Over $1.2m lost in courier phishing scams impersonating Ninja Van, J&T Express and others via iMessage

Phishing scams involving the impersonation of courier companies via Apple iMessage have become increasingly common, with victims losing more than $1.2 million since June 24.

In a statement on Wednesday (Aug 5), police said at least 251 cases have been reported and warned the public to remain vigilant.

Victims typically receive messages via Apple iMessage from scammers posing as recognised couriers such as DHL, Ninja Van, J&T Express and SingPost.

The messages usually originate from foreign numbers bearing country codes such as +212 (Morocco), +63 (The Philippines), +44 (United Kingdom), or from email addresses comprising random alphanumeric strings that appear to belong to couriers, said the police.

The messages inform recipients that their parcels could not be delivered due to an "invalid" address, and that they would need to update their delivery address within a stipulated timeframe through a link that closely resembles that of the courier company's official website. 

In some instances, the messages also include a local helpline number to appear more legitimate.

According to the police, the messages would instruct victims to reply "Y" or "1" to acknowledge the message.

This is believed to be an attempt to circumvent Apple iMessage's built-in protections, which prevent links in messages from unknown senders from being clicked until the recipient interacts with the sender.

Once victims click on the link, they are redirected to a spoofed website that closely resembles the courier company's official website.

Victims are then prompted to pay a small "re-delivery fee", where they would be asked to enter their credit card or internet banking details to authorise the transaction.

In some cases, victims would notice unauthorised logins to their bank account from unfamiliar devices.

Others would notice their credit cards being added to Google Pay or Apple Pay to unfamiliar devices after the victims were tricked into providing their One-Time Password, believing they were facilitating the parcel delivery.  

Many victims would only discover that they had been scammed upon noticing unauthorised transactions made to their cards or bank accounts, said the police.

The police warned that courier companies typically do not use iMessage to contact customers, and that they would usually send messages through registered SenderIDs which can be verified at https://smsregistry.sg/web/sid-query.

Alternatively, delivery drivers may also contact customers through phone calls, SMS or WhatsApp to verify delivery details.

"Unless the parcel is cash-on-delivery or the shipment requires GST payment before delivery, delivery drivers will not request any form of payment from recipients," the police said.

The police advised the public to update their iMessage settings to filter unknown senders and spam messages, and to report suspicious messages using the in-app reporting function.

Members of the public with any information on such scams should also make a police report through the police hotline at 1800-255-0000 or submit information online at www.police.gov.sg/i-witness. 

For more information on scams, the public can call the ScamShield Helpline at 1799 or visit ScamShield's website.

[[nid:741677]]

dana.leong@asiaone.com