Skip to content
Scammers.com
Government impersonationReviewed

Japan police warn of SMS from 'NPA' pushing fake police-recommended anti-fraud app download

Japanese police accounts, including Noda Police (@NodaPolice110), warned on X on 13 November 2026 about text messages that use the sender name "NPA" (National Police Agency) and claim that fraud is on the rise, urging…

First reported
Reports
1

Source: x.com · published

Japanese police warning graphic about SMS from 'NPA' pushing a fake police-recommended anti-fraud app, with the lure URL redacted
Image: Noda Police / graphic by Tobira Systems

What happened

Japanese police accounts, including Noda Police (@NodaPolice110), warned on X on 13 November 2026 about text messages that use the sender name "NPA" (National Police Agency) and claim that fraud is on the rise, urging recipients to download an anti-fraud app from a link. According to the warning graphic, the link opens a fake copy of the police agency's "recommended apps" page with a download button that does not exist on the real page, then a screen styled as Google Play that pushes an APK posing as the anti-fraud app "詐欺対策 by NTTタウンページ" (NTT Town Page). The graphic's final screens show the fake app requesting a VPN connection and full control of the device, which can let criminals take over the phone. The National Police Agency and NTT Town Page are being impersonated and are not involved; the police say they never send SMS asking people to install apps. Install police-recommended apps only through the links on the National Police Agency's official website or the official app stores.

How the scam works

Messages that claim to come from the police or another government service, especially about a fine, a refund or an investigation, are a common way to steal card details, identity documents or a login. Real agencies do not demand immediate payment by a link in a text, or ask you to type a driving licence and a card number on a look-alike page. Go to the official website or app you already use, or call a number from a statement or a government directory, not from the message. If you entered card or document details, contact your bank and report the texts to your national CERT or police cyber unit.

Source

Source: https://x.com/NodaPolice110/status/2121106677332320511 (@NodaPolice110, Nov 13, 2026, 12:03 AM ET)

Red flags

  • A message, page, group or phone number that uses a trusted organisation's or person's name, logo or contact details.
  • A request to pay, log in, or send money or personal information through an unofficial number or link.
  • Contact details that do not match the ones on the organisation's official website.
  • Urgency about an admission, a refund, a fine, an investigation or a limited offer.

If you were targeted

  1. 1Do not pay or log in through a link or number from the unexpected message.
  2. 2Look up the official website or phone number yourself and contact the organisation there.
  3. 3If you have already paid or shared information, contact your bank and report it to the police or your national cyber-crime service.
  4. 4Report the fake page, group or number to the platform and to the real organisation.

Researcher flags fake Tokyo Metropolitan Police sites on jp.kswg.net and jp.kswl.net

Security researcher @catnap707 posted on X on 13 November 2026, tagged #偽サイト (fake site) and #警視庁 (Tokyo Metropolitan Police Department), listing the links jp[.]kswg[.]net and jp[.]kswl[.]net and the IP addresses 180.…

  • jp.kswg.net
  • Also jp.kswl.net; IPs 180.178.61.26-30 (AS963)
  • Fake Tokyo Metropolitan Police site series (jp.kdfz.net / jp.kswg.net / jp.kswl.net)
Reported Nov 13, 20261 report
CERT Polska warning screenshot of a fake Polish police parking-fine text, with the recipient number blacked out and a red OSZUSTWO stamp.

Fake Polish police parking-fine texts link to 15844.eu.cc page that takes driving-licence and card details

Poland's national computer emergency response team CERT Polska warned on X on 12 November 2026 about a new SMS campaign in which fraudsters pose as police units, including traffic departments and regional police headq…

  • 15844.eu.cc
  • Link path /vehicle-gov/pl; SMS signed 'Policja'; report SMS to 8080 (CERT Polska)
  • eu.cc fine/malware smishing cluster (12 Nov 2026)
Reported Nov 12, 20261 report

Researcher flags fake Tokyo Metropolitan Police sites on jp.kdfz.net and four similar hosts

Security researcher @catnap707 posted on X on 12 November 2026 about fake websites (偽サイト) impersonating the Tokyo Metropolitan Police Department (警視庁). The post lists the links jp[.]kdfz[.]net, jp[.]kstw[.]net, jp[.]k…

  • jp.kdfz.net
  • Also jp.kstw.net, jp.kswt.net, jp.ksxz.net, jp.kdfx.net; IPs 180.178.61.26-30 (AS963)
  • Police or government impersonation and fake-bank callers (12 Nov 2026)
Reported Nov 12, 20261 report

Kolkata police arrest three men accused of posing as CBI officers at SSC office; fake IDs and forged job letters seized

Nation Press reported on 11 November 2026 that Kolkata Police's Bhowanipore police arrested three men who allegedly impersonated Central Bureau of Investigation (CBI) officers at the Staff Selection Commission (SSC) o…

  • Three men posing as CBI officers; fake CBI ID cards; SSC Eastern Region office, Nizam Palace, Kolkata
Reported Nov 11, 20261 report
PhishingReviewed

Fake 'GTA 6 EXE download' on Google Colab delivers WARDEN Stealer that steals crypto wallets; C2 uroker.casa

Help Net Security reported today on research by Cynet into a fake 'GTA 6 EXE file download' promoted from a Google Colab notebook. The link led to a page called 'Windows Software Hub' showing a version number, downloa…

  • uroker.casa
  • Probable C2 named by Cynet; lure: Google Colab notebook -> 'Windows Software Hub' page -> ZIP with loader
  • Fake GTA VI or GTA 6 download and key-lure sites
Reported Nov 13, 20261 report

Ottawa police charge Cory Cahill over alleged contractor frauds as Sprumac Renovations and Hammer & Nails Contracting

The Ottawa Police Service said on 13 November 2026 that its East Criminal Investigations Section charged Cory Cahill, 47, of Ottawa, on 10 November 2026 with offences relating to contractor frauds allegedly committed…

  • Cory Cahill, 47 (aliases Cory Campbell, Cory Perkins, Lincoln Cahill); Sprumac Renovations; Hammer & Nails Contracting
  • Contractor or home-repair fraud charges (13 Nov 2026)
Reported Nov 13, 20261 report