Scams that mimic banks or the Police are increasing rapidly around the world and inevitably in Cyprus as well. Indicatively, in 2025 alone, complaints of online fraud reached 921. The article below explains how the most common scam scenarios work and what the recent record theft on Binance shows for the human factor. Finally, it is mentioned what are the practical steps of prevention and response.
Because it concerns us today
On October 30, 2026, the Police announced a new case of online fraud in Paphos. An accounting office employee received an email that looked like it had been sent from a bank. The message asked her to "update" her personal information (Cyprus Mail, 2026). Unsuspecting, she followed the steps of the message and entered her details.
A little later, she found that €6.000 had been deducted from her bank account. He immediately reported the incident and the Police are investigating the case (Tachydromos, 2026). On the occasion of the incident, the Police reiterated the recommendation not to open links and not to register personal information through such messages (Cyprus Mail, 2026).
The case is instructive for two reasons. First, the victim became a man who works daily with financial data and bank messages. Second, no specialized technical knowledge was needed for the "burglary". A plausible message and a little trust were enough.
This case is not isolated. According to the Cyprus Police, in 2025, 921 cases of online fraud were reported, with losses of over €10.3 million (Typos, 2026). The Central Bank recorded about 14,000 incidents of payment fraud in the second half of 2025 alone, worth €3.7 million. In credit transfers, Cyprus also had the highest average value of a "fraudulent" transaction in the euro area (InBusinessNews, 2026).
A few hours earlier than the news in Paphos, a news of global scale had arrived. On October 29, Binance, the world's largest cryptocurrency platform, lost about $6.3 billion worth of digital assets. dollars. It is the largest cryptocurrency theft on record (TRM Labs, 2026). The two incidents differ greatly in scale, but they have a common starting point, a man who was deceived and violated.
The image was created using AI
The scenarios that now exist in Cyprus
Scammers no longer go through the process of cracking passwords. They persuade the victim to give them to himself. The technique is called social engineering. It is the exploitation of our trust, fear or haste. The most common scenarios of the last few months are the five that follow.
The "Bank" that requests an update of data
An email or SMS with a bank logo notifies that the account will be "frozen" if no confirmation is made. The link leads to an exact copy of the website. This is what happened in the Paphos case. The Police had issued a relevant warning as early as June (Sigmalive English, 2026).
The "policeman" on the phone
Someone presents himself as a police officer and asks for payment of a non-existent fine with a card. In a recent case in Paphos, a 37-year-old woman lost €784 in this way. On her screen, no number appeared, but a fake ID. The Police emphasize that they never ask for payment or bank details over the phone (Sigmalive English, n.d.).
The "out-of-court" via SMS
The Police have recorded an outbreak of messages that it allegedly sends itself. These messages contain a link to the payment of an out-of-court fine. The goal is to steal the card details in this way (Famagusta Gazette, 2026). The rush of "pay today to avoid court" is the bait.
The "Cypriot" number that is ultimately not Cypriot
Perpetrators can falsify the call number. The technique is called caller ID spoofing and can be done by anyone at a relatively low cost either by purchasing or subscribing to apps that do so. Thus, a call from abroad appears as Cypriot. That is why the authorities recommend that we do not trust a number just because it seems familiar to us (Dialogue, n.d.).
How easily this is done was shown three years ago by ethical hacker Rachel Tobac, in a show for CBS's 60 Minutes. From excerpts from television appearances, he made with artificial intelligence a clone of the voice of a journalist of the show. She then called a colleague, with a falsified caller ID to make it look like the journalist herself was calling. The associate did not understand anything suspicious and read the passport number that was asked of her. Voice cloning took about five minutes (CBS News, 2023).
What do all of the above have in common. All four combine an institution, individual, body, organization that we trust with an urgent deadline. The result is that in such cases we are likely to act before we think. In Europe, phishing was the "entry point" in 60% of the attacks analyzed by ENISA. By early 2025, over 80% of global social engineering activity leveraged AI (ENISA, 2025). For this reason, for example, spelling mistakes are no longer a reliable sign.
The "parcel" waiting for delivery
An SMS informs you that a package of yours is being held in the warehouse or has not been delivered. To pick it up, you need to pay a small amount via a link, such as a "customs fee" of €2.39 (Cyprus Mail, 2023). The small amount is the bait. The real target is the card details.
Cyprus Post emphasizes that it never asks for bank account or card details by email or SMS (Cyprus Post, n.d.a). But there is a detail, they also send genuine messages with a link to the parcel delivery option (Cyprus Post, n.d.b). That's why the safe way is to check the shipment by writing cypruspost.post address yourself, and not through the message. And first of all, ask yourself if you are really expecting a shipment (Cyprus Mail, 2022).
On the night of October 29, the attacker was carrying about 6,36 billion. from the platform's cryptocurrency wallets to ten blockchains. Most were gone in about 20 minutes (TRM Labs, 2026). The company's initial investigation points to an engineer's compromised laptop as an entry point (Axios, 2026; Nation, 2026). About 3 billion. have been committed. The management pledged to cover all user losses (The Block, 2026).
Residents of Cyprus with an account on the platform saw deposits and withdrawals suspended and prices fall. Funds on cryptocurrency platforms do not have the guarantee of a bank deposit (NBC News, 2026).
Also, a wave of "second fraud" for major incidents in the news is the ideal bait. The platform itself has repeatedly warned of fake "support" in SMS, email, and messaging apps, with the last one being September 2026 (ThreatCluster, 2026). All users and Twitter users are justified in expecting "confirm your account after the incident" or "recover your funds" type messages.
This, the same lesson, is for every organization, because if a colossus with advanced shielding was hacked through a laptop, no one is automatically safe. The accounting clerk in Paphos and the Binance engineer found themselves, on a completely different scale, in the same position that they are on the front line of defense.
How we protect ourselves
The Police, the Digital Security Authority (DSA) and the Association of Banks are working together in the ASPIS (INFORMATION SECURITY and INFORMATION SECURITY) campaign on electronic fraud (ACB, n.d.). Their instructions are summarized in a few simple rules.
Before you reply
-No bank or government agency asks for passwords or bank details by email, SMS or phone (Typos, 2026).
-Haste is a danger signal. If you see, for example, phrases, "In 24 hours", "otherwise you will be arrested", "last notice" or similar phraseology, stop and think again.
-Do not click on a link, but openthe application or website of the bank or service yourself. If it is thought that you have a suspicious link in front of you, the free CheckMyLink tool of APSA checks whether it is safe and allows reporting of malicious pages (APSA/CSIRT-CY, n.d.).
-Hang up the call and call back yourself. If someone says they are from the bank or the Police, call the official number of the institution. Do not use a number that he gave you.
-Enable two-factor authentication (2FA – Two Factor Authentication) and use a different code on each account (Typos, 2026).
-Haste is a danger signal. If you see, for example, phrases, "In 24 hours", "otherwise you will be arrested", "last notice" or similar phraseology, stop and think again.
-Do not click on a link, but openthe application or website of the bank or service yourself. If it is thought that you have a suspicious link in front of you, the free CheckMyLink tool of APSA checks whether it is safe and allows reporting of malicious pages (APSA/CSIRT-CY, n.d.).
-Hang up the call and call back yourself. If someone says they are from the bank or the Police, call the official number of the institution. Do not use a number that he gave you.
-Enable two-factor authentication (2FA – Two Factor Authentication) and use a different code on each account (Typos, 2026).
For small businesses
-Set a rule that no bank details change or payment is made by email alone. Confirmation from a second channel, such as the bank's official website, telephone line and application, should also be needed.
-Do short and frequent periodic phishing identification exercises on both employees and executives. ENISA considers them essential for SMEs (Digital SME Alliance, 2025).
-Don't connect personal apps and service accounts to the same device where possible.
-If you have already provided informationCall your bank immediately and ask them to block your card or account. The first few hours are very important.
-Report it to the Police. Keep the dial-in number, time, messages, and links (Dialog, n.d.).
-Change passwords on any accounts that used the same code. Use a different password for each account, across all your accounts using a password manager app.
-Beware of those who advertise themselves as "recovery specialists". Reject those who promise to return the money for a fee. It is usually the second act of the same fraud.
-Do short and frequent periodic phishing identification exercises on both employees and executives. ENISA considers them essential for SMEs (Digital SME Alliance, 2025).
-Don't connect personal apps and service accounts to the same device where possible.
-If you have already provided informationCall your bank immediately and ask them to block your card or account. The first few hours are very important.
-Report it to the Police. Keep the dial-in number, time, messages, and links (Dialog, n.d.).
-Change passwords on any accounts that used the same code. Use a different password for each account, across all your accounts using a password manager app.
-Beware of those who advertise themselves as "recovery specialists". Reject those who promise to return the money for a fee. It is usually the second act of the same fraud.
Conclusions
If there is one thing we keep from all the cases analyzed, it is that fraudsters do not need to overcome the security systems of banks, organizations and SMEs. It is enough to convince a person. This is shown by the €784 stolen from the fake call, the €6,000 stolen from a fake email up to Binance's billions. The most effective defense is the habit ofstopping, controlling from another channel, and then acting even under the pressure of time.
Questions for thought:
-If tomorrow you receive an SMS for a non-existent fine, do you know where you will officially check it?
-Do your parents and grandparents know that the number on the screen can be fake?
-In your job, a single compromised device would be enough to make a payment to the wrong account?
For more detailed information and incident reporting, visit the website of the National Cyber Security Community (ncc.cy), call the helpline at 1447, use the CheckMyLink tool of APSA and contact the Cybercrime Sub-Directorate of the Police for incident reporting.
-Do your parents and grandparents know that the number on the screen can be fake?
-In your job, a single compromised device would be enough to make a payment to the wrong account?
For more detailed information and incident reporting, visit the website of the National Cyber Security Community (ncc.cy), call the helpline at 1447, use the CheckMyLink tool of APSA and contact the Cybercrime Sub-Directorate of the Police for incident reporting.
SourcesACB (n.d.) Joint information campaign by the Digital Security Authority, the Central Bank, the Cyprus Police and the Association of Banks on online fraud. Available: https://acb.com.cy/koini-enimerotiki-ekstrateia-apo-tin-arxi-psifiakis-asfaleias-tin-kentriki-trapeza-tin-astunomia-kuprou-kai-ton-sundesmo-trapezon-gia-tis-ilektronikes-apates/
Axios (2026) Binance halts trading after biggest-ever crypto hack, Oct 29. Available: https://www.axios.com/2026/10/29/binance-cyberattack-crypto-heist
CBS News (2023) Ethical hacker scams 60 Minutes staffer to show how easy digital theft is, May 21. Available: https://cbsnews.com/news/how-digital-theft-targets-people-from-millennials-to-seniors-60-minutes-2023-05-21
Cyprus Mail (2022) Scam warnings issued by tax department and postal service, 21 January. Available: https://cyprus-mail.com/2022/01/21/scam-warnings-issued-by-tax-department-and-postal-service
Cyprus Mail (2023) Postal service warns of new SMS scam, August 21. Available: https://cyprus-mail.com/2023/08/21/postal-service-warns-of-new-sms-scam
Cyprus Mail (2026) Accountant's employee loses €6,000 in online scam, October 30. Available: https://cyprus-mail.com/2026/10/30/accountants-employee-loses-e6000-in-online-scam
Cyprus Post (n.d.a) Scam Facebook posts. Available: https://www.cypruspost.post/en/news/ facebook-scam
Cyprus Post (n.d.b) Spam Alert. Available: https://www.cypruspost.post/en/news/spam-alert
Digital SME Alliance (2025) ENISA Cybersecurity Threat Landscape Report 2025: Key takeaways for SMEs. Available: https://www.digitalsme.eu/?p=148145
ENISA (2025) ENISA Threat Landscape 2025. Athens: EU Agency for Cybersecurity. Summary available: https://www.infosecurity-magazine.com/news/phishing-dominates-euwide/
Famagusta Gazette (2026) Cyprus police warn of surge in phishing texts impersonating force. Available: https://famagusta-gazette.com/cyprus-police-warn-of-surge-in-phishing-texts-impersonating-force/
FX News Group (2023) CySEC deletes Binance Cyprus from Register of Crypto Asset Service Providers. Available: https://fxnewsgroup.com/forex-news/cryptocurrency/cysec-deletes-binance-cyprus-from-register-of-crypto-asset-service-providers/
InBusinessNews (2026) At €3.7 million. The value of payment fraud incidents in the second half of 2025. Available: https://inbusinessnews.reporter.com.cy/article/473928/sta-3-7-ekat-i-axia-ton-peristatikon-apatis-stis-pliromes-to-b-examino-toy-2025-diadiktyakes-oi-perissoteres-apates-me-kartes
NBC News (2026) Binance targeted in $6.3 billion crypto heist, the largest ever, October 29. Available: https://www.nbcnews.com/business/markets/binance-hack-tether-circle-stablecoins-rcna606445
Sigmalive English (2026) Police alert over fake bank emails, June 26. Available: https://en.sigmalive.com/police-alert-over-fake-bank-emails/
Sigmalive English (n.d.) Cyprus police phone scam costs woman €784. Available: https://en.sigmalive.com/new-cyprus-police-phone-scam-cost-woman-e784/
The Block (2026) Bitcoin slides below $77,000, BNB drops amid Binance hack, Oct. 29. Available: https://www.theblock.co/news/markets/2026-10-29-bitcoin-slides-below-77000-binance-hack-432183
ThreatCluster (2026) Binance Warns Users of Increased Phishing Text Scams, September 3rd. Available: https://threatcluster.io/cluster/binance-warns-users-of-increased-phishing-text-scams-0c87a380
TRM Labs (2026) North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History. Available: https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history
Typos (2026) Over €10.3 million in online fraud losses in 2025, July 27. Available: https://typos.com.cy/koinonia/pano-apo-e103-ek-apoleies-apo-diadiktyakes-apates-to-2025/
APSA/CSIRT-CY (n.d.) CheckMyLink: Check a website if it is a scam. Available: https://twitter.com/NationalCsirtCy/status/1863131417967735227
Dialogue (n.d.) Beware of unknown calls: Do not pick up the phone. Available: https://dialogos.com.cy/prosochi-stis-agnostes-kliseis-min-sikosete-to-tilefono-prokeitai-gia-apati
Nation (2026) Historic hit on Binance: Mammoth $6.3 billion cyberattack, October 30. Available: https://www.ethnos.gr/World/article/426420/istorikoxtyphmasthbinancekybernoepitheshmamoyth63disdolarionsygklonizeithnagorakryptonomismaton
Tachydromos (2026) "Clicked" on an email to update data and lost €6.000, a new electronic fraud in Paphos, October 30. Available: https://www.taxidromos24.com/2026/10/30/ click-on-email-to-update-on/
