{“lastseen”:”2025-09-02T14:59:41″,”description”:”The State of California Franchise Tax Board (FTB) recently issued a warning to taxpayers to protect themselves from tax scams. In their warning the FTB states:\\n\\n\\u003e \u201cRecently, the FTB received reports of a scam targeting taxpayers through text messages that appear to be from FTB. These text messages contain a link to a fraudulent version of certain FTB web pages, which are designed to steal personal and banking information. The scam aims to trick taxpayers into providing personal details and credit card information.\u201d\\n\\nAs if to prove their point, one of my co-workers received this text message.\\n\\n\\n\\n\\u003e \u201cState of California Franchise Tax Board (FTB)\\n\\u003e \\n\\u003e Your tax refund claim has been processed and approved. Please provide your accurate collection information before September 01, 2025.\\n\\u003e \\n\\u003e We will deposit the money into your bank account or email paper check within 1-2 working days.\\n\\u003e \\n\\u003e {link}\\n\\u003e \\n\\u003e Failure to submit required payment information by September 01, 2025 will result in permanent forfeiture of this refund under California Revenue and Taxation Code Section 19322.\\n\\u003e \\n\\u003e Just reply with ‘Y’, then close and reopen the message to make the link work. If that doesn’t do it, copy the link and paste it straight into Safari.\\n\\u003e \\n\\u003e California Franchise Tax Board|Sacramento, CA|Official State Agency\u201d\\n\\nThe links that we found for this campaign are designed to look legitimate by using ftb.ca, ftb.gov, or ftb.cagov in the URL. The sites are designed to mimic the official version of certain FTB web pages, but in reality they are designed to steal your personal and banking information.\\n\\n## How to tell if a message is a scam\\n\\nThis type of scam is not limited to California or even to tax returns, so this advice is good for everyone. Here are some scammy signs to watch out for:\\n\\n * **Suspicious domain names:** Official tax authorities only use domains ending in \\”.gov\\”. Any link leading to \\”ftb.ca-nt.cc\\” or other odd-looking domains is a major red flag. \\n * **Urgent or threatening language:** Scammers often try to rush recipients with claims like \\”permanent forfeiture of your refund\\” and tight deadlines.\\n * **Requests for sensitive personal or financial information:** Legitimate agencies never ask for bank account info or other private details via text message.\\n * **Promised instant rewards:** Messages offering immediate deposits should not be trusted.\\n * **Odd instructions for opening links:** Watch out for steps like \\”reply with ‘Y’, then close and reopen the message\\” or pasting the link into Safari. This is a scam tactic to bypass security features.\\n * **Foreign phone numbers:** US federal and state agencies only use official numbers, not foreign codes. A sender like +63 (Philippines) pretending to be a US state agency is a sure giveaway of fraud.\\n * **Grammatical mistakes, strange wording, and formatting errors:** Even though the use of AI by scammers has reduced the number of these signs, they sometimes occur. \u201cEmail paper check\u201d is a good example.\\n * **Generic sign-offs or incomplete contact details:** Real tax authorities provide clear and official contact information.\\n\\n\\n\\nSpotting any one of these signs should be enough to delete the message. Never click links or provide personal details based on unsolicited texts or emails.\\n\\nOther tips to stay safe are:\\n\\n * Keep your device and the software on it up to date.\\n * Use an active anti-malware protection, preferably with a web protection module.\\n * If you’re worried something is a scam and want to confirm it, Malwarebytes users can submit suspicious messages to Scam Guard.\\n\\n\\n\\nYou can also visit the FTB Scams page to verify when FTB sends texts and what information is included.\\n\\n## Indicators\\n\\nWe have spotted these subdomains in this campaign:\\n\\nftb.gov-ciehka.xmnsia[.]cc\\n\\nftb.ca-nt[.]cc\\n\\nftb.cagov-Ibh[.]cc\\n\\nftb.cagov-tqn[.]cc\\n\\nftb.cagov-cg[.]cfd\\n\\nftb.cagov-onr[.]cc\\n\\nftb.cagov-jme[.]cc\\n\\nftb.cagov-etu[.]cc\\n\\nftb.cagov-ib[.]cc\\n\\nftb.ca-mg[.]cc\\n\\nftb.gov-qls[.]help\\n\\n* * *\\n\\n**We don ‘t just report on scams\u2014we help detect them**\\n\\nCybersecurity risks should never spread beyond a headline. If something looks dodgy to you, check if it’s a scam using Malwarebytes Scam Guard, a feature of our mobile protection products. Submit a screenshot, paste suspicious content, or share a text or phone number, and we\u2019ll tell you if it’s a scam or legit. Download Malwarebytes Mobile Security for iOS or Android and try it today!”,”published”:”2025-09-02T13:09:34″,”modified”:”2025-09-02T13:09:34″,”type”:”malwarebytes”,”title”:”Tax refund scam targets Californians”,”source”:””,”references”:””,”id”:”MALWAREBYTES:EC910964FE9AD4D052532E2B17E69831″,”bulletinFamily”:”blog”,”cwe”:null,”cvelist”:[],”sourceData”:””,”sourceHref”:””,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.malwarebytes.com\/blog\/news\/2025\/09\/tax-refund-scam-targets-californians”,”category_name”:”News”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-09-02T14:59:41″,”description”:”The State of California Franchise Tax Board (FTB) recently issued a warning to taxpayers to protect themselves from tax scams. In their warning the FTB…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[6,8,12,115,13,33,7,11,5],"class_list":["post-15468","post","type-post","status-publish","format-standard","hentry","category-category_news","tag-cve","tag-cvss","tag-exploit","tag-malwarebytes","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n