Beijing time, November 11 — According to incomplete statistics, since November 5, at least 12 car brands have officially issued similar statements regarding "car owners receiving scam text messages sent by criminals under the guise of the brand. The messages usually use [recall] as a pretext to induce car owners to provide personal information and go through so-called [recall] procedures," reminding car owners not to be deceived and stating that legal liability will be pursued.

The 12 brands are:

November 5: Volkswagen Group China Investment Co., Ltd., Li Auto Legal Department;

November 6: BMW China, Mercedes-Benz, AITO, SAIC General Motors, BYD (News Anti-Counterfeiting Office), Toyota Motor (China) Investment Co., Ltd.;

November 7: Nissan (China) Investment Co., Ltd., Volvo Cars;

November 9: Jaguar Land Rover China;

November 11: Great Wall Motor (Haval SUV).

In addition, Tesla owners have also received similar scam text messages, but the brand has not yet officially issued a notice explaining the matter; only customer service has given oral reminders in interviews. Owners of brands such as NIO and XPeng have also reported receiving similar scam text messages on social platforms.

Judging from the brands and numbers involved, the coverage is very wide, and the police need to pay special attention and carry out special investigations.

According to an automotive news report by Jiemian News, some of the text messages received by car owners can accurately state the owner's name, license plate, model, and even VIN, and some even include red-header documents and fake official seals, making them highly deceptive.

How the information was leaked requires the investigation results of public security organs. Those who can accurately provide so much information most likely obtained it from information retained by car companies, either because the system was attacked by hackers or because insiders sold the information. Let's wait for the final investigation results.

Moreover, the content of the scam text messages is quite professional. Below is the main content of the scam text messages received by owners of various brands:

From the content of the above scam text messages, there are two mainstream scripts:

Template A (mainstream, used by 10 brands: Li Auto, BMW, Volkswagen, Mercedes-Benz, AITO, SAIC-GM, Toyota, Volvo, Nissan, Jaguar Land Rover)

[Important Recall Reminder] Dear XX car owner, your vehicle's "Takata airbags have safety hazards, and fragments may injure people when the airbags deploy." An emergency recall has now been initiated. Please "click the link below / scan the QR code within 2 hours to complete the recall registration online. If overdue, the vehicle warranty will be canceled." Attached is a forged red-header recall document (with a fake official seal) + phishing URL.

Template B (specific component version: BYD, Great Wall)

Forged red-header documents of car companies, fabricated exclusive component defects (BYD: brake pedal stop pad; Great Wall: steering gear / subframe bolts), falsely used the name of regulatory authorities, limited-time processing, loss of warranty if overdue, attached phishing links, and requested bank cards and verification codes.

Supplement: Tesla belongs to the "separate compensation version" (not included in the 12 official notice list): recall for manufacturing defects in rear shock absorbers and rear springs, "each vehicle will be compensated 2,800 yuan, distributed by China UnionPay Center to bank cards / Alipay."

These scam text messages accurately state car owner information to create credibility, then fabricate safety hazards to create panic, then use "limited time + warranty cancellation if overdue" to exert pressure, and finally lead through attached links or QR codes to highly imitation fake official websites, ultimately inducing victims to fill in ID numbers, bank cards, and SMS verification codes, and even requiring screen sharing to steal funds.

Most of the rumor-refuting notices from the above 11 brands remind car owners not to click suspicious links, not to reply to text messages, and not to submit sensitive information such as bank cards and verification codes to unknown channels; legitimate recalls will not issue cash compensation, will not request bank card information online, and will certainly not require screen sharing.