Chase Bank Scams Target Our Own

This report analyzes an SMS phishing scam impersonating Chase Bank that directs victims to a mobile-optimized fake login page which captures usernames, passwords, and phone numbers. The scammers appear to relay multi-factor authentication codes in real time to complete account takeover; the authors validated data exfiltration in a sandbox but did not use real accounts.