Fake Court and Subsidy Texts in Iran: How to Spot the Trap

What does SMS phishing look like in Iran?

Do not pay, install an app, or share account details through an unexpected court or subsidy text. Verify the request through a contact route you established separately. SMS phishing, also called smishing, uses messages that imitate trusted services to lead people to fake pages or harmful downloads. ^[3]

For an Iranian reader, the first question is practical: What does this message want me to do? Write the answer in ordinary words. “Open a court notice” may become “install an unknown app.” “Receive a benefit” may become “enter card details and a code.” Assess that change before continuing.

Do not feel obliged to solve the whole mystery while holding the phone. You can stop without deciding whether the sender is a criminal, an administrative office, or someone who made a mistake. The immediate decision is whether to trust the proposed action.

As of 4 November 2026. Keep the message for reference if needed, but do not reopen its link to investigate it. This is general security guidance; choose the next step according to what you actually shared or installed.

How did the documented fake Sana trap work?

In December 2021, Check Point Research described an Iranian campaign using fake judicial complaints and lookalike Sana pages. Victims were directed to an Android app and a small payment. The fake banking page collected card information, while the malware's access to SMS helped obtain verification messages. Infected phones also sent messages onward, spreading the lure. ^[1]

The lesson is the chain of requests, not a permanent list of bad addresses. A notice led to a download, the download led to sensitive access, and a supposedly minor charge led to financial exposure. A message arriving from another person's number was not enough to make it trustworthy. ^[1]

Use a short stop-point checklist:

• What was I originally trying to check?
• Why am I now being asked to install software?
• Why is the requested access necessary?
• Who independently confirmed that this payment is required?

If you cannot answer those questions, stop the process. Keep the message if you need a record, but do not reproduce the steps to see how the trap ends. A live suspicious download is not a safe demonstration for friends or relatives.

What about messages promising subsidies or support payments?

In June 2026, ITresan reported a warning from the Tehran judiciary about fake messages using government-service names, including Sana, cash subsidies, and support schemes. ^[2]

Treat a benefit offer as an unverified claim. A deadline written in the message is also part of that claim. Do not let “last chance” replace checking what the payment or download is for.

For example, imagine a text saying a household must install a new application tonight to keep a support payment. This is an illustrative scenario, not a quoted campaign. The safe decision is to pause and verify the underlying issue separately. You do not need to open the attachment to explain the message to someone you trust.

Messages may impersonate banks, workplaces, or other authority figures and ask for money or private information. Contact the person or organization through a route you normally use, and check the claim before responding to the unexpected request. ^[6]

How can I check a message without following its link?

For a business or account you actually use, contact it through a website or phone number you already know is genuine. Do not use contact information supplied by the suspicious text. This independent check is the core of the FTC's advice for unexpected messages seeking personal or financial information. ^[3]

Before making contact, write a neutral question: “Does my account have an issue that needs action?” Avoid reading out passwords or authentication codes. Ask the recipient to explain any required action through the established channel.

Apple's anti-scam guidance warns about impersonators creating urgency, requesting sensitive information, and directing people to fake support. If a caller takes over the conversation and tells you exactly what to press or reveal, stop and initiate your own contact through a known route. ^[4]

For a claimed legal notice, especially one involving political activity or threats, consider confidential advice from an independent lawyer before approaching a state body. Do not use the message's own payment link to settle the question. Keep verification of the claim separate from payment, app installation, and any decision to report.

Does a padlock, familiar logo, or sender name prove it is safe?

No. Google explains that Chrome's secure-connection status means information is private between you and the site. It still advises checking the site name and taking care with sensitive information. A secure connection is not a reason to accept the site's payment or identity claims. ^[11]

Apple notes that scammers can imitate trusted organizations and that caller information or other apparent signs of identity can be misleading. Do not accept a familiar logo, polished design, or apparent support identity as a substitute for independent contact. ^[4]

Do not make spelling your only test either. Ask what evidence would remain if the message had perfect spelling and no obvious design mistakes. If the answer is only “it looks official,” verification is still missing.

Use two separate questions: “Am I connected securely?” and “Is this the recipient I intended to trust?” A browser can help with the first; it cannot settle every part of the second. If you are unsure, close the page and return to the independently established route instead of trying to become an expert in address-bar tricks under pressure. ^[11]

Which requests should make me stop immediately?

Stop when an unexpected download asks you to weaken Android protections or allow powerful restricted settings. Google warns that harmful apps can use such requests to put device information at risk. Assess why the access is needed before allowing it; a screen that says “required” is not an independent justification. ^[5]

Also stop when someone asks you to hand over a password, device passcode, or verification code under the guise of support. Apple warns against sharing these details with impersonators. Do not use an unsolicited caller as your guide through an account-security process. ^[4]

Here is a suggested household rule: no one has to finish a payment or installation while a stranger waits on the line. Put the phone down, read the request together, and decide who will verify it independently. Use the same rule for a confident adult and a less experienced family member.

If someone has already acted, ask factual questions without blame. “Did you install the file?” and “Did you enter a code?” are more useful than “Why did you believe it?” Keep the answers in order, because the next response should address the exposure that actually occurred.

What if I already clicked, entered details, or paid?

Make a short action record before guessing at a diagnosis: link opened, information typed, file downloaded, app installed, permission granted, and payment made. Mark anything you cannot remember. Do not reopen the suspicious page just to fill a gap.

If you paid or exposed payment access, contact the bank or payment provider promptly through a known route and ask what action is possible. Do not assume the money is either certainly recoverable or certainly gone. ^[8]

If you entered a Google Account password or lost access, use Google's compromised-account guidance. Check the account's security activity and recovery information as part of recovery, rather than treating deletion of the text as a fix. ^[9]

If you installed an app or enabled an unexpected setting, stop using its instructions and seek device-specific help. Explain the app name and the access you granted. Distinguish this from merely receiving a message: the record should make clear how far the interaction went.

If a family member is helping, divide the work. One person can gather receipts while another contacts the payment provider. Keep the suspect phone away from further experimentation until the next action is clear.

Should I block or report the message?

Google Messages offers blocking and spam reporting. A spam report sends the last ten incoming messages from the sender to Google, and staff or contractors may review it. It may also send information to the carrier. Read the reporting details before submitting a sensitive conversation. ^[7]

Save any record you need before deleting or reporting. For a routine unwanted text, blocking may be the appropriate next step. For threats or a loss of money, decide separately what evidence to preserve and whether to seek legal advice. Do not treat the app's spam button as a formal complaint or a payment-recovery request.

Some threatening messages in Iran involve state intimidation rather than ordinary financial phishing. In October 2026, Iran International reported citizens' accounts of security warnings over social-media activity. Those reports do not authenticate any particular text, but they are a reason not to dismiss every threat as a harmless scam or direct every recipient straight to a state agency. ^[10]

To warn others, share a description of the tactic without a clickable attack link or private identifying details. For the wider background, read Pouyam's guide to phishing emails, texts, and QR codes.