Chinese Scammers use fake Traffic Fine messages to target Saint Lucia and the Caribbean

Saint Lucian motorists are being warned to ignore a run of fraudulent messages that claim they were caught speeding and demand payment through a counterfeit government website.

The Government of Saint Lucia published the alert on its official Instagram account on 5 August, carrying the crest of the Royal Saint Lucia Police Force (RSLPF). The advisory tells the public to disregard fraudulent WhatsApp messages posing as RSLPF traffic enforcement and steering recipients to a fake "Digigov" site. Recipients are told not to reply, not to click, and not to hand over personal or financial details, and to report, block and delete.

The force added a detail that quietly dismantles the whole premise of the scam: traffic tickets in Saint Lucia are paid at the First District Court Office on St. Louis Street, and a physical copy of the ticket is required. There is no online path to pay a traffic ticket. A link that offers one is, by definition, not the government.

What the message says

A specimen circulating on the island reads as a formal enforcement notice:

• It is headed as a Saint Lucia (RSLPF) Traffic Enforcement Notice
• It claims vehicle records show a speeding violation "in breach of the Road Traffic Act"
• It carries an official-looking reference, Notice Number: RSLPF-2026-98124, and a date of issue of 5 August 2026
• It sets an action deadline of three days
• It directs the recipient to "log in to the official government portal" at https://digigov-govt[.]cam/lc to view photos of the violation and pay
• It invites the recipient to reply "1" for a quick view of the violation details
• It closes by threatening deduction of driving points, suspension of driving privileges, or a court summons

The statute name is a small tell. Saint Lucia's governing legislation is the Motor Vehicles and Road Traffic Act, per the Revised Laws of Saint Lucia. "Road Traffic Act" is the title used in other jurisdictions, the sort of near-miss that appears when a single phishing template is re-skinned country by country.

Threat Analysis & IOCs

The strongest evidence of professional tooling is the URL itself.

Saint Lucia's real e-services platform is DigiGov, a Government of Saint Lucia digital services portal that hosts online applications and payments for services including those of the Division of Transport. It lives at digigov.govt.lc.

Threat analysis of the domain:

1. The hyphen fuses two labels into one. In the real address, govt.lc is the domain and digigov is a subdomain beneath it. In the fake, digigov-govt is a single label, the hyphen does the visual work a dot used to do.
2. .cam impersonates .com. It is a real generic top-level domain, and one letter off the most recognised suffix on the internet. Interisle Consulting Group's cybercrime research has ranked .cam among the worst-performing top-level domains by proportion of registrations reported for cybercrime.
3. .lc is demoted from a country code to a folder. In digigov-govt.cam/lc, the "lc" sits after a slash. It is a path on someone else's server, not Saint Lucia's national domain.

Read left to right at phone speed, digigov-govt.cam/lc scans as digigov.govt.lc. That is the entire attack.

There is corroboration that this technique is in active regional use. In Trinidad and Tobago, the Judiciary flagged a fraudulent site in its own traffic-fine scam warning this week, noting one fake domain ended in .cam rather than .org, which CNC3 reported as a common deception tactic.

This phishing website contacted 2 IPs in 1 countries across 1 domains to perform 1 HTTP transactions. The main IP is 43.164.196.169, located in São Paulo, Brazil and belongs to TENCENT-NET-AP-CN - Tencent Building, Kejizhongyi Avenue, China. The main domain is digigov-govt.cam (1 day old). TLS certificate is Issued by YR1 on August 5th 2026 which is valid for 3mo.

Multiple domains are hosted on the IP under investigation.

Link Analysis

Ten of the sixteen relate directly to vehicle taxes, traffic fines, or court fine payment. Two are tax authorities, three postal, and the remainder general government payment portals. This is a fines-and-payments kit.

The "reply 1" trap

The instruction to reply "1" deserves attention, because it is not a link and most people will not read it as dangerous.

It does three things for the operator. It confirms the number belongs to a live, responsive human, instantly upgrading it from a bulk list to a qualified target. It opens a conversation, which is where social engineering actually works. And it moves the interaction into a chat thread, sidestepping the link-scanning and URL filtering that carriers and messaging platforms increasingly apply.

Answering a scam message is not neutral. It is the first conversion step.

A regional wave, not an isolated incident

Saint Lucia's advisory did not arrive alone. Within roughly 48 hours:

• Guyana, 4 August: Traffic Chief Mahendra Singh warned of fake traffic fine texts threatening legal action unless payment is made within a set period, and directing recipients to a fraudulent site. He confirmed some people had already paid through the fraudulent links, and said police had launched an investigation. Singh noted legitimate notifications come through the Safe Road Intelligent System and that only MMG and the Clerk of Court are authorised payment routes.
• Trinidad and Tobago, 5 August: The TTPS and the Judiciary issued separate advisories over texts purporting to come from the TTPS Traffic Enforcement Branch, claiming a vehicle was detected speeding by a speed enforcement system.
• Barbados, May: The Barbados Police Service warned about a bogus "Final Notice of Administrative Penalty for Traffic Violations" instructing recipients to log in and settle payment online.

Where this comes from

The Caribbean is not being singled out. It is being added to a list.

Bitdefender Labs, tracking what it named Operation Road Trap, has been following traffic-themed smishing campaigns targeting drivers worldwide since December 2025. Researchers reported more than 79,000 scam text messages across some 40 campaigns impersonating transport authorities, toll operators and parking services, with over 29,000 unique message variants, and noted that a typical message sets a short deadline, usually 24 to 72 hours, to resolve an invented fine.

Saint Lucia's three-day window sits precisely inside that band.

The industrial scale behind it has been documented repeatedly. Palo Alto Networks' Unit 42 has attributed a long-running smishing operation to a China-linked group known as the Smishing Triad, linking it to more than 194,000 malicious domains since January 2024, and describing a highly decentralised campaign in which attackers register and burn through thousands of domains daily. Check Point researchers documented a parallel wave impersonating US state motor vehicle departments, in which victims received alarming unpaid-violation messages and were funnelled to cloned agency sites that harvested personal information and card credentials.

Fake toll and fine notices are commodity infrastructure now. Adding a small island state costs an operator a template edit and a domain registration.

How to check, in ten seconds

• No unsolicited link is a payment channel. For Saint Lucian traffic tickets, the RSLPF says payment is made in person at the First District Court Office on St. Louis Street, with the physical ticket.
• Read the URL backwards. Find the last dot before the first single slash. In digigov-govt.cam/lc, that is .cam, not .lc. Everything before it can say anything at all.
• Type the address yourself. Reach government services by typing the known address or using an official app, never by following a link you were sent.
• Treat the deadline as the tell. Real enforcement gives you statutory time and a paper trail. Manufactured urgency is the product.
• Do not reply, not even "1."
• Verify by a channel you chose. Call or visit the police or the relevant office using contact details you looked up independently.

If you already clicked

Move on the money first. Contact your bank or card issuer immediately and ask them to block the card and reverse pending transactions, speed materially affects recovery. Change any password you entered, and any password you reuse elsewhere. Report the matter to the police so it enters the record and can be linked to other reports. Keep the message; do not just delete it.

Then brace for the second wave. Victim lists get resold, and "we can recover your money" follow-ups are a well-documented pattern targeting people already known to have paid once.