Typhoon stay-at-home scams: Fake supermarket vouchers steal personal data

Scams have been emerging in an endless variety, frequently combining current events with popular consumer brands in an attempt to lower the public's guard. The Criminal Investigation Bureau issued a special alert today, pointing out that taking advantage of Typhoon Champi striking Taiwan—during which many people stay at home to monitor weather and typhoon-preparedness information—unscrupulous scam syndicates capitalized on this surge in the stay-at-home economy and web-browsing traffic to set up fake webpages imitating the well-known supermarket chain PX Mart. Using gift certificate lucky draws as bait, they attracted large numbers of unsuspecting citizens to click and participate. Police urged that the primary objective of this type of scam is to steal personal information, reminding the public to remain highly vigilant when browsing the internet or participating in various online activities, and to avoid easily filling in sensitive personal data.

According to the Criminal Investigation Bureau's analysis and explanation, in this webpage scam targeting PX Mart, the criminal syndicate exploited the public's trust in a well-known retail brand. Fraudsters placed advertisements on social platforms or messaging apps, claiming that participants could receive PX Mart shopping vouchers worth thousands or even tens of thousands of New Taiwan Dollars for free simply by completing a specific online questionnaire or simple lucky draw interaction. Because PX Mart has an extremely high penetration rate in Taiwan and is a nearly household-name consumer location, these seemingly advantageous limited-time promotional messages often attract a massive influx of clicks in a short period of time. However, when users click on the advertisement link, they are redirected to a fake webpage that looks extremely similar to the official PX Mart website, where they are asked to fill in personal information such as names, phone numbers, ID card numbers, addresses, and even credit card details to complete the so-called "prize collection procedure."

Faced with an endless array of phishing and personal data theft methods, the police, after conducting in-depth investigations, specially disclosed a key technique for identifying authenticity to serve as a reference for public prevention. The Criminal Investigation Bureau pointed out that when clicking on any internet link, in addition to carefully verifying whether the webpage layout, fonts, and official branding are consistent, the most direct and easily identifiable method is to examine the ending of the URL. Legitimate large enterprises and official institutions typically use common and credible top-level domains, such as the commonly used ".com" or ".com.tw" in Taiwan; conversely, to evade investigation or due to cost considerations, scam syndicates often register rarer top-level domains, sometimes even with special meanings. Taking this fake PX Mart gift certificate scam as an example, the endings of its phishing webpages frequently featured suffixes like ".art," which are rarely used for commercial retail webpages under normal circumstances. As long as citizens pay close attention to URL details, they can spot the clues.

These types of online scams utilizing current events and well-known brands not only severely infringe upon public property security and personal privacy, but also cause a certain degree of disruption to corporate brand reputations. In the digital age of rapid information flow, scam tactics have evolved from simple past telephone intimidation or text-message lottery winnings into highly realistic webpage frauds. Criminals frequently take advantage of natural disasters—such as the period when Typhoon Champi struck Taiwan, during which public demand for home-based online shopping, online entertainment, or livelihood information surges and psychological defenses are lowered—to carry out large-scale, indiscriminate phishing scams. This criminal model combining social dynamics and internet technology poses greater challenges for various scam prevention efforts and highlights the urgency of strengthening digital literacy and cybersecurity awareness among the entire population.

To effectively curb this type of phishing crime impersonating well-known enterprises, the Criminal Investigation Bureau reiterated that the public should maintain a cautious "zero-trust" attitude when facing various online freebies, limited-time lucky draws, or gift certificate giveaways. If there are any doubts about the authenticity of an activity, individuals should avoid directly filling in any personal information on the webpage and are advised to verify and consult through official channels, by calling customer service hotlines, or by directly contacting the National Police Agency's anti-fraud hotline. Only through the public's heightened vigilance, paired with the police's continuous internet patrols and crackdown operations, can personal data security and property rights be comprehensively safeguarded amidst the ever-changing wave of digital scams.

(Source Fact: Central News Agency)