“You have received a direct deposit of $1,200 from COVID-19 TREAS FUND. Further action is required to accept this payment into your account. Continue here to accept this payment …” is the typical message. The text includes a link to phishing web address which purports to come from a state agency or relief organization, takes the visitor to a website that impersonates the IRS.gov Get My Payment website.
Anyone entering personal and financial account information will have their information harvested.