More than $1.2m lost to scams involving courier firms and Apple’s iMessage
Sign up now: Get ST's newsletters delivered to your inbox
The scammers would impersonate courier companies and send potential victims messages via Apple’s iMessage function.
PHOTO: LIANHE ZAOBAO
- Scammers impersonate courier firms using Apple iMessage to trick victims into paying fake re-delivery fees, resulting in over $1.2 million lost since June 24 across at least 251 reported cases.
- Victims receive messages with fake links and are asked to provide credit card and bank details, leading to unauthorised transactions and accounts being compromised.
- Police advise that courier companies rarely use iMessage, recommend enabling spam filters, and urge the public to report suspicious messages and verify contacts via official channels.
AI generated
SINGAPORE – Received a message from Ninja Van or DHL notifying you of a failed delivery because of an invalid address? Be careful as this may be a ruse to obtain your personal and banking information.
The police on Aug 5 warned of scammers impersonating courier companies and sending potential victims messages via Apple’s iMessage function.
More than $1.2 million has been lost to such scams since June 24, with at least 251 cases reported, the police said.
In such cases, victims would typically receive messages from numbers bearing foreign country codes, or from e-mail addresses comprising random alphanumeric strings imitating recognised couriers such as DHL, NinjaVan, J&T Express and SingPost.
Recipients would be told that their parcels could not be delivered due to an invalid address. They would be urged to update their delivery address through a link that resembles the courier’s genuine URL, and given a deadline to do so. In some cases, the messages also include a local helpline number.
Recipients would be told to reply with “Y” or “1”. This is likely an attempt to bypass Apple iMessage’s inbuilt protections, which prevent recipients from clicking on links in messages until they have interacted with the sender, police said.
Victims would typically receive messages from numbers bearing foreign country codes, or from e-mail addresses comprising random alphanumeric strings imitating recognised couriers such as DHL, NinjaVan, J&T Express and SingPost.
PHOTO: SINGAPORE POLICE FORCE
Upon clicking on the link, victims are directed to a fake website that looks like the courier company’s official page, and prompted to pay a “re-delivery fee”.
They are asked to enter their credit card and internet banking credentials, and authorise the transaction with their digital tokens.
In some cases, their credit cards would later be added to Google Pay or Apple Pay. Victims’ bank digital tokens may also be set up on unfamiliar devices after they were tricked into providing their one-time password.
Some victims also observed unauthorised logins to their bank account from unfamiliar devices.
Many of them would discover they had been scammed only after noticing unauthorised transactions made to their cards or bank accounts.
Courier companies usually do not use iMessage to contact their customers, the police said. They typically communicate through messages sent via their registered SenderIDs, which the public can verify at https://smsregistry.sg/web/sid-query
Also, NinjaVan may contact customers through its verified business pages on Facebook Messenger and Telegram, police said. It is also working with WhatsApp to send out notifications through its WhatsApp Business account.
J&T Express Singapore uses several modes of communication, including SMS, WhatsApp and e-mail, and does not charge parcel re-delivery fees.
Delivery drivers may also contact recipients directly through phone calls, SMS or WhatsApp to verify delivery details, but will not ask for any payment, unless the parcel is cash-on-delivery or the shipment requires GST payment before delivery.
The police advised the public to turn on “Filter Unknown Senders” and “Filter Spam” in their iMessage settings, and to report suspicious messages using the in-app reporting function.
To contact the police on such scams, call 1800-255-0000, or go to www.police.gov.sg/i-witness