Taiwan police and rail officials are urging passengers to reject text messages that claim a booked train has been rescheduled or cancelled and push them toward a link to confirm a new time or claim a refund over the long weekend.
The advisory lands during one of the year’s heaviest travel periods. Taiwan High Speed Rail carried a record 348,000 passengers on Sept. 24, and hotel occupancy for the weekend reached 67.07% nationally, with Chiayi, Pingtung and Tainan above 80%, according to industry and government figures. Transport data also show high-speed rail passenger volume up 23.5% year on year and domestic aviation up 23.2%.
That volume gives a familiar phishing script a better cover. A traveler with a real booking, a crowded inbox and a holiday schedule is more likely to tap a link that appears to come from a rail operator. Police say the messages imitate official notices closely enough to create urgency: a seat has been moved, a departure time has changed, or an itinerary needs reconfirmation before a deadline.
The link does not lead to an official booking system. It typically routes to a look-alike page designed to collect login credentials, card details or personal data, or to prompt a malicious download. The Criminal Investigation Bureau has repeatedly warned about similar fake-refund links in e-commerce scams. The rail variant is distinct because it borrows the authority of a transport operator and the anxiety of a holiday schedule, rather than the promise of an online shopping refund.
Verify inside the app, not the text
The safest check is the one passengers already control: open the official Taiwan High Speed Rail or 929 app and look at the booking attached to the account. If a train has genuinely been rescheduled, the change should appear in the official system. The same applies to the operator’s website, ticketing counters and published customer-service channels.
Unsolicited messages should not be used to confirm anything. A text message can display a recognizable brand name and still be spoofed. Passengers should not tap links, reply with personal information, install attachments or call numbers supplied in the message. If a caller claims to be a rail employee and asks for card data or a one-time password, that is a fraud signal, not a service call.
Suspicious messages can be reported to Taiwan’s 165 anti-fraud hotline and to the rail operator’s official customer service. Passengers who already entered credentials should change passwords, contact their bank if card data was shared, and file a police report.
What is confirmed — and what is not
Confirmed: police and rail authorities have issued a holiday warning about spoofed rescheduling texts; the messages are circulating around a high-volume travel weekend; and the official apps remain the reliable place to check a booking.
Not confirmed: how many messages have been sent, how many passengers have clicked, whether any losses have been reported, and whether investigators have identified specific senders, spoofing services or payment accounts. No arrests or charges tied to this holiday rail alert have been announced. Those gaps matter because the public advisory describes a pattern, not a completed case file.
That also shapes liability. Under Taiwanese law, phishing that induces a transfer or harvests account data can be prosecuted as fraud, with additional exposure for those who run or assist the fraudulent site and for money mules who move proceeds. Telecom spoofing and misuse of personal data can bring separate regulatory and criminal consequences. But liability is fact-specific. Without a named suspect or a confirmed loss, the immediate legal question is not who is guilty; it is which agency is collecting reports and whether the pattern is being tracked as part of the broader holiday fraud wave.
The Criminal Investigation Bureau has warned about holiday phishing patterns; individual reports go through local police and the 165 anti-fraud hotline. Travelers who receive a rail rescheduling text should treat it as evidence, not as an instruction: screenshot it, avoid the link, and verify through the official app or counter.
Why the rail angle matters now
Holiday travel in Taiwan is dense and time-sensitive. A rescheduling claim hits a passenger’s real fear: missing a train, losing a seat or failing to get a refund. Scammers rely on that pressure to short-circuit the few seconds of doubt that would otherwise send a user to the official app.
The long weekend also includes events across the country, from Penghu’s music and light festival to Taitung’s Moonlight Sea event on Sept. 28, adding more reasons for last-minute travel changes. The more people move, the more routine the “your train has changed” premise becomes.
Police want passengers to slow down anyway. A genuine reschedule does not require a card number, a password or a link opened from an unsolicited text. It appears in the official system, where the booking already lives.