GG My pet theory is that they maybe use a normal phone number leak and then use the bunq app to check if somebody set an alias to an account with that number (try to send a payment or payment request and see if anything comes up).
Of course you can always disable the alias feature and in of it itself, it‘s not a security issue. But this might allow to better filter a huge list of phone numbers for more targeted phishing campaigns.
On the other hand, we don‘t know if just bunq users are receiving these messages. For spammers it wouldn‘t really matter, they could send to as many numbers as possible and just hope that some people are using bunq. I‘ve definitely received phishing SMS for services before that I have never used or signed up for.
