not carefully following the authentication flow can allow scammers to intervene.
# Example of a malicious URL structure
# Although it looks like turkiye.gov.tr, it goes to a different place when clicked
# It is important to be careful with such links.
# Example of a malicious link (do not click!)
phishing_link = "https://turkiye.gov.tr.guvenlik-kontrol.xyz/giris?token=12345"
# Another example, hidden with URL encoding
encoded_link = "https://www.example.com/redirect?url=https%3A%2F%2Fedevlet-giris.dolandirici.net%2Flogin"
print(f"Link in the received message: {phishing_link}")
print(f"Link using URL encoding: {encoded_link}")
How Can We Protect Ourselves Individually from Such Attacks?
Protecting ourselves individually against these types of scams requires a basic level of attention and some habit changes. First and foremost, approaching every incoming SMS or email with suspicion is the most important line of defense. If a bank, a cargo company, or e-Government sends you a link via SMS, instead of clicking on it directly, you should go to the official website or mobile application of the relevant institution to check the situation.
As I always emphasize in my own system administration, the principle of "verify, don't trust" applies here too. Especially when it comes to e-Government, using the mobile application is a much safer method. Performing transactions through the application eliminates the risk of being redirected to fake sites. Additionally, using two-factor authentication (2FA) for all your critical accounts makes it harder for your account to be compromised even if your password is stolen. Not sharing your phone number on public platforms as much as possible can also reduce targeted SMS attacks.
⚠️ Critical Warning: Never Enter Your Information Directly
If a page that opens after you click on a suspicious link asks for your TR ID number, password, bank card details, or OTP (one-time password), never enter this information. Always confirm the transaction using official channels.
What Measures Should Be Taken at the Corporate Level?
Protecting against SMS and e-Government scams at the corporate level requires a more comprehensive strategy than individual measures. The most critical point I've observed in my own operations and in companies I consult for is increasing employee awareness. Regular security training and simulations (phishing tests) enable personnel to recognize such attacks and respond appropriately. While designing the security architecture for a bank's internal platform, I once again realized that cybersecurity training for employees is as important as the most advanced technical security controls.
Technically, properly configuring email gateways with protocols like DMARC, SPF, and DKIM largely prevents email-based phishing attacks. Furthermore, implementing a Zero Trust Network Access (ZTNA) architecture within the organization and performing network segmentation restricts an attacker's lateral movement within the network even if a user's credentials are compromised. DNS filtering and web application firewall (WAF) solutions can also block access to malicious sites. In my own backend services, I reduce the impact of such attacks by implementing strict rate limiting and Web Application Firewall rules on Nginx reverse proxy.
What Will Be the Future Threats and Defense Strategies?
Cyber fraud methods are constantly evolving with technological advancements, and more sophisticated attacks await us in the future. Especially artificial intelligence (AI) is becoming a powerful tool in the hands of scammers. AI can be used to create more convincing and error-free phishing emails or SMS messages. Advanced language models can generate personalized content, making it easier to trap victims.
Additionally, voice or video scams using deepfake technologies may also increase, making attacks that impersonate executives or family members more dangerous. While working on my own AI application architectures, I also consider the potential misuse of techniques like RAG (Retrieval-Augmented Generation); it may become possible for AI to generate personalized and highly convincing scam scenarios with existing data. Our defense strategies against these threats must also be adaptive. Proactive threat intelligence, anomaly-based monitoring systems, and AI-powered security solutions will be critical for detecting and preventing these next-generation attacks.
Conclusion
SMS and e-Government scams in Turkey pose a serious threat to both individuals and corporations, and these threats are becoming more complex with technological advancements. Understanding the social engineering and technical vulnerabilities underlying these scams is the first step in our protection strategies. Simple but effective steps like skepticism, using 2FA for critical accounts, and confirming official channels can make a big difference at the individual level.
In the corporate sphere, employee training, strong email and SMS security gateways, ZTNA, and continuous security audits are indispensable. Considering that we will face AI-powered attacks in the future, we must constantly update our security approaches and develop proactive solutions. Let's not forget that cybersecurity is not just a matter of technology, but also a matter of people and processes; the strongest defense comes from conscious and educated users.
Top comments (0)