Taiwan’s Criminal Investigation Bureau issued a public alert September 24 warning that fraud rings revived gift-card phishing pages mimicking major convenience-store chains and supermarket voucher portals after Mid-Autumn gatherings, according to the bulletin and case summaries CIB shared with local police bureaus. Scammers send SMS messages claiming unused mooncake or barbecue gift-card balances will expire unless recipients click links and “verify” card numbers and PINs—capturing funds within minutes.
How the lure works
Fake sites copy chain color palettes and shelf photography but host on look-alike domains registered days earlier. Victims enter serial numbers believing they merge small holiday gifts onto one card; malware-free pages simply relay digits to cash-out teams that redeem value at legitimate self-checkout kiosks before holders notice.
Some messages reference corporate mooncake exchanges employers ran in September—social engineering that makes employees think HR sent the link.
Who is targeted
CIB said reports skew toward adults forty-five to sixty-five who received physical gift cards as holiday gifts and rarely use official chain apps to check balances. Students forwarding “deal” links in family chat groups spread URLs without inspecting domains.
Convenience chains issued legitimate balance-check apps and in-store QR codes; CIB stressed only official app store listings or printed receipts—not SMS links—should trigger balance queries.
What chains and banks did
Major chains posted in-store notices reminding clerks not to help customers redeem unfamiliar barcode screenshots—a tactic mules use after phishing captures. Acquiring banks tightened velocity limits on bulk gift-card redemptions at midnight hours when fraud clusters spiked after the holiday.
165 anti-fraud hotline operators added scripted callbacks when callers mention “gift card expiry” texts, walking victims through domain inspection before funds leave.
Prosecution and takedown tempo
CIB’s cyber unit referred dozens of domains to telecoms for DNS blocks within forty-eight hours of identification, but fraudsters rotate URLs faster during long weekends. Prosecutors said proving cross-border cash-out mule networks requires correlating kiosk CCTV with wallet withdrawals—a slower track than account-freeze requests victims want immediately.
Fair Trade Commission staff monitor deceptive ad keywords on search engines; CIB asked platforms to suppress sponsored results that clone chain trademarks.
Household defense before Lunar New Year
Treat gift-card SMS like wire-transfer requests: call the printed hotline on the physical card, not the message link. Screenshot domains and report to 165 before attempting redemption if a relative forwards a “balance merge” offer.
Employers distributing holiday gifts should send official balance-check instructions in the same email that announces benefits—reducing room for parallel phishing that cites HR themes.
Local police bureaus in New Taipei and Taichung ran post-holiday briefings at community centers September 23–24, demonstrating how fake pages miss SSL issuer details visible in mobile browsers—an education step CIB said cut repeat victimization in prior Dragon Boat campaigns.
Retail analysts expect another phishing wave before Lunar New Year hongbao gift-card promotions; CIB urged chains to pre-publish official domain lists on corporate sites so journalists and schools can mirror them in scam-awareness slides.
Telecom operators said September 24 blocks targeted more than eighty domains tied to the same template farm CIB traced to offshore hosting—yet smishing volumes rose because fraudsters shifted to encrypted messaging apps with shortened URLs.
Victim assistance centers in Taipei reported longer call hold times after Mid-Autumn as families disputed kiosk redemptions; counselors walk callers through freezing unused card balances when serial numbers may already be compromised.
School districts in Kaohsiung added gift-card scam modules to parent LINE groups after CIB shared redacted screenshots—an outreach channel police said reached more households than televised PSAs alone.
Legislators on the Judiciary and Organic Laws committee asked CIB for monthly loss tallies by chain brand; the bureau cautioned that brand-specific figures can lag when victims report only “convenience store” categories at first intake.
Chain corporate security teams began sharing hashed domain lists with CIB twice weekly after September 24—a coordination step retailers said cut average takedown requests from five days to under forty-eight hours for cloned voucher pages.