Watch out for an energy-themed scam being sent out via SMS. The message plays on energy price fears, similar to what we’ve seen previously.

Scam alert. I just received this text. Click through and it looks very official. It’s a scam. The £400 energy bill discount is automatic, you don’t need to register or share any details with anyone. Please be aware. pic.twitter.com/76bT9YSkOy

— Marc Ashdown (@marcashdown) September 20, 2022

It reads as follows:

GOVUK: We have identified you as eligible for a discounted energy bill under the Energy Bills Support Scheme. You can apply here [URL]

The message, which claims to be from the UK government, directs clickers to a phishing page which resembles a typical gov.uk website.

Energy Bills Support Scheme

Register now to receive a £400 non-repayable discount under the Energy Bills Support Scheme.

Anyone “registering” to the website may well find themselves out of pocket. Considering those most likely to respond to such a message may be people already struggling financially, this is a particularly despicable attack.

Phishing for info

The pattern followed by this site is typical of this kind of attack. First it asks potential victims to enter a variety of personal information:

• Name

• Date of birth

• Phone number

• Address

• City

• Postcode

Once this is done, the site asks for your current energy supplier, and provides a list of pre-fills.

The site eventually asks for:

• Card number
• Card expiry date
• Card security code

It also places the logo of whichever company you’ve selected at the top of the page, along with the following message:

This should be the account linked to your [business name] account. This is the account your supplier will send the payments to.

It’s worth noting that the URL is already being flagged by some browsers. For example, Chrome will make you confirm that you want to visit the site, ignoring its prominent “this site is bogus” warning. If you actually visit the page despite this, it’s also tagged as “Dangerous” where the green padlock in the URL bar is located. Users of Malwarebytes are protected from the phishing URL used in this attack.

How to avoid energy scams

• Phone calls, emails, and random SMS messages asking for payment information are not going to be legitimate. You should also never be asked for login details for your online banking or other accounts from a cold-caller.
• If you receive an unexpected call about energy prices or rebates, insist on calling "them" back on their official number taken from an official website directly. If the caller objects to this, that's an immediate red flag. A genuine caller would have no possible reason to object to this.
• Bogus fake energy company websites are very popular and easy to set up. Visit the official website listed in official correspondence only, and pay close attention to URLs sent to you by text or email. Don’t trust sites sent your way in relation to any money back, discount, or rebate offer.