251 victims, S$1.2 million gone: The iMessage courier scam that bypasses Apple’s built-in protection

SINGAPORE: The Singapore Police Force has issued an urgent advisory about a surge in courier impersonation phishing scams conducted through Apple iMessage, with at least 251 cases reported since June 24, 2026 and total losses exceeding S$1.2 million.

Apple iMessage has a built-in protection that makes links from unknown senders unclickable by default. Scammers have found a way around this: they send messages urging victims to reply “Y” or “1” to acknowledge receipt. Once the victim responds, the sender is no longer treated as unknown, and the phishing link in the original message becomes clickable.

The messages arrive from foreign numbers with country codes including +212 (Morocco), +63 (Philippines), and +44 (United Kingdom), or from email addresses made up of random alphanumeric strings, but are made to appear as if they come from recognised couriers including DHL, NinjaVan, J&T Express, and SingPost. They claim a parcel could not be delivered due to an invalid address, and urge the recipient to update their details via a link before a stated deadline.

Clicking the link leads to a spoofed website mimicking the real courier’s site, where victims are asked to pay a small re-delivery fee and enter their card details or internet banking credentials. In some cases, victims were also tricked into providing OTPs, unknowingly allowing scammers to add their credit cards to Google Pay or Apple Pay, or provision their digital banking tokens to unfamiliar devices.

Unauthorised logins to bank accounts from unknown devices have also been reported.

The Police noted that courier companies do not use iMessage to communicate with customers. Legitimate communications come through registered SenderIDs, which can be verified at smsregistry.sg/web/sid-query, or through direct contact from delivery drivers via phone call, SMS, or WhatsApp. Unless a parcel is cash-on-delivery or requires GST payment, delivery drivers will never request payment from recipients.

Specifically: NinjaVan uses verified Facebook Messenger and Telegram pages, and is working with WhatsApp on business notifications. J&T Express Singapore uses SMS under the registered sender ID “J&T Express,” WhatsApp, and email, and does not charge re-delivery fees.

The Police advise all iPhone users to update their iMessage settings immediately: turn on both “Filter Unknown Senders” and “Filter Spam” to reduce the risk of encountering these messages. Suspicious messages should be reported using iMessage’s in-app reporting function.

More broadly, the ACT framework applies: Add the ScamShield app and enable Two-Factor Authentication, transaction limits, and Multifactor Authentication for banking. Check the authenticity of any delivery notification through the courier’s official website rather than clicking links in messages, even if you are expecting a parcel.

Tell your bank immediately if you notice unauthorised transactions, and report suspicious messages through in-app reporting functions.

For more information or to report a scam, call the ScamShield Helpline at 1799, visit www.scamshield.gov.sg, or call the Police Hotline at 1800-255-0000. For urgent Police assistance, dial 999.

Read also: SPF: Four arrested for providing modified foodpanda app that let foreigners impersonate local workers