Serbia: Forgery misuse of payment cards

2026 marks the 25^th anniversary of the Convention on Cybercrime (also known as the Budapest Convention ).

H ere are 25 selected real cases and operations against cybercrime that speak for themselves on the usefulness and relevance of the Convention and its framework in the daily work of criminal justice authorities worldwide, working on fighting against cybercrime and protecting you and your rights in cyberspace.

Back to the main page

25 cases

Back Serbia: Forgery misuse of payment cards

In December 2025, the Serbian Police, Cybercrime Unit, in coordination with the Higher Public Prosecutor’s Office in Belgrade, Special Department for Cybercrime arrested two Chinese nationals for committing criminal offences forgery misuse of payment cards and unlawfully obstructed and restricted access to a public computer network.

They used improvised IMSI-catcher device which was controlled via a mobile phone on which special application was installed in order to connect and intercept users of the base stations of the mobile network operator and that is how they unlawfully prevented access to a public computer network transmitting radio signal of sufficient strength to establish direct radio communication with the mobile phones of the injured parties. Defendants sent SMS messages containing false information, designed to appear as if they had been sent by legitimate services. These messages contained phishing links directing the injured parties to fraudulent websites on a public computer network, displaying the logos of the legitimate services and including sections for online payments and data entry, falsely presented for the purpose of inducing the injured parties to disclose confidential personal data, such as payment card details, which were then misused for unauthorized purchases abroad and obtained unlawful material gain exceeding 2 million Serbian dinars.

A key element in pre-investigation process was close operational co-operation with national telecommunications operators in accordance with Article 20 (Real-time collection of traffic data) of Budapest Convention. Telecom operators provided law enforcement with technical indicators of abnormal network behavior, specifically data on mobile devices that were disconnected from legitimate base stations and subsequently reconnected in a pattern inconsistent with normal network mobility. The Cybercrime Unit also developed an internal analytical application that correlated telecom network data with time and location parameters. This tool enabled investigators to track the movement of the IMSI-catcher device in near real time, effectively mapping its trajectory across urban areas as the suspects moved with the equipment in their vehicle.

An indictment was submitted after conducting evidentiary measures in early June.