Scammers are targeting customers as they file their Income Tax Returns; Beware of a new tax SMS scam

Scams involving online banks are not new and have been reported in recent years. Scammers deceive people by sending bogus alerts about KYC, credit card, or bank updates. They specifically target persons coping with pressing issues such as PAN updates. Similar to the phoney PAN update fraud, a new scam is spreading in which scammers target people who are busy submitting their income tax forms.

Scammers are taking advantage of the ongoing Income Tax Return completion process and targeting Indian account holders through tax-time smishing tactics in an ongoing scam. They are sending bogus text messages to bank account holders that look to be from well-known Indian banks in order to deceive consumers into disclosing personal information.

According to a Sophos report, scammers are sending phoney text messages claiming that the recipient’s bank account will be stopped and asking them to update their PAN and AADHAR card information on their accounts. These text messages also provide a link to download an Android Package (APK) file. When the programme is linked with an APK file, it looks similar to the real bank application, and users are misled into entering their banking data in the phoney app to steal money.

“This not only exploits recipients but also bank brands. The APK then attempts to obtain the recipient’s login, password, debit card number, and ATM pin,” according to the investigation.

While fake bank SMS scams have occurred in the past, it is critical to be vigilant this time since consumers may mistake them for real SMS while checking their account details via online banking or banking applications during the income tax return filing period.

What exactly is the tax-time smishing scam?

Scammers target consumers during the income tax return filing season in situations of tax time smishing scams. Scammers send phoney text messages that appear to be from the recipient’s bank and contain a link to a malicious Android Package (APK) file. Once installed, the APK launches false bank login screens that appear to be legitimate. If the receiver submits any personal information on these pages, the information is routed to a remote server held by the attackers rather than the bank. The malicious APK can also read incoming SMS texts and perhaps retrieve OTP codes supplied by the bank.

How to Avoid Tax-Time Smishing Scams?

Be cautious of texts pretending to be from your bank and requesting personal or financial information. To exchange information, banks will never contact you by text messages, messaging applications, or social media.

When receiving unwanted text messages or attachments, be cautious and confirm the sender’s identity before opening or downloading any files.

If you receive an unexpected message “from your bank” or another service provider, contact them immediately by phone, using the business’s authentic, secure website or applications, or by visiting the nearest branch.

If you have received such SMS, you can report the scams by sending the email or a copy of the text/SMS as an attachment to phishing@irs.gov.