{"id":162,"date":"2025-12-19T09:14:44","date_gmt":"2025-12-19T09:14:44","guid":{"rendered":"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/sms-phishers-pivot-to-points-taxes-fake-retailers\/"},"modified":"2025-12-19T09:14:44","modified_gmt":"2025-12-19T09:14:44","slug":"sms-phishers-pivot-to-points-taxes-fake-retailers","status":"publish","type":"post","link":"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/sms-phishers-pivot-to-points-taxes-fake-retailers\/","title":{"rendered":"SMS Phishers Pivot to Points, Taxes, Fake Retailers"},"content":{"rendered":"<div>\n<p>China-based phishing groups blamed for non-stop scam SMS messages about a supposed wayward package or unpaid toll fee are promoting a new offering, just in time for the holiday shopping season: Phishing kits for mass-creating fake but convincing e-commerce websites that convert customer payment card data into mobile wallets from Apple and Google. Experts say these same phishing groups also are now using SMS lures that promise unclaimed tax refunds and mobile rewards points.<\/p>\n<p>Over the past week, thousands of domain names were registered for scam websites that purport to offer <strong>T-Mobile<\/strong> customers the opportunity to claim a large number of rewards points. The phishing domains are being promoted by scam messages sent via Apple\u2019s iMessage service or the functionally equivalent RCS messaging service built into Google phones.<\/p>\n<div id=\"attachment_72772\" style=\"width: 419px\" class=\"wp-caption aligncenter\"><img aria-describedby=\"caption-attachment-72772\" decoding=\"async\" loading=\"lazy\" class=\"size-full wp-image-72772\" src=\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2025\/12\/tmobpoints-smish.png\" alt=\"\" width=\"409\" height=\"804\"><\/p>\n<p id=\"caption-attachment-72772\" class=\"wp-caption-text\">An instant message spoofing T-Mobile says the recipient is eligible to claim thousands of rewards points.<\/p>\n<\/div>\n<p>The website scanning service <strong>urlscan.io<\/strong> <a href=\"http:\/\/urlscan.io\/result\/019a609e-8dda-7612-a4b1-a6fe2c0bff6d\" target=\"_blank\" rel=\"noopener\">shows<\/a> thousands of these phishing domains have been deployed in just the past few days alone. The phishing websites will only load if the recipient visits with a mobile device, and they ask for the visitor\u2019s name, address, phone number and payment card data to claim the points.<\/p>\n<div id=\"attachment_72775\" style=\"width: 760px\" class=\"wp-caption aligncenter\"><img aria-describedby=\"caption-attachment-72775\" decoding=\"async\" loading=\"lazy\" class=\" wp-image-72775\" src=\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2025\/12\/tmob-points-site.png\" alt=\"\" width=\"750\" height=\"563\" srcset=\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2025\/12\/tmob-points-site.png 893w, https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2025\/12\/tmob-points-site-768x576.png 768w, https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2025\/12\/tmob-points-site-782x587.png 782w\" sizes=\"auto, (max-width: 750px) 100vw, 750px\"><\/p>\n<p id=\"caption-attachment-72775\" class=\"wp-caption-text\">A phishing website registered this week that spoofs T-Mobile.<\/p>\n<\/div>\n<p>If card data is submitted, the site will then prompt the user to share a one-time code sent via SMS by their financial institution. In reality, the bank is sending the code because the fraudsters have just attempted to enroll the victim\u2019s phished card details in a mobile wallet from Apple or Google. If the victim also provides that one-time code, the phishers can then <a href=\"https:\/\/krebsonsecurity.com\/2025\/02\/how-phished-data-turns-into-apple-google-wallets\/\" target=\"_blank\" rel=\"noopener\">link the victim\u2019s card to a mobile device that they physically control<\/a>.<span id=\"more-72622\"><\/span><\/p>\n<p>Pivoting off these T-Mobile phishing domains in urlscan.io reveals a similar scam targeting <strong>AT&amp;T<\/strong> customers:<\/p>\n<div id=\"attachment_72774\" style=\"width: 759px\" class=\"wp-caption aligncenter\"><img aria-describedby=\"caption-attachment-72774\" decoding=\"async\" loading=\"lazy\" class=\" wp-image-72774\" src=\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2025\/12\/att-smish.png\" alt=\"\" width=\"749\" height=\"558\" srcset=\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2025\/12\/att-smish.png 894w, https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2025\/12\/att-smish-768x572.png 768w, https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2025\/12\/att-smish-782x583.png 782w\" sizes=\"auto, (max-width: 749px) 100vw, 749px\"><\/p>\n<p id=\"caption-attachment-72774\" class=\"wp-caption-text\">An SMS phishing or \u201csmishing\u201d website targeting AT&amp;T users.<\/p>\n<\/div>\n<p><strong>Ford Merrill<\/strong> works in security research at\u00a0<a href=\"https:\/\/www.secalliance.com\/\" target=\"_blank\" rel=\"noopener\">SecAlliance<\/a>, a\u00a0<a href=\"https:\/\/www.csis.com\/\" target=\"_blank\" rel=\"noopener\">CSIS Security Group<\/a> company. Merrill said multiple China-based cybercriminal groups that sell phishing-as-a-service platforms have been using the mobile points lure for some time, but the scam has only recently been pointed at consumers in the United States.<\/p>\n<p>\u201cThese points redemption schemes have not been very popular in the U.S., but have been in other geographies like EU and Asia for a while now,\u201d Merrill said.<\/p>\n<p>A review of other domains flagged by urlscan.io as tied to this Chinese SMS phishing syndicate shows they are also spoofing U.S. state tax authorities, telling recipients they have an unclaimed tax refund. Again, the goal is to phish the user\u2019s payment card information and one-time code.<\/p>\n<div id=\"attachment_72776\" style=\"width: 405px\" class=\"wp-caption aligncenter\"><img aria-describedby=\"caption-attachment-72776\" decoding=\"async\" loading=\"lazy\" class=\"size-full wp-image-72776\" src=\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2025\/12\/dctaxphish.png\" alt=\"\" width=\"395\" height=\"842\"><\/p>\n<p id=\"caption-attachment-72776\" class=\"wp-caption-text\">A text message that spoofs the District of Columbia\u2019s Office of Tax and Revenue.<\/p>\n<\/div>\n<h2>CAVEAT EMPTOR<\/h2>\n<p>Many SMS phishing or \u201csmishing\u201d domains are quickly flagged by browser makers as malicious. But Merrill said one burgeoning area of growth for these phishing kits \u2014 fake e-commerce shops \u2014 can be far harder to spot because they do not call attention to themselves by spamming the entire world.<\/p>\n<p>Merrill said the same Chinese phishing kits used to blast out package redelivery message scams are equipped with modules that make it simple to quickly deploy a fleet of fake but convincing e-commerce storefronts. Those phony stores are typically advertised on <strong>Google<\/strong> and <strong>Facebook<\/strong>, and consumers usually end up at them by searching online for deals on specific products.<\/p>\n<div id=\"attachment_72789\" style=\"width: 760px\" class=\"wp-caption alignnone\"><img aria-describedby=\"caption-attachment-72789\" decoding=\"async\" loading=\"lazy\" class=\" wp-image-72789\" src=\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2025\/12\/fake-ecom.png\" alt=\"\" width=\"750\" height=\"270\" srcset=\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2025\/12\/fake-ecom.png 1146w, https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2025\/12\/fake-ecom-768x276.png 768w, https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2025\/12\/fake-ecom-782x281.png 782w\" sizes=\"auto, (max-width: 750px) 100vw, 750px\"><\/p>\n<p id=\"caption-attachment-72789\" class=\"wp-caption-text\">A machine-translated screenshot of an ad from a China-based phishing group promoting their fake e-commerce shop templates.<\/p>\n<\/div>\n<p>With these fake e-commerce stores, the customer is supplying their payment card and personal information as part of the normal check-out process, which is then punctuated by a request for a one-time code sent by your financial institution. The fake shopping site claims the code is required by the user\u2019s bank to verify the transaction, but it is sent to the user because the scammers immediately attempt to enroll the supplied card data in a mobile wallet.<\/p>\n<p>According to Merrill, it is only during the check-out process that these fake shops will fetch the malicious code that gives them away as fraudulent, which tends to make it difficult to locate these stores simply by mass-scanning the web. Also, most customers who pay for products through these sites don\u2019t realize they\u2019ve been snookered until weeks later when the purchased item fails to arrive.<\/p>\n<p>\u201cThe fake e-commerce sites are tough because a lot of them can fly under the radar,\u201d Merrill said. \u201cThey can go months without being shut down, they\u2019re hard to discover, and they generally don\u2019t get flagged by safe browsing tools.\u201d<\/p>\n<p>Happily, reporting these SMS phishing lures and websites is one of the fastest ways to get them properly identified and shut down. <strong>Raymond Dijkxhoorn<\/strong>\u00a0is the CEO and a founding member of\u00a0<a href=\"https:\/\/www.surbl.org\/\" target=\"_blank\" rel=\"noopener\">SURBL<\/a>, a widely-used blocklist that flags domains and IP addresses known to be used in unsolicited messages, phishing and malware distribution. SURBL has created a website called <a href=\"https:\/\/smishreport.com\/\" target=\"_blank\" rel=\"noopener\">smishreport.com<\/a> that asks users to forward a screenshot of any smishing message(s) received.<\/p>\n<p>\u201cIf [a domain is] unlisted, we can find and add the new pattern and kill the rest\u201d of the matching domains, <strong>Dijkxhoorn <\/strong>said. \u201cJust make a screenshot and upload. The tool does the rest.\u201d<\/p>\n<div id=\"attachment_72786\" style=\"width: 367px\" class=\"wp-caption aligncenter\"><img aria-describedby=\"caption-attachment-72786\" decoding=\"async\" loading=\"lazy\" class=\"size-full wp-image-72786\" src=\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2025\/12\/smishreport.png\" alt=\"\" width=\"357\" height=\"772\"><\/p>\n<p id=\"caption-attachment-72786\" class=\"wp-caption-text\">The SMS phishing reporting site smishreport.com.<\/p>\n<\/div>\n<p>Merrill said the last few weeks of the calendar year typically see a big uptick in smishing \u2014 particularly package redelivery schemes that spoof the <strong>U.S. Postal Service<\/strong> or commercial shipping companies.<\/p>\n<p>\u201cEvery holiday season there is an explosion in smishing activity,\u201d he said. \u201cEveryone is in a bigger hurry, frantically shopping online, paying less attention than they should, and they\u2019re just in a better mindset to get phished.\u201d<\/p>\n<h2>SHOP ONLINE LIKE A SECURITY PRO<\/h2>\n<p>As we can see, adopting a shopping strategy of simply buying from the online merchant with the lowest advertised prices can be a bit like playing Russian Roulette with your wallet. Even people who shop mainly at big-name online stores <a href=\"https:\/\/krebsonsecurity.com\/2017\/04\/how-cybercrooks-put-the-beatdown-on-my-beats\/\" target=\"_blank\" rel=\"noopener\">can get scammed<\/a> if they\u2019re not wary of too-good-to-be-true offers (think third-party sellers on these platforms).<\/p>\n<p>If you don\u2019t know much about the online merchant that has the item you wish to buy, take a few minutes to investigate its reputation. If you\u2019re buying from an online store that is brand new, the risk that you will get scammed increases significantly. How do you know the lifespan of a site selling that must-have gadget at the lowest price? One easy way to get a quick idea is to run <a title=\"http:\/\/whois.domaintools.com\/krebsonsecurity.com\" href=\"http:\/\/whois.domaintools.com\/krebsonsecurity.com\">a basic WHOIS search<\/a>\u00a0on the site\u2019s domain name. The more recent the site\u2019s \u201ccreated\u201d date, the more likely it is a phantom store.<\/p>\n<p>If you receive a message warning about a problem with an order or shipment, visit the e-commerce or shipping site directly, and avoid clicking on links or attachments \u2014 particularly missives that warn of some dire consequences unless you act quickly. Phishers and malware purveyors typically seize upon some kind of emergency to create a false alarm that often causes recipients to temporarily let their guard down.<\/p>\n<p>But it\u2019s not just outright scammers who can trip up your holiday shopping: Often times, items that are advertised at steeper discounts than other online stores make up for it by charging way more than normal for shipping and handling.<\/p>\n<p>So be careful what you agree to: Check to make sure you know how long the item will take to be shipped, and that you understand the store\u2019s return policies. Also, keep an eye out for hidden surcharges, and be wary of blithely clicking \u201cok\u201d during the checkout process.<\/p>\n<p>Most importantly, keep a close eye on your monthly statements. If I were a fraudster, I\u2019d most definitely wait until the holidays to cram through a bunch of unauthorized charges on stolen cards, so that the bogus purchases would get buried amid a flurry of other legitimate transactions. That\u2019s why it\u2019s key to closely review your credit card bill and to quickly dispute any charges you didn\u2019t authorize.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>China-based phishing groups blamed for non-stop scam SMS messages about a supposed wayward package or unpaid toll fee are promoting a new offering, just in time for the holiday shopping season: Phishing kits for mass-creating fake but convincing e-commerce websites that convert customer payment card data into mobile wallets from Apple and Google. Experts say [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-container-style":"default","site-container-layout":"default","site-sidebar-layout":"default","disable-article-header":"default","disable-site-header":"default","disable-site-footer":"default","disable-content-area-spacing":"default","footnotes":""},"categories":[113,146,90,147,143,148,149,150,144,151,145],"tags":[91],"class_list":["post-162","post","type-post","status-publish","format-standard","hentry","category-a-little-sunshine","category-att","category-cybersecurity","category-ford-merrill","category-latest-warnings","category-raymond-dijkxhoorn","category-surbl","category-t-mobile","category-tax-refund-fraud","category-urlscan-io","category-web-fraud-2-0","tag-cybersecurity"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v26.7 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>SMS Phishers Pivot to Points, Taxes, Fake Retailers - Imperative Business Ventures Limited<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/sms-phishers-pivot-to-points-taxes-fake-retailers\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"SMS Phishers Pivot to Points, Taxes, Fake Retailers - Imperative Business Ventures Limited\" \/>\n<meta property=\"og:description\" content=\"China-based phishing groups blamed for non-stop scam SMS messages about a supposed wayward package or unpaid toll fee are promoting a new offering, just in time for the holiday shopping season: Phishing kits for mass-creating fake but convincing e-commerce websites that convert customer payment card data into mobile wallets from Apple and Google. Experts say [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/sms-phishers-pivot-to-points-taxes-fake-retailers\/\" \/>\n<meta property=\"og:site_name\" content=\"Imperative Business Ventures Limited\" \/>\n<meta property=\"article:published_time\" content=\"2025-12-19T09:14:44+00:00\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/sms-phishers-pivot-to-points-taxes-fake-retailers\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/sms-phishers-pivot-to-points-taxes-fake-retailers\/\"},\"author\":{\"name\":\"admin\",\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02\"},\"headline\":\"SMS Phishers Pivot to Points, Taxes, Fake Retailers\",\"datePublished\":\"2025-12-19T09:14:44+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/sms-phishers-pivot-to-points-taxes-fake-retailers\/\"},\"wordCount\":1357,\"image\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/sms-phishers-pivot-to-points-taxes-fake-retailers\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2025\/12\/tmobpoints-smish.png\",\"keywords\":[\"Cybersecurity\"],\"articleSection\":[\"A Little Sunshine\",\"AT&amp;T\",\"Cybersecurity\",\"Ford Merrill\",\"Latest Warnings\",\"Raymond Dijkxhoorn\",\"SURBL\",\"T-Mobile\",\"Tax Refund Fraud\",\"urlscan.io\",\"Web Fraud 2.0\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/sms-phishers-pivot-to-points-taxes-fake-retailers\/\",\"url\":\"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/sms-phishers-pivot-to-points-taxes-fake-retailers\/\",\"name\":\"SMS Phishers Pivot to Points, Taxes, Fake Retailers - Imperative Business Ventures Limited\",\"isPartOf\":{\"@id\":\"https:\/\/blog.ibvl.in\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/sms-phishers-pivot-to-points-taxes-fake-retailers\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/sms-phishers-pivot-to-points-taxes-fake-retailers\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2025\/12\/tmobpoints-smish.png\",\"datePublished\":\"2025-12-19T09:14:44+00:00\",\"author\":{\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02\"},\"breadcrumb\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/sms-phishers-pivot-to-points-taxes-fake-retailers\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/sms-phishers-pivot-to-points-taxes-fake-retailers\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/sms-phishers-pivot-to-points-taxes-fake-retailers\/#primaryimage\",\"url\":\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2025\/12\/tmobpoints-smish.png\",\"contentUrl\":\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2025\/12\/tmobpoints-smish.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/sms-phishers-pivot-to-points-taxes-fake-retailers\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/blog.ibvl.in\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"SMS Phishers Pivot to Points, Taxes, Fake Retailers\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/blog.ibvl.in\/#website\",\"url\":\"https:\/\/blog.ibvl.in\/\",\"name\":\"Imperative Business Ventures Limited\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/blog.ibvl.in\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g\",\"caption\":\"admin\"},\"sameAs\":[\"https:\/\/blog.ibvl.in\"],\"url\":\"https:\/\/blog.ibvl.in\/index.php\/author\/admin_hcbs9yw6\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"SMS Phishers Pivot to Points, Taxes, Fake Retailers - Imperative Business Ventures Limited","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/sms-phishers-pivot-to-points-taxes-fake-retailers\/","og_locale":"en_US","og_type":"article","og_title":"SMS Phishers Pivot to Points, Taxes, Fake Retailers - Imperative Business Ventures Limited","og_description":"China-based phishing groups blamed for non-stop scam SMS messages about a supposed wayward package or unpaid toll fee are promoting a new offering, just in time for the holiday shopping season: Phishing kits for mass-creating fake but convincing e-commerce websites that convert customer payment card data into mobile wallets from Apple and Google. Experts say [&hellip;]","og_url":"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/sms-phishers-pivot-to-points-taxes-fake-retailers\/","og_site_name":"Imperative Business Ventures Limited","article_published_time":"2025-12-19T09:14:44+00:00","author":"admin","twitter_card":"summary_large_image","twitter_misc":{"Written by":"admin","Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/sms-phishers-pivot-to-points-taxes-fake-retailers\/#article","isPartOf":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/sms-phishers-pivot-to-points-taxes-fake-retailers\/"},"author":{"name":"admin","@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02"},"headline":"SMS Phishers Pivot to Points, Taxes, Fake Retailers","datePublished":"2025-12-19T09:14:44+00:00","mainEntityOfPage":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/sms-phishers-pivot-to-points-taxes-fake-retailers\/"},"wordCount":1357,"image":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/sms-phishers-pivot-to-points-taxes-fake-retailers\/#primaryimage"},"thumbnailUrl":"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2025\/12\/tmobpoints-smish.png","keywords":["Cybersecurity"],"articleSection":["A Little Sunshine","AT&amp;T","Cybersecurity","Ford Merrill","Latest Warnings","Raymond Dijkxhoorn","SURBL","T-Mobile","Tax Refund Fraud","urlscan.io","Web Fraud 2.0"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/sms-phishers-pivot-to-points-taxes-fake-retailers\/","url":"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/sms-phishers-pivot-to-points-taxes-fake-retailers\/","name":"SMS Phishers Pivot to Points, Taxes, Fake Retailers - Imperative Business Ventures Limited","isPartOf":{"@id":"https:\/\/blog.ibvl.in\/#website"},"primaryImageOfPage":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/sms-phishers-pivot-to-points-taxes-fake-retailers\/#primaryimage"},"image":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/sms-phishers-pivot-to-points-taxes-fake-retailers\/#primaryimage"},"thumbnailUrl":"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2025\/12\/tmobpoints-smish.png","datePublished":"2025-12-19T09:14:44+00:00","author":{"@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02"},"breadcrumb":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/sms-phishers-pivot-to-points-taxes-fake-retailers\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/sms-phishers-pivot-to-points-taxes-fake-retailers\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/sms-phishers-pivot-to-points-taxes-fake-retailers\/#primaryimage","url":"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2025\/12\/tmobpoints-smish.png","contentUrl":"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2025\/12\/tmobpoints-smish.png"},{"@type":"BreadcrumbList","@id":"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/sms-phishers-pivot-to-points-taxes-fake-retailers\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/blog.ibvl.in\/"},{"@type":"ListItem","position":2,"name":"SMS Phishers Pivot to Points, Taxes, Fake Retailers"}]},{"@type":"WebSite","@id":"https:\/\/blog.ibvl.in\/#website","url":"https:\/\/blog.ibvl.in\/","name":"Imperative Business Ventures Limited","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/blog.ibvl.in\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02","name":"admin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g","caption":"admin"},"sameAs":["https:\/\/blog.ibvl.in"],"url":"https:\/\/blog.ibvl.in\/index.php\/author\/admin_hcbs9yw6\/"}]}},"_links":{"self":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/posts\/162","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/comments?post=162"}],"version-history":[{"count":0,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/posts\/162\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/media?parent=162"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/categories?post=162"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/tags?post=162"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}