Police are investigating the latest in a series of cases in which fraudsters impersonating the General Healthcare System (GeSY) have gained access to people’s bank accounts through text messages. This time, the person targeted was an 81-year-old woman, who lost €33,424 from her personal bank account and from a second account she manages. The case comes just two weeks after the Health Insurance Organisation and the Cyprus Police warned that fake GeSY texts can appear in the same thread as genuine ones.
How the latest scam unfolded
According to a complaint filed with Limassol CID, the woman received a text message on her mobile phone that appeared to come from GeSY. The message asked her to pay €1.50.
She followed the instructions in the message. She then began receiving notifications of attempts to access her online banking account.
The perpetrators withdrew a total of €33,424 from her personal account and from another account she manages. The case is being investigated by the Financial Crime Investigation Office of Limassol CID.
Why the fake messages are difficult to recognise
On 28 September, the Health Insurance Organisation (HIO) and the Cyprus Police issued a joint warning to GeSY beneficiaries, as cases of false and malicious text messages continued to be recorded.
According to their statement, the messages use the name “GESY” or the names of healthcare providers to create the impression that they come from the health system. The messages may even appear directly below legitimate messagesthat GeSY has previously sent to beneficiaries.
Police have also said that criminals exploit technological developments, the widespread use of the internet and, above all, citizens’ trust in order to obtain money or personal information.
A pattern of fake health system messages
The latest complaint follows similar cases over the past year. In November 2025, a 66-year-old man lost €30,000 after receiving a text message that appeared to come from GeSY and asked him to pay a small fee. He entered his bank card details, which allowed the perpetrators to withdraw the money from his account. That case was also investigated by Limassol CID.
In April 2026, a 60-year-old man in Paphos lost €48,000. The message he received claimed that his GeSY profile required an upgrade and directed him to a website. There, he was asked to enter personal and bank account details, supposedly to complete a payment for the upgrade. The perpetrators then gained access to his account and withdrew the money. The case was investigated by the Financial Crime Investigation Office of Paphos CID.
Other methods used by fraudsters
Text messages are not the only method being used. In December 2025, police warned of scams in which perpetrators appear as uniformed police officers on phone and video calls and present fake identification. They try to obtain passport and identity card numbers, residence permit details and credit card information. Police stated that they never communicate with citizens in this way.
Businesses have also been targeted. In April 2026, a Limassol company reported losing €65,709 after unknown individuals gained access to its email correspondence with a partner company. The perpetrators sent fraudulent messages instructing the company to transfer invoice payments to a new bank account under their control. The case was examined by the Limassol CID’s Financial Crime Investigation Unit.
Online fraud figures for 2025
Figures provided by the Cyprus Police, show that 921 online fraud cases were reported to district CID offices during 2025. The cases involved the theft of €10,352,540, along with $4,185,955 and £5,272.
The Electronic Crime Subdivision reported the figures. Police said the most frequent forms of online fraud include fake emails and text messages, telephone scams, fake investment platforms, invoice payment scams, social media scams and the theft of bank account and payment card details.
According to police, these cases are often linked to organised criminal networks operating internationally, with perpetrators frequently based outside Cyprus.
What the HIO will never ask for
The HIO has stated that it never asks beneficiaries by text message for passwords, login details, payment details or other personal data. It also does not ask citizens to carry out financial transactions through links included in text messages.
Anyone who receives such a message is advised not to open the link and to delete the message immediately.
Police advice to the public
Police are urging the public to be particularly cautious with messages containing links. Citizens are advised not to share or enter personal or banking details on unknown websites.
Before making any online transaction or payment, people should verify that the request is genuine by contacting the organisation or company named as the sender through its official channels. Businesses are advised to verify any payment request received by email, particularly where bank details have changed.
Police also recommend using strong and different passwords for each account and enabling two-factor authentication where available.
Anyone who has already shared bank details through such messages should inform their bank immediately to prevent the details being used illegally. They should also contact the police.
