Victims would receive a message claiming of a failed parcel delivery to their addresses. They would then be instructed to click on a link to confirm their addresses. Those who do so would enter a phishing site. - Photo: Singapore Police Force
SINGAPORE: A surge in parcel delivery scams in 2024 has cost victims here at least S$616,000, the police warned on Friday (Sept 20).
At least 338 such cases have been reported since Jan 1. So far, the bulk of these cases – at least 266 of them – involved scammers impersonating national postal service provider SingPost, which resulted in at least $495,000 lost in total.
Victims of these scams would first receive a message claiming of a failed parcel delivery to their addresses. They would then be instructed to click on a link to confirm their addresses.
Those who do so would enter a phishing site, which would prompt the victim to key in their credit or debit card details.
Victims would realise they have been scammed only when they notice unauthorised transactions on their affected cards.
The police said they have also observed online messaging applications like iMessage and Rich Communication Services (RCS) being abused by these scammers to deliver phishing messages.
In one case, the scammer, using a number with a British country code, named an RCS group chat as Singapore Post in an attempt to impersonate SingPost.
“While there are safeguards such as the SMS Sender ID Registry to protect the public from spoofed SMSes, such protection does not extend to online messaging applications,” said the police.
Under the registry system, unregistered organisations that send SMS messages to Singapore mobile numbers will have their sender profiles marked with the words “Likely-SCAM”.
The public should be alert when they receive messages from unknown contacts through a group chat on such messaging applications, said the police.
Group chats can be renamed to mimic legitimate sender profiles used in SMS, and used by scammers to impersonate legitimate entities in such group chat settings.
SingPost has said on its website that it will not send SMSes to request for any payment before delivery or personal information. SMSes from SingPost comes from the SMS Sender ID “SingPost” and will not contain clickable links.
SingPost receives payments made only on the official SingPost mobile application, post offices, and self-service postal machines.
The police advised the public to take the following precautions.
# Add the ScamShield app and set security features. For example, users can set up transaction limits for credit and debit card transactions, enable Two-Factor Authentication (2FA) and Multifactor Authentication for banks and e-wallets.
# For iMessage, enable a setting that would filter out messages from unknown senders or disable the iMessage if you do not expect messages from this channel.
# Report phishing messages from iMessage to Apple and for Android RCS to Google.
# Do not respond to unknown numbers on online messaging applications until the sender’s identity can be verified.
# Verify the information in text messages with the company or e-commerce platform directly.
# Avoid iMessage and RCS group chats by unknown senders. A group chat can be identified by looking for the prompt indicating that you have been added to a group chat, as well as other key design features distinguishing them from other message types.
# Tell the authorities, family and friends about scams.
Any fraudulent transaction should be reported to the bank immediately.
Those with information about such crimes or are in doubt should contact the police at 1800-255-0000, or at this website.
The public can visit this website or call the Anti-Scam Helpline at 1800-722-6688 for more information on scams. - The Straits Times/ANN
