Smishing Scams and Sweepstakes

If you received a notification by text that you won a $1,000 Best Buy gift card it could be the result of a Smishing scam. Walmart Smishing scams have also been reported lately that look similar. Smishing is a new kind of scam that is aimed at cell phone users. You get a text that looks like the one below, click on the link, and the site could be full of virus threats and potential risks to your personal and private information.

The Best Buy scam came from phone number 347-687-3897 and I got a second one from 310-383-5804. If you received one from another number, please leave it below and I will add it here in the post.

The URL from 347-687-3897 was www.bestbuycards.net/?id=klwlwkpbck

The URL from 310-383-5804 was www.bestbuy.com/bbcp.biz/?claimid=312

More to look out for:

• 203-402-9445
• 210-501-9193
• 253-237-6143
• 330-595-9008 Best Buy
• 360-550-2346
• 347-602-3525
• 347-618-0592 Best Buy
• 347-735-6856 Best Buy
• 315-413-1800 Best Buy
• 408-634-8916 Best Buy
• 410-610-6050
• 502-744-0418
• 502-572-7305
• 704-550-6229
• 715-513-9858
• 814-483-1398 Best Buy
• 850-390-1761, 757-362-4966, 802-829-9402 Walmart
• 917-756-5288 Best Buy
• 920-750-3051
• 973-454-2547  Best Buy

Smishing stands for SMS (Short Message Service) and is similar to Phishing.

Phishing is attempting to acquire information (and sometimes, indirectly, money) such as usernames, passwords, and credit card details by masquerading as a trustworthy entity in an electronic communication. Communications purporting to be from popular social web sites, auction sites, online payment processors or IT administrators are commonly used to lure the unsuspecting public. From Wikipedia

Smishing is similar but it uses cell phone text messages to deliver the “bait” to get you to divulge your personal information. The “hook”  in the text message may be a website URL, like the one above, but it could also be a phone number that connects to automated voice response system.

How can you tell if something you receive through a text is fake and not a real win?

Examine the URL

If this were a real win from Best Buy or even from a company sponsoring a sweepstakes other than Best Buy but offering a Best Buy gift card as a prize, the URL (link you click on) they send you to would be more like www.bestbuy.com and not www.bestbuycards.net. Also, the ?id=klwlwkpbck also gives it away. They are most likely using a unique ID for each person to track to see if that person responds. Anyone can register a domain name and use a big brand’s name and get by with it, that is, until they are caught.

What should I do if I clicked on the link?

If you were curious enough to find out if you really won a $1,000 Best Buy gift card and clicked on the link, DON’T PANIC! If your cell phone isn’t hooked up to your computer then they can’t send a virus through to harm your computer. I haven’t heard of any viruses that actually attack phones, only computers. But, of course, I could be wrong and there could be viruses for Smartphone that I haven’t heard of yet. If your phone is attached to your computer, just unplug it and run a virus scan.

Make sure you have virus software installed on your computer and it is updated constantly. Virus software has an automatic setting that will update it whenever an update is available so make sure you have it setup that way. I use Free virus software, either AVG or Comodo, and it works perfectly.

If you click on the link, the website is most likely trying to get your personal information. Just don’t fill out the form and don’t give them your information. Anytime a website or even phone message or live caller is asking for your Social Security Number (SSN), to verify a banking account, or to verify your credit or debit card, they are most likely scams. Just don’t give that kind of information out and you should be protected.

Side Note: yes, you will have to give your SSN if you win a large value prize and have to fill out an affidavit but that is completely different. Legitimate sweepstakes can ask for your SSN for tax purposes.

Examine the Wording

Luckily for us, the scammers haven’t quite got the sweepstakes wording down. I can spot a scam quickly because I have been entering sweepstakes for so long that I know what a real win looks like.

The wording in the scam in the picture above reads, you’ve won the $1000 Best Buy Card drawing and the other one I received read, Your entry last month has WON!

To me, that is a big red flag. They aren’t giving the name of the sweepstakes and what the heck is a Best Buy Card drawing? They didn’t include the name of the sweepstakes. It wouldn’t be Best Buy Card drawing but something like, you have won a $1,000 Best Buy card from the XXX Sweepstakes (where XXX is the name of the sweepstakes). Real sweepstakes wins usually use words like Congratulations with the name of the sweepstakes, may come right after you entered by text so you know if you won or not (in the case of an instant win game), come from a verifiable source, and will reference the original entry or sweepstakes. These aren’t the only ways to figure out if a text is legitimate but they are some things to look for.

The more sweepstakes you enter, the better your feel for the real deal will be. If you ever question a win, feel free to email it to me at [email protected] and I will take a look. You can leave a comment on the Facebook page and someone in the sweepstakes community will help you as well. No one wants to see someone else taken by a scammer and if we work together we can help to prevent it.

If you feel that you have been defrauded, you may want to contact the Federal Trade Commission (FTC) at www.ftc.gov or at 1-877-FTC-HELP, or the Consumer Protection Division of your state’s Attorney General’s office.

Read how to tell if a sweepstakes is legitimate and more about Smishing Attacks.

Read more about Walmart scams on Twitter, Facebook, and by text.