tl;dr
Be cautious of fake text and email notifications claiming that a package delivery has failed due to an incorrect delivery address. These are scams designed to trick you into divulging sensitive information or downloading malware.
Overview
Several times a week, I receive messages claiming that a package is on hold or could not be delivered due to incorrect address information. The notifications purport to be from postal services or well-known courier companies.
The example I discuss here claims to be from Australian postal service, Australia Post, but similar versions use the names of other postal services or delivery companies around the world.
The notifications are delivered via email as well as text messages.
Not From Legitimate Delivery Services
Despite appearances, these messages were not sent by any legitimate postal or courier service. The claim that a package delivery could not be completed is just a ruse designed to trick you into clicking the link in the fake messages.
What Happens if You Click?
If you click the link, you will be directed to a website that requests a substantial amount of personal and financial information, purportedly to correct the addressing errors, verify your identity, and ensure the successful delivery of your package.
Some versions ask you to enter your credit card number to pay a small delivery fee.
Criminals will collect all of the information you submit on the fake site and use it to commit credit card fraud and steal your identity.
Some versions may trick you into downloading and installing malware. Once installed, the malware can steal personal information, harvest login credentials, or even allow remote access to your device.
Why The Scam Works
Postal and delivery services often send legitimate text messages or emails about your package deliveries. For example, Australia Post sends me a text message on the day of delivery with a package arrival time window.
If you are accustomed to receiving these genuine messages, it may be easier to fall for a scam message claiming that a delivery has gone wrong.
How to Stay Safe
Don’t click links or open attachments in any message claiming that a parcel could not be delivered due to an incorrect address or other supposed problem.
Always track package deliveries via the service’s official app or website.
Legitimate delivery services are not likely to ask for personal or financial details via unsolicited text messages or emails. Be suspicious of any message that does so.
Don’t fall for false urgency. Scammers often create a sense of urgency to trick people into immediately clicking without due care and attention. Step back, and take some time to analyse any message before you proceed.
A screenshot of the fake alert:
This one never seems to go away!