← Back to the guide
Fake SMS messages (courier, parcel, fines, Ghișeul.ro)
How it works
- You get an SMS: “Your parcel is held, pay 2.5 lei customs fee” + a link
- Or: “You have an overdue fine on Ghișeul.ro, pay within 48h or it doubles” + a link
- The link leads to a cloned page that steals your card details
Warning signs
- A shortened link or a strange domain (e.g. ghiseul-plata.xyz, fan-courier.top instead of the official site)
- Small amounts requested (2–5 lei): the real aim is stealing your card data, not the sum
- Aggressive deadlines: “48-hour grace period”, “extra penalty of 3,000 RON”
- Strange instructions: “reply with 1 and reopen the message”
- Language mistakes, missing diacritics, robotic wording
What to do
- Do not open the link. At all.
- Check directly on the official website (typed by you in the browser) or in the courier's official app.
- Did you order nothing? Then you certainly have no parcel. Delete the message, but take a screenshot first, for reporting.