KCEN reported October 15, 2026: residents got emails offering a 50% refund on tickets to the Harker Heights Food, Wine & Brew Festival. The messages claim to be the Harker Heights Chamber of Commerce. The Chamber says it did not authorize refunds and did not send those offers.
This is not a report that the Chamber, the city, or TicketSpice were hacked. It is a lookalike refund lure timed to the October 17, 2026 festival. Official ticket terms on TicketSpice say all sales are final — no refunds or exchanges. A “50% refund” mail that asks you to click, log in, or send card details is the scam.
We scanned ic3.gov, ticketspice.com, kcentv.com, hhchamber.com, harkerheights.gov, and hhfoodandwine.com. 100% is the ideal overall domain-security score. None reach it. The festival host sits at 28% with Identity 0%.
Snapshot
| Field | Detail |
|---|---|
| Local alert | KCEN · Oct 15, 2026 |
| Official hosts | hhchamber.com · hhfoodandwine.com · TicketSpice event page |
| Verify | 254-699-4999 · admin@hhchamber.com · events@hhchamber.com |
| Ticket rule | TicketSpice: no refunds |
| Report | ic3.gov if you clicked or paid |
The Chamber and festival asked vendors, sponsors, and neighbors not to reply, click, or send personal, financial, or ticket data. Do not treat “Chamber of Commerce” in the From line as proof. Type the official sites yourself. The festival was still scheduled for Saturday, October 17.
The city has separately warned about permit-expedite and planning-invoice fakes. Those are different lures. This week’s mail is a festival refund.
What the lure wants
A refund page that looks like TicketSpice or the Chamber still works if you type the password or a card. Typical next steps after a click: harvest the ticket email, drain a card, or reuse the password on mail and banking.
| Do | Why |
|---|---|
| Ignore the refund mail | Chamber says it did not send offers |
| Type official URLs | Costume From-lines are cheap |
| Call 254-699-4999 | Voice path the Chamber publishes |
| Report a loss | ic3.gov |
If you already clicked and typed a password, change that password now, turn on a stronger second factor, and watch the card.
MFA on the accounts this lure hunts
Hardware keys and authenticator apps raise the cost after you lock the real account. They do not make a refund email safe.
| Grade | Meaning |
|---|---|
| Fail | SMS, email OTP, or no public key / open TOTP |
| Pass | Self-serve Google Authenticator-style open TOTP |
| Strong | FIDO2 / YubiKey-class security key for sign-in |
| Platform | Grade | YubiKey | Authenticator |
|---|---|---|---|
| TicketSpice | Pass | No | Yes |
| Strong | Yes | Yes | |
| HH Chamber portal | Fail | No | No |
| City of Harker Heights | Fail | No | No |
TicketSpice 2FA help (Aug 6, 2026) is an authenticator-app QR code. It names Authy, 1Password, and LastPass Authenticator. That is open TOTP — Google Authenticator works even though it is not named. No public YubiKey enrollment. No SMS path in that article, so the row is Pass. Organizer/admin MFA does not stop a buyer-facing refund phish.
The Chamber’s Connectory member login is email and password. No public YubiKey or open TOTP. City recreation uses Civic Rec; permits use MGO Connect. Those help pages document username/password only.
Facebook already grades Strong (U2F/FIDO2 security key + authenticator; SMS remains an alternate). The festival warning started on Facebook — treat the page as a notice, not a login you reach from the refund mail.
Directory: MFA support directory · Business Apps and Social & Professional.
Recommended MFA tools
| Product | Best for | Get it |
|---|---|---|
| YubiKey 5C NFC | USB-C laptops + NFC phones | Amazon |
| YubiKey 5 NFC | USB-A desktops + NFC phones | Amazon |
| Proton Pass | Passkeys + authenticator-style TOTP | Proton Pass |
We may earn a commission if you buy a YubiKey or sign up for Proton Pass through the links above.
Independent cybersecurity audits
We audited the report, ticket, chamber, city, and coverage hosts on October 17, 2026. 100% is the ideal — none reach it. These scores are public email / transport / website posture. They do not mean the Chamber was breached.
| Organization | Domain | Overall | vs 100% |
|---|---|---|---|
| FBI IC3 | ic3.gov | 87% | −13 |
| TicketSpice | ticketspice.com | 54% | −46 |
| KCEN | kcentv.com | 53% | −47 |
| HH Chamber | hhchamber.com | 46% | −54 |
| City of Harker Heights | harkerheights.gov | 42% | −58 |
| Festival site | hhfoodandwine.com | 28% | −72 |
| Domain | Identity | Transport | Website |
|---|---|---|---|
| ic3.gov | 90% | 45% | 97% |
| ticketspice.com | 50% | 50% | 37% |
| kcentv.com | 50% | 15% | 40% |
| hhchamber.com | 35% | 15% | 37% |
| harkerheights.gov | 0% | 15% | 70% |
| hhfoodandwine.com | 0% | 15% | 37% |
Audit links: ic3.gov · ticketspice.com · kcentv.com · hhchamber.com · harkerheights.gov · hhfoodandwine.com
hhfoodandwine.com has Identity 0% and no MX on the blacklist probe. A spoofed “your refund is ready” note is easier to send as that brand than the overall 28% suggests. harkerheights.gov is also Identity 0%. Type hhchamber.com and hhfoodandwine.com yourself.
hhchamber.com, harkerheights.gov, hhfoodandwine.com, and kcentv.com sit at 15% transport (MTA-STS / related).
Website stack
Passive homepage + Certificate Transparency probes (October 17, 2026). Versions only — not a claim the sites were compromised.
| Domain | Stack note |
|---|---|
| ic3.gov | CMS undetected; DigiCert TLS expires 2027-01-05 |
| ticketspice.com | Webflow (vendor-managed); Amazon Trust TLS expires 2027-02-06 |
| kcentv.com | CMS undetected; Sectigo TLS expires 2027-03-18 |
| hhchamber.com | CMS undetected; Let’s Encrypt TLS expires 2026-12-14; HTTP→HTTPS redirect not confirmed |
| harkerheights.gov | CMS undetected; Google Trust TLS expires 2026-12-07 |
| hhfoodandwine.com | CMS undetected; Google Trust TLS expires 2026-12-05; probe jQuery 1.8.3 (EOL hint) |
The jQuery 1.8.3 hit on the festival host is a probe comparison, not a finding that the refund mail came from that site.
Blacklist and lookalikes
Email blacklist checks (public DoH, October 17, 2026): ic3.gov, hhchamber.com, hhfoodandwine.com, harkerheights.gov, kcentv.com, and ticketspice.com were clear on mail/domain lists we can query. kcentv.com showed web/CDN SPFBL on two IPs — shared-edge noise, not led.
Registered lookalikes that matter if the refund mail turns into a fake portal:
| Lookalike | Technique | Signal |
|---|---|---|
| ticketspice.us | TLD swap | BEC staging (NS + MX) |
| ic3.com | TLD swap | BEC staging (NS + MX) |
| hhifoodandwine.com | insertion | NS + A + MX |
| hhchamber.net | TLD swap | NS + A + MX |
harkerheights.com redirects to the city site. TicketSpice also owns defensive redirects (ticketspice.io, .net, .tech). Type hhchamber.com, hhfoodandwine.com, and the TicketSpice event URL — not a near-spell from a refund mail. Continuous monitoring: Cybersquat Domain Monitoring.
CourtListener RECAP searches for Harker Heights, hhchamber, and this festival-refund lure did not turn up a matching U.S. docket. This remains a consumer-alert story, not a filed case we can cite.
Related coverage
- Midland Planning & Zoning phishing
- Houston brushing / QR-package phishing
- BBB / FTC “You’re Invited” party-invite phishing
- MFA support directory
Sources: KCEN, Oct 15, 2026 · Harker Heights Chamber · Festival site · TicketSpice 2026 event page (no-refund terms) · TicketSpice 2FA help · Connectory HHCC login · City of Harker Heights. Independent EmailMeNow audits, website-tech, blacklist, cybersquat, and CourtListener searches October 17, 2026. Domain scores: audit.emailmenow.com only.