An ongoing smishing campaign is targeting New Yorkers with text messages posing as the Department of Taxation and Finance, claiming to offer “Inflation Refunds” in an attempt to steal victims’ personal and financial data.
The Inflation Refund is an initiative from New York State that automatically sends refund checks to eligible residents to help offset the effects of inflation.
Those who qualify include taxpayers who filed a return, meet certain income thresholds, and were not claimed as dependents by another filer. New Yorkers do not need to apply, sign up, or provide any personal information to receive their checks, as they are automatically sent to qualified taxpayers.
In a new smishing attack seen by BleepingComputer, text messages claim to be part of the state’s “Inflation Refund Initiative,” urging recipients to click a link to provide information for the refund to be processed.
“Your refund request has been processed and approved. Please provide accurate payment information by September 29, 2025. Funds will be deposited into your bank account or mailed to you via paper check within 1-2 business days,” reads the phishing text.
“Failure to submit the required payment information by September 29, 2025, will result in permanent forfeiture of this refund under New York Revised Statute §5747.11.”
Phishing text
Source: BleepingComputer
Clicking the link brings you to a page impersonating the New York Department of Taxation and Finance, prompting the visitor to check their refund status by clicking on the “Check Refund” button.
Doing so will open a page asking the person to submit their personal information, including their name, address, email address, phone number, and Social Security Number.
Phishing page requesting visitor’s personal information
Source: BleepingComputer
The fraudsters can use this submited information to commit identity theft and financial fraud.
On September 28, Governor Kathy Hochul’s office issued a warning about the scam, stating that the scammers are sending text messages, emails, and direct mail to trick people into providing sensitive payment information.
“New Yorkers do not have to do anything to receive an inflation refund check outside of meeting the eligibility requirements,” Governor Hochul said.
“With scams targeting the state’s inflation refund initiative, let me be clear: The Tax Department and the IRS do not call or text individuals for personal information. My administration urges New Yorkers to remain vigilant and report these scams to the Tax Department to protect yourself from being a victim.”
The New York Department of Taxation and Finance also issued a warning, stating the agency will never contact taxpayers by text, phone, or email regarding the inflation refund checks.
Recipients can protect themselves by avoiding websites that come through unexpected emails or texts, hanging up on tax-related calls, and never agreeing to meet anyone in person to hand over tax payments.
Those who believe they have received one of these scams or fallen victim to it should report it to the Tax Department or IRS.
Join the Breach and Attack Simulation Summit and experience the future of security validation. Hear from top experts and see how AI-powered BAS is transforming breach and attack simulation.
Don’t miss the event that will shape the future of your security strategy
Register Now
