Poytaxt Parking warned about fake SMS about «parking debts» in Tashkent

What the parking operator warned about

The operator of paid parking lots in Tashkent, Poytaxt Parking, warned about fake SMS messagesbeing sent in its name, Gazeta reports. The messages claim that the recipient has an unpaid parking debt, allegedly overdue by three days, and threaten to restrict the service if the «debt» is not paid. To «view the parking session details» and make the payment, recipients are asked to follow a link and enter the vehicle's state registration number. The link imitates the official website but is not it.

How the scammers operate and what the company advises

According to the company, the messages come from international numbers with the country codes of the Philippines (+63) and Morocco (+212); the use of other numbers is also possible. Poytaxt Parking stressed that it does not send such mailings. Recipients are advised to delete such SMS messages, not to follow the links, and not to enter bank card details or the vehicle number. If card details have already been entered, the bank must be contacted immediately and the card blocked. The parking payment status can be checked only in the Poytaxt Parking app; for clarifications, the company suggests calling 78 113 67 00 or using the support bot.

Against the backdrop of personal data leaks

The warning appeared shortly after reports of a leak: On October 28–29, databases containing citizens' personal data were discovered in Telegram bots in Uzbekistan — personal identification numbers (PINFL), passport details, residential addresses, phone numbers, vehicle information, and driver's licenses. The Cybersecurity Center at the Ministry of Internal Affairs' Department for Combating Cybercrime is conducting an inspection together with AUTODOC, the company servicing the Safe Service platform (formerly Safe Road); specialists are to establish the origin of the data and check the likelihood of leaks from these and other information systems. Safe Service itself denied reports of a data leak from its app.

Context of the January attacks

This is happening against the backdrop of earlier incidents: in February, Minister of Digital Technologies Sherzod Shermatov reported that after the January cyberattacks on the systems of three government agencies, about 60,000 unique personal records were leaked. At the time, the ministry warned that the stolen data could be used for fraudulent purposes — and that is apparently the scenario being played out in the current SMS mailing, although a direct link to the leaks was not confirmed in the publications.