SMS Phishers Pivot to Points, Taxes, Fake Retailers

China-based phishing groups are pivoting to mass-creating fake e-commerce websites that steal payment card data to feed mobile wallets, while also using SMS lures promising unclaimed tax refunds and rewards points, the Krebs on Security piece reports. In the past week thousands of scam domains purporting to offer T-Mobile rewards points have been registered and promoted via Apple iMessage and Google’s RCS, with the sites only loading on mobile devices and requesting personal and card details to claim points.

The fraud then prompts for a one-time code sent by the bank, which the thieves use to enrol the card in a mobile wallet; similar domains are targeting AT&T customers as well. According to SURBL, the researchers behind the campaign warn that these fake stores can be hard to spot and may fly under the radar for months before being shut down. The article also notes that reporting smishing attempts via smishreport[.]com is one of the fastest ways to get them identified and blocked.