![\"Scam](\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2025\/03\/scam-text-message-emoji-purple-bg-600x300-1.png\")
<\/p>\n<\/p>\n
Scammers continue to escalate their efforts to defraud people via unsolicited text messages. This week, two types of scam messages have been prevalent. One of the latest scams involves an alleged tax refund<\/strong>. Additionally, texts claiming that the recipient owes toll fees<\/strong> are prevalent.<\/p>\n Phishing scams delivered via text message are sometimes referred to as “smishing” (or “smshing”). While short for “SMS phishing,” such scams are increasingly being delivered via other texting platforms besides the old SMS standard. Notably, we have observed an increase in scams sent over Apple’s iMessage service in recent months.<\/strong> Both of this week’s most common text scams often arrive via iMessage.<\/p>\n Here’s how you can recognize, avoid, and report these scams.<\/p>\n In this article:<\/em><\/p>\n Tax-related scams are certainly nothing new; but Californians are currently being hit with a new version. California residents, and potentially others with a California area code, may receive messages like the one below.<\/p>\n Phishing text message claiming to be from the California Franchise Tax Board.<\/p><\/div>\n This particular example says:<\/p>\n STATE OF CALIFORNIA Franchise Tax Board (FTB)<\/p>\n Your California tax refund of [$1,050] will permanently expire on [03\/[current date]<\/em>\/2025]. Failure to submit the required documentation by the deadline will result in the forfeiture of your payment to the State of California. To prevent unnecessary loss, please address this matter promptly:<\/p>\n https:\/\/ftb.gov-checking-[random characters]<\/em>.[top or cfd]<\/em>\/us<\/p>\n (Please reply Y, then exit the text message and open it again to activate the link, or copy the link into your Safari browser and open it)<\/p>\n California Franchise Tax Board | Sacramento, CA | Official State Agency<\/p><\/blockquote>\n Note that the domain isn’t ftb.gov (which, in fact, isn’t a real site anyway; California’s Franchise Tax Board site is at ftb.ca.gov). Rather, the hyphen immediately after the .gov part of the URL is an indication that the sender is trying to be tricky. (We have previously reported about scam links using a deceptive hyphen instead of a slash<\/a>.) The real domain in this case would be gov-checking-randomcharacters<\/em>.cfd (or .top); the “ftb.” part at the beginning is just a subdomain, or a subsection of the main site.<\/p>\n California’s real Franchise Tax Board has issued its own statement<\/a> about these scam messages.<\/p>\n Web addresses found in any similar messages will lead to phishing scam sites. They’re often designed to mimic real forms, in an attempt to steal your personal information. Data collected through such forms may be used to commit financial fraud.<\/a><\/p>\n Another common text message scam this week involves allegations of toll evasion, or late fees for usage of toll roads. Again, many such messages often arrive via iMessage. Following are a few recent examples:<\/p>\n Final Notice: Toll Road Payment Needed https:\/\/fastrak.org-[random characters]<\/em>.xin\/pay<\/p>\n Take action today to avoid these outcomes. Your attention is appreciated! <\/p>\n The Toll Roads Notice of Toll Evasion: You have an unpaid toll bill on your account. To avoid late fees, pay within 12 hours or the late fees will be increased and reported to the DMV.<\/p>\n https:\/\/www.ezdrivemasa[.]xin\/us<\/p>\n \u2026 The Toll Roads team wishes you a great day!<\/p><\/blockquote>\n <\/p>\n E-ZPass Final Reminder: https:\/\/e-zpassny.com-[random characters]<\/em>.xin\/us<\/p>\n \u2026 Please settle your toll immediately after reading this message to avoid penalties for delaying the payment. Recent versions of these scams tend to have a lot in common. They are often delivered via iMessage; they might come from a U.S. area code, or from a +66 (Philippines) or +44 (UK) country code, or from an e-mail address. Often they reuse the line about replying, exiting, and reopening the message to activate the link. The top-level domain (the “dot something” at the end) that’s most common this week is “.xin”\u2014a Chinese TLD.<\/a><\/p>\n As we’ve noted throughout this article, scammers are increasingly sending text messages like these through Apple’s own iMessage system. In theory, it should be more difficult to set up a plethora of Apple Accounts\u2014especially ones attached to unique telephone numbers. And yet, somehow, scammers keep getting away with it.<\/span><\/p>\n One would think that after many users have reported similar scam messages to Apple that the company would put filters in place to block such messages from being sent\u2014especially in bulk. Additionally, most of these messages reuse the same chunks of text, without any variation; it should be easy for Apple to filter out common scam instructions like replying and reopening the message to enable links, for example.<\/span><\/p>\n We reached out to Apple to ask what, if anything, the company is doing to improve the situation. Apple has not yet responded to our inquiry.<\/span><\/a><\/p>\n If you enter personal information on a phishing site, be sure to immediately report it to the authorities. Go to the Internet Crime Complaint Center (ic3.gov<\/a>) and click File A Complaint.<\/p>\n Even if you haven’t fallen for a scam, it’s important to report it to Apple and your mobile carrier. This can, in theory, help them block similar scam messages in the future.<\/p>\n Whenever you get a text message that you’re confident is a scam, tap on “Report Junk.” You’ll be asked to confirm; “Report this conversation as junk by sending it to [your carrier] and Apple from your phone number.” Tap the “Delete and Report Junk” button to proceed.<\/p>\n <\/a><\/p>\n We’ve previously covered tons of similar scams<\/a>; check out these articles for additional details:<\/p>\n You can also subscribe to our e-mail newsletter<\/strong><\/a> and keep an eye here on The Mac Security Blog<\/strong><\/a> for the latest Apple security and privacy news. And don’t forget to follow Intego on your favorite social media channels: Scammers are increasingly exploiting iMessage to send phishing texts; why has Apple not put a stop to this? The most common scams this week involve tax refunds and toll road payments; we explain how to spot and report them.<\/p>\n","protected":false},"author":14,"featured_media":103505,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"spay_email":"","jetpack_publicize_message":"","jetpack_is_tweetstorm":false},"categories":[13],"tags":[4039,116],"yoast_head":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\t\n\t\n\n\n\n\t\n\t\n\t\n\n
Tax scams: California Franchise Tax Board (FTB) refund<\/h3>\n
![\"Phishing](\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2025\/03\/California-Franchise-Tax-Board-iMessage-text-message-scam-202503.jpg\")
Toll scams: E-ZPass, FasTrak, EZDriveMA, The Toll Roads<\/h3>\n
\nPlease settle your toll fees by [current date]<\/em>, to avoid potential penalties such as:
\nSuspension of vehicle registration
\nPossible fines
\nCredit score repercussions<\/p>\n
\n(Please reply Y, then exit the SMS and open it again to activate the link, or copy the link to your Safari browser and open it)<\/p><\/blockquote>\n
\nYou have an outstanding toll.Your toll account balance is outstanding. If you fail to pay by March 24, 2025. You will be penalized or subject to legal action.
\nNow Payment:<\/p>\n
\nThank you for your cooperation.<\/p><\/blockquote>\nWhy is Apple failing to block so many iMessage scams?<\/h3>\n
What should I do if I receive a scam text message?<\/h3>\n
![\"\"](\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2024\/12\/Delete-and-Report-Junk.jpg\")
<\/p>\nHow can I learn more?<\/h3>\n
\n
![\"\"](\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2021\/04\/intego-podcast-artwork-400.jpg\")
<\/a>Each week on the Intego Mac Podcast<\/strong><\/a>, Intego’s Mac security experts discuss the latest Apple news, including security and privacy stories, and offer practical advice on getting the most out of your Apple devices. Be sure to follow the podcast<\/strong><\/a> to make sure you don\u2019t miss any episodes.<\/p>\n![\"Follow](\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2024\/03\/X-Twitter-logo-icon-225.gif\" "\\"Follow"){kind=icon}
<\/a>\u00a0![\"Follow](\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2024\/03\/Facebook-logo-icon-225.gif\" "\\"Follow"){kind=icon}
<\/a>\u00a0![\"Follow](\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2024\/03\/YouTube-logo-icon-225.png\" "\\"Follow"){kind=icon}
<\/a>\u00a0![\"Follow](\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2024\/03\/LinkedIn-logo-icon-225.gif\" "\\"Follow"){kind=icon}
<\/a>\u00a0![\"Follow](\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2024\/03\/Pinterest-logo-icon-225.png\" "\\"Follow"){kind=icon}
<\/a>\u00a0![\"Follow](\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2024\/03\/Instagram-logo-icon-225.gif\" "\\"Follow"){kind=icon}
<\/a>\u00a0![\"Follow](\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2017\/10\/ios9-podcasts-app-tile.png\" "\\"Follow")
<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"