“It’s quite unbelievable what they’ve done with the link because it makes the SMS entirely unactionable.”
FedEx texted Troy Hunt a demand for duty and taxes through a bpoint.com.au payment link whose amount could be edited in the query string. A later SMS carried only query parameters, no domain at all. Hunt took it for phishing, but it was a real bill on a US$799 Prusa order. FedEx trains customers to pay strangers, then wonders why scammers copy it so easily.