Fake SMS from GLS: we walked the scam site to the end and this is what it does with your data

This afternoon an SMS in the name of GLS arrived on one of our numbers: delivery has supposedly been suspended because the order is missing a house number. The link leads to gls-balik.us.cc. It is a scam, and a more dangerous one than it looks. We walked that site all the way to the end with made-up data and we will show you exactly what it does.

What the message looks like

The text is short: “Delivery has been suspended because your order is missing a house number. Please update it as soon as possible.” plus a link. No shipment number, no shop, no name. But it has exactly what works on people: a parcel on the way and a small detail to fix quickly.

Why it looks so believable

This message has three things ordinary phishing does not.

It landed among genuine messages. The thread holds older real GLS messages, including a PIN for parcel pickup and a verification code for the app. The scammer spoofed the alphanumeric sender ID, the sender name shown instead of a number. Phones group messages by that name, so the fake message slots in with the real ones. The sender of an SMS proves nothing.

It has a valid certificate and a padlock. The site runs on HTTPS with a Let’s Encrypt certificate. The padlock in the browser only means the connection is encrypted, not that the site is trustworthy. The certificate for this domain was issued the same morning, a few hours before the messages went out.

It is an exact copy. The page looks like the real GLS, including the blue header, the logo, the footer links and the shipment timeline.

Step 1: the notice about a held parcel

After opening the link, the page claims the delivery attempt failed and the parcel is held at the depot. There is a shipment reference in the form GLS-SK-8947562310 and a complete timeline: label created, picked up, in transit, arrived at depot, out for delivery, delivery exception. All invented, yet it looks like a real tracking system.

At the bottom sits a single button: Update delivery address, with a reassuring note that it takes less than two minutes.

Step 2: address, phone number and e-mail

The second screen asks for full name, address, city, region, postcode, phone number and e-mail. We filled in made-up data and watched what the page sent to the server. And here is the most important finding of this whole article.

The page does not submit the form when you press the button. It sends each field separately, the moment you stop typing in it. In the network traffic we saw one request after another:

{"content":{"type":"input_address","key":"fullName","text":"Testovaci Testovac"}}
{"content":{"type":"input_address","key":"address","text":"Vymyslena ulica 123"}}
{"content":{"type":"input_address","key":"phone","text":"0900000000"}}
{"content":{"type":"input_address","key":"email","text":"test.neexistuje@example.com"}}

This means that even if you change your mind halfway and close the page, the scammer already has everything you managed to type. So much for “I never pressed submit, so nothing happened”.

Step 3: the 1.39 EUR fee and your card details

After the address comes the main act: a re-delivery contribution of 1.39 EUR. The page asks for the cardholder name, card number, expiry date and CVV. For good measure it adds that “your data is protected by AES-256 encryption” and shows the logos of every card scheme.

We entered a non-existent test card number and watched the traffic again. The result is the same as with the address:

{"content":{"type":"input_card","key":"cardNumber","text":"4111111111111111"}}
{"content":{"type":"input_card","key":"expires","text":"12/30"}}
{"content":{"type":"input_card","key":"cvv","text":"123"}}

The card number, expiry and CVV went to the attacker before we pressed Pay.

After clicking the button the page froze, waiting. That is normal for these scams: on the other side sits a person or a script trying the details in a real payment gateway in real time. Depending on what the bank answers, the page then shows the next step, most often a prompt to enter the code your bank has just sent you.

What happens next

The 1.39 EUR is bait. The real goal is usually one of these:

• Adding your card to the attacker’s mobile wallet. When a card is registered in Apple Pay or Google Pay, the bank sends a verification code. If you type it into the fake page or read it out on the phone, the attacker has your card on his device and pays with it in shops without a PIN. Slovak banks warn about exactly this.
• Recurring payments. The 1.39 EUR goes through as a one-off, but the small print often hides consent to a subscription. Then tens of euros leave the card every month.
• Reselling the data. Your name, address, phone number and e-mail are a product in themselves. Bundled up, they are sold to other scammers who will call you a few days later “from your bank” and sound very convincing, because they will know more about you than a stranger should.

What we found out about the site

A third level domain under us.cc is a typical sign. Subdomains like this are cheap and quick to get, the attacker rotates them after every wave and lets the old one die. That is why memorising specific addresses is pointless. Remember the rule instead: the part right before the first slash must be the company’s own domain, not its name somewhere in the middle.

How to spot it in five seconds

1. Look at the domain, not at the text. In gls-balik.us.cc the real domain is us.cc. GLS uses gls-group.com.
2. Are you even expecting a parcel? If not, it is a scam. If yes, open the tracking in the shop or in the carrier’s app.
3. No diacritics and no specifics. No order number, no shop, no name of yours.
4. It asks for money or a card. Carriers handle surcharges at the door or in their own app, not through a link in an SMS.
5. It pushes you on time. “As soon as possible”, “last attempt tomorrow”, “the shipment will be returned with extra costs”.

What to do if you already entered your data

1. Block the card. It takes seconds in your banking app, otherwise call the bank’s 24/7 line. Speed matters more than anything else.
2. Do not confirm any codes or notifications. If a verification SMS or an app prompt arrives, do not approve it and do not read the code to anyone, not even to someone claiming to be from your bank or the police.
3. Check your transactions and dispute them. Report unauthorised payments to the bank, a quick reaction usually gets the money back.
4. Report the scam. Inform the police and send the scam site to GLS at security@gls-group.com so they can warn others.
5. Adjust your limits. Set a lower limit for online payments, or ask your bank for a virtual card used only for online shopping.

If you only entered your address and not your card, the card is safe, but be ready for them to try again. We described how such calls go in our article about scammers calling from your bank.

How to stay safe

• Never click links in messages about shipments. Open the carrier’s app or the shop yourself.
• Keep a separate card for online payments with a low limit, or a virtual card you can cancel in one click.
• Turn on notifications for every transaction. You will know about an attempt the same second.
• Never read out codes from SMS messages. Neither your bank nor a courier will ever ask for them.
• Warn your family. These waves go out to thousands of numbers at once and the people who really are expecting a parcel pay the price.

Similar messages circulate in the name of other companies. We have already taken apart a scam SMS from ZSE about cutting off electricity, a fake police fine and the motorway vignette scam. The principle is always the same and so is the defence: verify it yourself, outside that message. If something similar arrives by e-mail, you can check the message with our scam e-mail detector right in your browser.

Conclusion

The “missing house number” SMS with a link to gls-balik.us.cc is phishing for payment card details. It is well made: it slips into the thread with genuine GLS messages, it runs on HTTPS and it looks like the carrier’s real website. We verified that everything you type into it reaches the attacker as you type, so closing the page halfway is not enough. The 1.39 EUR fee is a pretext, the target is your card and the verification code from your bank. If you entered your details, block the card now and confirm nothing. And pass this article on, it protects better than any antivirus.

Sources and verification. The carrier’s official security notice is on the GLS security advice page, where GLS states that it never asks recipients to pay for goods by e-mail, credit card or bank transfer, and that fraud should be reported to security@gls-group.com. Slovak banks, for example Tatra banka, warn about stolen cards being added to mobile wallets using codes from bank SMS messages. The technical findings in this article come from our own analysis of the site on 13 October 2026, which we carried out exclusively with made-up data.

This article is part of our Cybersecurity overview.