Problem
“[Police] Notice of unpaid traffic violation fine. Late fees apply after the deadline.” Then a link. You may well have run a light recently, and “late fees” makes you hurry.
Government impersonation texts apply two pressures at once: a penalty and a deadline. People rarely ignore an official agency, and the thought that they might have made a mistake makes them tap just to check.
Symptoms
- It names the police, the road traffic authority or a local government.
- Urgent words: “unpaid”, “late fee”, “seizure”, “pay by”.
- It came from a personal mobile number or one you have never seen.
- The link is not a government domain (
go.krin Korea) or is hidden behind a short link. - The page asks you to install a “notice viewer app” or enter card details.
Three checks against a real notice
1. How real notices arrive. In Korea, fines come by post by default. Those who sign up receive e-notices via 국민비서 on verified channels such as KakaoTalk or the Naver app. If a single text from an unknown sender is the only contact, start from suspicion.
2. The link. Korean government sites mostly end in go.kr. But go.kr appearing in the middle of an address (efine.go.kr.pay-check.top) is not a government site. Look at what the address ends with.
3. Check on an official site you opened yourself. Ignore the link and phone number in the text. Open the police traffic portal efine.go.kr or Gov24 via search or a bookmark and look up unpaid fines. If the fine is real, it will be there.
Diagnose with DechoNet
- Paste the message into the phishing link check. It shows whether the link really reaches a government domain, how old the domain is and whether it leads to an app download.
- Domain registration lookup shows when the link’s domain was registered. Government sites are
go.krdomains registered years ago. - Lookalike domain detection finds addresses imitating the official domain.
Resolution Checklist
- Do not use the link or phone number in the text.
- Look up fines on efine.go.kr or Gov24 yourself.
- Check that the address ends in
go.kr(in the middle does not count). - Close the page if it asks for an app install or card details.
- Signing up for official e-notices gives you one trusted channel for real notices.
- Screenshot the text, report it (Korea: 118) and delete it.
When to Escalate
- If you entered details or installed an app, follow what to do after clicking a smishing link.
- If money was taken, request a payment stop (Korea: 112).
Paste the message and check it now
Paste the whole message or just the link. The text is not stored; each link is followed to where it really goes.