Over $1.2m lost to scams involving courier firms and Apple’s iMessage

AI generated

SINGAPORE – Received a message from Ninja Van or DHL, notifying you of a failed delivery because of an invalid address? Be careful as this may be a ruse to obtain your personal and banking information.

The police on Aug 5 warned of scammers impersonating courier companies and sending potential victims messages via Apple’s iMessage function.

More than $1.2 million has been lost to such scams since June 24, with at least 251 cases reported, the police said.

In such cases, victims would typically receive messages from numbers bearing foreign country codes, or from e-mail addresses comprising random alphanumeric strings imitating recognised couriers such as DHL, NinjaVan, J&T Express and SingPost.

Recipients will be told that their parcels could not be delivered due to an invalid address. They will be urged to update their delivery address through a link that resembles the courier’s genuine URL, and given a deadline to do so. In some cases, the messages also include a local helpline number.

Recipients will be told to reply with “Y” or “1”. This is likely to try to bypass Apple iMessage’s inbuilt protections, which prevents recipients from clicking into links in messages until they have interacted with the sender, police said.

Upon clicking on the link, victims will be directed to a fake website that looks like the courier company’s official page, and prompted to pay a “re-delivery fee”.

They will be asked to enter their credit card and internet banking credentials, and authorise the transaction with their digital tokens.

In some cases, their credit cards would later be added to Google Pay or Apple Pay. Victims’ bank digital tokens may also be set up on unfamiliar devices after they were tricked into providing their One-Time Password.

Some victims also observed unauthorised logins to their bank account from unfamiliar devices.

Many of them would discover that they had been scammed only after noticing unauthorised transactions made to their cards or bank accounts.

Courier companies usually do not use iMessage to contact their customers, the police said. They typically communicate through messages sent via their registered SenderIDs, which the public can verify at https://smsregistry.sg/web/sid-query

Also, NinjaVan can contact customers through its verified business pages on Facebook Messenger and Telegram, police said. It is also working with WhatsApp to send out notifications through its WhatsApp Business account.

J&T Express Singapore uses several modes of communication, including SMS, WhatsApp and e-mail, and does not charge parcel re-delivery fees.

Delivery drivers may also contact recipients directly through phone calls, SMS or WhatsApp to verify delivery details, but will not ask for any payment, unless the parcel is cash-on-delivery or if the shipment requires GST payment before delivery.

The police advised the public to turn on “Filter Unknown Senders” and “Filter Spam” in their iMessage settings, and to report suspicious messages using the in-app reporting function.

To contact the police on such scams, call 1800-255-0000, or go to www.police.gov.sg/i-witness