Cyber Sleuths Investigate Northern Ireland’s Weblink Security Mystery

Summary

• A misprinted web address went out on Northern Ireland rates bills. About 295,000 ratepayers received letters with an incorrect link for payment information.
• The domain was not government-owned. A security expert said the site tried to download malware.
• Stormont asked cyber police to investigate. Land and Property Services reported the site to Action Fraud.
• The error has been fixed. Future bills drop the misprinted link, and officials pointed people to the correct address.

A typo with security consequences

Northern Ireland’s Department of Finance asked cyber security police in April 2025 to look into a fake website whose address was mistakenly printed on rates bills. It was a typo. An earlier version of this article wrongly described this as a hack of Northern Ireland’s parliamentary network that compromised members’ accounts; no such attack was reported, and the article has been corrected.

What went wrong

Land and Property Services (LPS), which collects rates, said an incorrect link appeared on the second page of one version of the bills sent to about 295,000 ratepayers. The web address looked similar to the official NI Direct site, but the domain was not government-owned. LPS reported the site to Action Fraud, the UK’s national fraud and cybercrime reporting centre.

Malware concerns

Prof Kevin Curran, a professor of cyber security at Ulster University, examined the address for BBC News NI. He said it led to a site that “tried to download malware.”

Collaboration for Resolution

“What we have a case of here is typo-squatting or cyber-squatting,” Curran told the BBC. He explained that scammers register look-alike domain names hoping people will mistype or misread an address, and that some sites simply try to earn advertising revenue from the clicks.

What officials did

LPS apologized and removed the misprint from future bills. Officials asked people who type the address directly to use www.nidirect.gov.uk/rates. Curran said government IT teams should watch for these issues and get the fake site taken down.

How to protect yourself

If a printed letter sends you to a website, check the address carefully. Better yet, search for the official site or type the address you already know, never download anything a payment page pushes at you, and report anything that looks off to Action Fraud or your bank.

The lesson for government

A single misprinted link on hundreds of thousands of bills shows how easily a clerical mistake can become a security risk. Typo-squatters count on it. Organizations that send mass mailings can protect customers by proofreading every link and registering look-alike domains first.

Dan Evert, CCNP

Dan Evert is a self proclaimed Router Jockey. Dan got heavily involved in networking right out of high school and has never looked back! Dan is giving back by working with high school students to get them involved and interested in Networking and Security.