“ZSE may cut off your electricity”: the scam SMS that wants your payment card

This afternoon an SMS from the sender “ZSE” arrived on one of our phones. It claims we have overdue fees and that ZSE may cut off our electricity. The link leads to zse.liast.cc. It is a scam. Here is what it looks like, what we found out about it and what to do when it reaches you.

What the message looks like

The exact wording, in Slovak without diacritics:

Upozornenie: Vase poplatky po splatnosti zostavaju neuhradene a ZSE moze prijat opatrenia na prerusenie dodavky elektriny. https://zse.liast.cc/sk

In English: “Warning: your overdue fees remain unpaid and ZSE may take measures to interrupt the electricity supply.” The message has two jobs. The first is to scare you, nobody wants to be left without electricity. The second is to get you to a page where you “settle the arrears” with a payment card. The scammers then empty the card.

What we found out about the domain

The link looks trustworthy at first glance because it starts with zse. But the domain is what comes before the first slash and after the last dot: liast.cc. The word zse is only a subdomain, which anyone can set up on their own domain in a minute. It could just as well read bank.liast.cc or post.liast.cc.

A few facts we verified:

• The domain liast.cc was prepared on the day of the attack. Let’s Encrypt issued its certificate on 23 September at 10:22. The messages went out in the afternoon. The scammers built the page in the morning and sent it out the same day.
• The page hides behind Cloudflare. The real server is not visible and the domain is hard to block.
• The first screen was a “human verification”. A fake check meant to deter automated scanners. Behind it was the page with the payment card form, we counted dozens of references to the word “card” in its code.
• After a few hours the page disappeared. By the evening the link returned a 404 error. Scam pages often live only a few hours until someone reports them. That is why there is no point waiting for someone to “switch it off”, and why we publish this warning on the same day the SMS arrived.

How to recognise the scam

• Foreign domain. The real ZSE website is zse.sk. Anything else, even with the word zse inside, is a scam.
• No diacritics. A company sending hundreds of thousands of messages gets its Slovak spelling right.
• No specific details. No name, contract number, invoice number, amount or due date. A genuine reminder always has them.
• Threat and pressure. Cutting off electricity is exactly the kind of fear that makes people click without thinking.
• The sender “ZSE” proves nothing. The SMS sender name can be set freely by the scammer, technically it is called an alphanumeric sender ID. On iPhone and Android such a message can even land in the same thread as previous genuine messages from ZSE.

How ZSE really communicates arrears

ZSE sends reminders by post, by e-mail from the zse.sk domain, and shows them in the customer account at zse.sk and in its app. If you are not sure whether you have arrears, open the customer account yourself, through an address typed manually into the browser or through the app, and check the invoices. Never through a link in a message. The same rule applies to SSE, Východoslovenská energetika, SPP and any other supplier.

What to do when such an SMS arrives

1. Do not click. If you clicked and filled in nothing, close the page. Opening the page by itself does not leak your data.
2. Report the message as spam and delete it. On iPhone press and hold the message, Report Junk. On Android use the menu in the Messages app.
3. Check your status with the supplier your own way: the app, the customer account or the phone number on your invoice.
4. Warn your parents and older relatives. They are the ones most afraid of losing electricity and the ones who most often pay.

What to do if you already entered card details

• Call your bank immediately and block the card. Banks have a 24/7 fraud line.
• Watch your account activity and dispute every unauthorised payment. Card payments can be charged back.
• If you also entered login details, change the password everywhere you used it.
• Report it to the police and ideally to ZSE too, so it can warn others.

This scam is a copy of the scenario we already described in the fake fine from the Ministry of Interior and the fake motorway vignette. Only the brand changes, the mechanism stays the same: fear, a foreign domain, a card form. How to recognise scam messages in general is in our article on scam messages, and you can check a link from any message in our phishing email checker.

Conclusion

The SMS “ZSE may cut off the electricity supply” with a link to zse.liast.cc is a scam after your payment card details. You recognise it by the foreign domain, the missing diacritics, the missing contract details and the threat of disconnection. Check your invoices only at zse.sk or in the app, never through a link in a message. If you already entered your card, call your bank now. And pass this article on, the scammers sent thousands of these messages today.

This article is part of our Cyber security overview.