Tax refund scam targets Californians

The State of California Franchise Tax Board (FTB) recently issued a warning to taxpayers about a text-message scam that impersonates the FTB and directs recipients to fraudulent versions of FTB web pages designed to steal personal and banking information. The scam text claims a tax refund has been processed and approved and pressures recipients to provide collection information before a set deadline, with promises of a quick deposit or paper check.

The article notes that the campaign uses domains such as ftb[.]ca, ftb[.]gov, or ftb[.]cagov in links to look legitimate, while actually prompting victims to reveal sensitive data. It also provides signs to spot the scam, including suspicious domains, urgent language, requests for banking details, and instructions to open links in particular ways, such as replying with ‘Y’ or pasting links into Safari.

Malwarebytes urges vigilance and recommends keeping devices updated and using anti-malware protection, with Scam Guard available to verified Malwarebytes users. Indicators listed include several ftb subdomains that have appeared in this campaign.