On Wednesday afternoon, September 16, Nigerian actress, Eva Ibiam, took to X to warn her followers after losing nearly N400,000 to a fraudulent text message purportedly sent by the country’s traffic enforcement agency. The message arrived on her phone at 3:08 p.m.. The same day, Lagos-based comedian, Edeh Sylvester Chisom, known as MC Monica (@mcmonicacfrn), posted on his Instagram account that he had nearly N1.9million taken from his account after receiving a traffic offence-related text message. The messages were fraudulent, but Ibiam and MC Monica did not know and had acted upon the instructions. Several Nigerians also posted online disclosing they had received similar messages.
Collage of fraudulent posts
The fraudulent website was designed to impersonate the Federal Road Safety Corps (FRSC), although most of the sites bear little resemblance to the agency’s actual website in appearance or layout. Their common link to the FRSC is the text messages used to lure motorists with fabricated traffic violations, prompting them to enter their bank card details on third-party payment pages controlled by scammers.
This report investigates the scam operation using open-source intelligence (OSINT) techniques. It finds that the public alert identified only one entry point into a broader scheme that had been operating for at least six months across multiple countries, leaving behind sufficient technical evidence to reconstruct its development in remarkable detail.
The investigation traced the infrastructure used in the text-message campaign to earlier schemes that impersonated a European parking company and a South African traffic-fine service, months before the Nigerian operation began. The campaigns relied on servers in Singapore and the United States, as well as a residential internet connection in New Zealand.
However, the findings do not establish a single, centrally coordinated operation. Instead, they reveal a network of related domains linked by shared registrars, hosting providers and identical phishing templates. The overlaps suggest that either one operator has been recycling infrastructure across different campaigns or several actors are using the same underlying toolkit.
READ ALSO: SEC dismantles over 400 fraudulent investment schemes in 3 years
How the scam worked
The scam began with a text message to ordinary phone numbers, styled to look like an official notice: “FRSC: You have a new road traffic offence record that requires handling. Please review the relevant details [https://www.fctevreg.cam/z].”
When the link www.fctevreg.cam/z was clicked, visitors were taken to a page titled ‘Road Traffic Offences,’ where they were asked to enter their vehicle registration number and select ‘View Violation Notice(s).’ This would lead to a page titled ‘Pending Fines’ that referenced the FRSC Establishment Act, quoted a particular traffic offence code and offered a discounted penalty if the payment was made within a limited period.
Related Articles
This combination of official language, a legal reference and a time-sensitive discount seems to be intended to create a sense of urgency and legitimacy. The page makes the payment seem credible and financially beneficial, prompting victims to act fast rather than look closely at the website or check its authenticity.
In the documented cases investigated, the consequences were more than the payment of the alleged fine. The two victims said they entered payment or banking details on the website and then saw unauthorised transactions. In one instance, the victim’s card was used to make an unauthorised purchase, and in another, money was taken from the victim’s bank account.
READ ALSO: China-based Ponzi scheme, CBEX, scams investors as Nigerians lose over N1.3trn
Ibiam had only one fraudulent debit of N364,574.36 from her account, and it was through a merchant she later shared online as ‘Serious Fix Machinery’ on a bank statement with a Dubai address. In her account, she said that after the debit was processed, the one-time password (OTP) related to the transaction was on her phone. The sequence also raised concerns over how the payment was approved and suggested the fraud might have been perpetrated while the fraudsters were actively engaging with the transaction.
Screenshots of text message and transaction Ibiam shared on her X account
MC Monica, in the records he shared directly with this reporter, showed a single card transaction of N1,849,378.18, processed through a merchant name ‘Rawdat Aljamal.’
His screenshots also show he received a second text message a few hours after the first, pointing to an entirely different domain, evidence the scam operation was actively running multiple lures against the same person in a single afternoon.
Screenshots of text messages and transaction from MC Monica
But the infrastructure behind the scam showed four separate pieces of evidence that tied these attacks to a coordinated, automated operation rather than an improvised, one-off scam: the speed of deployment, a shared hosting fingerprint, a leased and difficult-to-trace server, and a takedown that was later reversed.
The ‘speed of deployment’ showed the first fake FRSC website, frscgov.top, was registered at 09:47:53 UTC on September 16. Public records show its hosting was fully configured 82 seconds later, scripted, automated and designed to spin up fake portals on demand.
Related Articles
That speed matters. No one manually registers a domain and configures a government-style website in under a minute and a half. The evidence points to an automated pipeline: a pre-written script capable of deploying new scam websites almost immediately, ensuring the operation can replace takedowns with fresh domains at will.
READ ALSO: Six Nigerians face US extradition over R100m romance scam in South Africa
Another infrastructure was ‘a shared hosting fingerprint.’ That same website shared its registration company, technical settings and, for a period, its actual server with a second scam website: [apcoa-pl.sbs], impersonating APCOA, a real European parking payment company targeting Polish drivers. It was registered two days before the Nigerian scam operation wave began, using an identical setup down to a shared server, an indication both scams were orchestrated by the same operation, or at very least, by a single infrastructure provider catering to multiple criminal clients. The apcoa-pl.sbs website has been labelled unsafe and deceptive by Google.
Screenshot of Google’s branding of the website as deceptive
The third piece of infrastructure was a leased block of 256 IP addresses. First allocated to Hewlett-Packard in 1986, the block has changed hands four times. Registry records show it passed through the leasing marketplace IPXO in April 2026, then through a subleasing intermediary before being assigned in July to a customer listed as a private customer at a private residence in Auckland, New Zealand, weeks before the first scam wave.
No ordinary household needs 256 IP addresses. While that alone proves nothing, the opaque leasing chain made the block’s latest custodian difficult to identify. Three campaign domains, one linked to a Polish parking scam and two to Nigerian scams, shared an IP address within the block, providing a technical link between the operations.
The fourth takedown was short-lived. Days after the Polish website was suspended by its registry, this investigation found that it had quietly resurfaced. A new security certificate had been issued, its technical settings updated and the website migrated to a different server through a hosting reseller in Singapore. At the same time, another fraudulent domain linked to the operation was being taken offline. As one part of the network went dark, another came back online.
Besides the four infrastructure leads, a fifth lead originated from a separate investigative technique. Instead of tracking the domains sent to victims, a search was conducted on domain registration records for web addresses containing the term ‘frscgov.’ This common investigative technique can help to identify associated infrastructure that may not be present in phishing messages or directly encountered by potential victims.
The search revealed fctevreg.cam’s sibling domain, the one which delivered the text message sent to lure to actress Eva Ibiam, which was registered on September 15 (one day before the appearance of frscgov.top) and is hosted by the same Singapore-based reseller, Aceville Pte. Ltd., which apcoa-pl.sbs transferred to when its suspension was lifted.
In combination with ak.fegw.eu.cc, the domain sent to comedian MC Monica, the operation spans at least four hosting providers across three countries: a residential lease in New Zealand, a reseller in Singapore, and both Alibaba Cloud and Amazon‑leased infrastructure registered in the United States. That mix rules out any notion of a single improvised server and instead points to a deliberately redundant, distributed setup designed to withstand takedowns.
Related Articles
The same keyword search for ‘frscgov’ that turned up the fctevreg.cam WHOIS record also turned up a fourth domain, frscgov.org. The frscgov.org does not share any infrastructure links with the other domains in the FRSC scam network. The site has been in operation since March 2026, several months before the SMS campaign first appeared in Nigeria. It is hosted on Amazon servers managed through Vercel and has a fraudulent FRSC login portal to harvest users’ email addresses and passwords.
Screenshot captured on September 21, 2026 showing the fake FRSC website frscgov.org active status
Unlike the short-lived fine-payment websites, frscgov.org appears designed for longevity: certificates are renewed on a monthly basis, it has never been flagged by Google, and it is configured to send and receive email as if it were an official FRSC website.
This domain shares no registrar, hosting platform, or technical attributes with frscgov.top(/ng), fctevreg.cam, apcoa-pl.sbs, or ak.fegw.eu.cc, suggesting this is a separate operation which only intersected this report’s scope due to its use of a similarly named domain.
Its favicon even includes the logo of an actual Enugu State vehicle-testing initiative, implying the page’s template may have been designed for a legitimate purpose prior to being adopted for its current use.
A WhatsApp click-to-chat link embedded in the website’s footer resolves to a Nigerian phone number registered to a WhatsApp Business account under the name of a company belonging to an individual whose profile online described him as a software and electrical engineer. The pre-filled message read: “Hello! My name is ___. I’m looking for help with software development or an IT solution.”
While the name appeared in the footer of frscgov.org, this report could not establish that the individual behind the account deployed or operated the scam. His involvement could range from legitimate software work to misuse of his identity. Multiple attempts to reach him for comment failed: WhatsApp messages were marked read but unanswered. Text messages received no reply, phone calls rang without response, and a message sent to his X account also went unanswered.
An older scam, wearing a new uniform
This report found that the domain frsc-gov.sbs, linked to the scam operation, displayed ‘FRSC’ in a browser tab but in fact loaded a South African traffic-fine payment template titled ‘Fines SA.’ Unlike the other websites, it was built on older software, suggesting the operation had recycled an existing scam framework rather than creating it fresh for Nigeria.
Archive searches show that this template had been in use several months prior and was associated with at least six related domains since May 2026. One of these domains was associated with the same hosting reseller that had brought back the Polish website, indicating a common operational source. The evidence suggests the infrastructure was not built for the Nigerian campaign, in the first place. Instead, it seems to have been created specifically to target South African motorists, and then repurposed and rebranded to look like the FRSC in Nigeria.
This finding suggests the operation is portable and adaptable; the same scam framework can be pointed at different countries’ traffic authorities, swapping out names and logos while keeping the underlying fraud intact. Nigeria may simply be the latest target, not the last.
At the time of publication, the operation remained active. The frscgov.org domain, which operates independently of the wider scam network, has been the longest-running website to exploit the FRSC’s name and logo. Active since March, it continues to host a fake login page.
Meanwhile, apcoa-pl.sbs, which was previously suspended, has resurfaced on new infrastructure. Only a few of the domains identified in this investigation have been permanently taken down, while others remain active or have gone offline temporarily, suggesting a pattern of domain rotation rather than a withdrawal from the operation. The FRSC’s public warning identified one fraudulent website. This investigation uncovered several others, at least two of which remain accessible.
