Scam victims lose $560K to parcel delivery phishing schemes

SINGAPORE: In an advisory dated Dec 15 (Friday), the Police warned against phishing parcel delivery scams, especially during this holiday season. This year, at least 362 victims have had losses amounting to at least S$560,000 from January to November of this year alone due to this type of scam.

The modus of perpetrators of parcel delivery phishing scams is to obtain the victim’s personal details and banking credentials on the pretext of delivery charges. This is usually carried out when victims receive a text message or email saying the items they order need additional payment. However, the emails and messages are sent under the pretext that they are from postage and eCommerce logistics companies, including Singapore Post (SingPost). They contain a phishing link, which, when clicked, leads to a site where victims are asked to provide personal details and/or banking credentials.

They later find out that they’ve been scammed when unauthorised transactions made to their bank accounts or credit cards appear. The police also provided samples of these messages and the phishing websites that scammers use.

“Delivery charges are usually paid upfront when purchases are made. SingPost will never send you a text message or email requesting additional payment through an embedded link that demands that you give SingPost your personal or banking information. Any payment to SingPost can only be done via the SingPost Mobile App, at SAM machines, or any post office. Please refer to https://www.singpost.com/online-security-you to stay alert against scams,” the police said in the advisory.

As a precaution, they ask the public to add the ScamShield App and security features (e.g., Set up transaction limits for internet banking transactions, enable Two-Factor Authentication (2FA), and Multifactor Authentication for banks. People can also check for scam signs with official sources (e.g. ScamShield WhatsApp bot @ https://go.gov.sg/scamshield-bot, call the Anti-Scam Helpline on 1800-722-6688, or visit www.scamalert.sg).

The police also reminded the public to always verify the authenticity of the information with the official website or sources, even if a person is expecting a delivery of parcels, and to not click on links in unsolicited messages or emails.

No one should ever use personal or banking credentials, including Time Passwords (OTPs), to anyone, they added and underlined the importance of looking out for tell-tale signs of a phishing website.

Scams should also be reported immediately to the Police Hotline at 1800-255-0000 or via online submission at www.police.gov.sg/iwitness.

Read also: Police warn against parcel delivery scams; 25 victims lost S$38K  /TISG