Takealot SMS smishing scam.

Please note the use of the generic Dear Customer and not your name or order number.  

The cloned fake Takealot typosquatting website .dev in the URL indicates a cloned or subdomain website that has a fake payment gateway that steals your credentials and bank card information.

You receive an SMS.
TAKEALOT: Dear Customer, Your Parcel is due for delivery. kindly click here https://t.ly/JmSPZ <https://t.ly/JmSPZ>  to clear your VAT & DUTY charges to proceed with your delivery.

You follow the URL shortener link to what appears to be a Takealot website with a payment gateway where you enter all the details scammers need:  You will be asked to enter your card number, expiry date, phone number, your bank and the CVV number to release the delivery providing the scammers information needed to max your credit limit.

You are enticed with the small amount of R16.13, however, the scammers then immediately empty your bank account, this action cannot be reversed and you may not be able to claim if you used a code or one-time pin (OTP). You have provided your phone number, bank name and the scammers will call you to try for your OTP if the bank security stops them from emptying your account.

Mark the SMS as spam and report immediately.

Takealot SMS smishing scam.

Smishing or SMS/text message phishing use of text messaging to steal personal information, money and fraud.

Checking the Shortened URL.

Phishing scammers use shortened URLs in emails to conceal the true destination of a link. If you want to check the link, it is hidden in the URL Shortener however there are services where you can check the shortened URL’s final destination. The shortened URL will lead to a website that looks like Takealot Payment gateway where you will fill in with your banking credentials and possibly even have to confirm your card details as part of the login process. The phisher will use this information to gain access to your account, and your money, or steal your identity

Treat all emails with Zero Trust especially Shortened URLs in emails. To check the legitimacy of a URL, however, to check the end destination of shortener URLs you will need to use a service like https://www.virustotal.com/gui/home/upload and https://www.urlvoid.com/

Install an Anti-virus with Firewall and Phishing/ransomware modules, for example, Trend Micro or Zone Alarm Security Suites and browser extensions (Trend Micro Check) used for detecting scams, phishing attacks, malware, and dangerous links.