Beware “bill has been paid, here’s a gift” scam text messages
Scam text messages are thanking recipients for paying their phone or utility bills by claiming to offer them a “little gift” in a social engineering trick designed to lure recipients to spoof websites.
SCAM
Type of Scam: Social Media Phishing
Attack Type: Link to Phishing Website
Social Engineering Technique: Free gifts or prizes
The text messages will appear to come from a well-known company, for example AT&T, Verizon or T-Mobile. An example of such a message is below.
Free Msg: Your bill is paid for March. Thanks, here’s a little gift for you. LINK REMOVED
The suspicious messages are very similar to another text scam that claimed to offer “little gifts” as way of an apology for coverage or signal issues.
In both cases the links in the text messages direct recipients to spoof phishing websites. These websites are designed to look like the legitimate websites of the company the scammers are pretending to be messaging the recipient from.
So if the “little gift” message appeared to come from T-Mobile, for example, then the link will direct to a spoof website designed to look like the T-Mobile website.
But in reality these spoof websites are owned by crooks, and any information entered into them – such as for example your login username and password – is sent straight to the crooks, allowing them to access your online account.
Sponsored Content. Continued below...
And from there the crooks can glean personal information about you, potentially allowing them to open up new phone or utility contracts in your name or to commit other forms of identity fraud.
How to avoid these “little gift” text scams
When it comes to links in text messages, online messages or emails, the advice is always the same. Don’t click them. This way you can avoid the vast majority of phishing scams that will come your way. If you’re not sure a message is legitimate, you can contact the relevant company directly – for example by logging into your online account directly (without clicking links) or contacting them using their contact details you already have.
If you do believe a message is legitimate and you click the link, the next step is to check the web address (URL) at the top to see if it’s the web address of the company. We have more information on spotting fake web addresses that you can read here.
Also be aware of common social engineering tricks used by crooks to lure recipients into clicking links. Text messages or emails offering freebies, prizes or that otherwise seem too good to be true (as well as messages that appeared to be designed to panic you) are always likely to be scams. Read more about avoiding SMS phishing scams in our article here.
Finally, you can report scam texts by forwarding them to 7726 if you’re in the UK, Canada, New Zealand or the United States.
Keep up-to-date with all the latest cybersecurity threats and our tips to stay safe online. Follow us on Facebook, Instagram and Twitter.
Continued below...
Thanks for reading! But before you go… as part of our latest series of articles on how to earn a little extra cash using the Internet (without getting scammed) we have been looking into how you can earn gift vouchers (like Amazon vouchers) using reward-per-action websites such as SwagBucks. If you are interested we even have our own sign-up code to get you started. Want to learn more? We discuss it here. (Or you can just sign-up here and use code Nonsense70SB when registering.)
Become a Facebook Supporter. For 0.99p (~$1.30) a month you can become a Facebook fan, meaning you get an optional Supporter Badge when you comment on our Facebook posts, as well as discounts on our merchandise. You can subscribe here (cancel anytime.)
