The crime scheme is simple. An email arrives suggesting that a PGE customer has a refund for overpaid invoices. The amount that appears in such messages may vary, but it remains enticing for those who must pay high energy bills. Here you must be alert for the first time, but not the last. These messages even reach people who are not PGE customers, and in the flood of invoices and options to recover part of the money, one can easily become a target for criminals.
Almost 300 PLN refund
One of the situations described online involves people who received information about a refund of 285.44 PLN, of which 279.29 PLN was supposed to be the refund amount and 6.15 PLN was interest. All calculations were presented in the email graphically, to further capture attention and build trust in the sender. The button is usually below the amount, and by clicking it the client must confirm their details to receive the refund. In return, the person who does so is redirected to a website with a form to fill out, where scammers ask for all data to supposedly confirm the identity of the person who should receive the refund. The refund is to be made within 2-3 business days. This is obviously an attempt to steal data and then money from a potential victim, so vigilance regarding everything we receive in email or phone must be very high.
In the case of alleged PGE emails, you should pay attention to the sending addresses. In this specific case the address looked like: [email protected], which should already raise suspicion. Of course scammers want to lull their victims’ attention, so for the unfamiliar below they included information suggesting that the mail actually comes from PGE, such as: Customer Service Department, PGE Polska Grupa Energetyczna or contact email: [email protected], which in any case someone expecting a refund would probably not want to use.
PGE urges vigilance
The information that PGE is being used for crime reached the state company, which warns against such messages.
“Cybercriminals send fake emails about alleged tariff changes (including G12) and overpayment refunds. They cite government institutions (including ministries) and use case numbers and legal bases to legitimize the message” – the company warns.
The company clearly states that it always contacts its clients from one address, which for invoices sounds exactly like: [email protected]. The invoices themselves also always look the same. They feature the company logo, client number, invoice number, payment deadline, and amount due.
This is a phishing campaign – PGE warns, adding that similar actions are also carried out using the image of other state companies and institutions.
“Please remain vigilant. If you suspect fraud, you can report it at incydent.cert.pl” – PGE emphasizes in its press release.
See also: There was already a scam involving a grandchild and BLIK. Now criminals are trying to impersonate DPD
