The text message about your parcel
“Your parcel could not be delivered. Pay 1.99 € for a new delivery.” It looks harmless, but they are after your bank details.
1How they do it
- You get a text message that seems to come from the post office, DHL, UPS or another courier.
- The link leads to a fake site with the courier's logo.
- You have to pay a small amount. To do so, you enter your card details or log in to your bank.
- With those details they empty your account, or they make you “confirm” a much bigger payment.
2A real example
“Post: your parcel is waiting for shipping costs (1.99 EUR). Pay within 24 hours: post-levering-track.com/xYz”
3How to spot it
- You are not expecting a parcel, or the message does not mention an order.
- The link address is not the courier's real address.
- A small amount with an urgent deadline.
4How to protect yourself
- Do not click. Track your parcel in the app or on the site that you type in yourself.
- Report the message to the phishing reporting point in your country (see “Help by country”) and delete it.
- For every payment, check in your banking app what amount you are really confirming.
In Belgium
- Forward suspicious messages to suspicious@safeonweb.be.
How WolfKey helps
On a fake site the little wolf does not work: WolfKey only fills in your password on the real website. You see the difference straight away.
Get WolfKeySuspicious number, email or website? Check it or report it.
Examples have been made unrecognisable. Names and numbers in the examples are made up.