5

I received a strange SMS which my Android phone classified as spam (first time that has ever happened to me):

enter image description here

It says

Hello [My surname and name, misspelled] Your package is still pending. Confirm your information here: [URL].

Normally, I would ignore such messages outright. But two days ago, I made a purchase from a Chinese seller on Etsy and decided to also enter my phone number, to increase the odds of being notified if my package is stuck in customs. So I wonder if the message is somehow connected to the purchase. The seller itself seems legit, with 1000+ real-looking reviews collected over a couple of years.

I did click on the link (I know, it was stupid, in hindsight), saw a DHL logo loading, and closed the site again without waiting to see what else is there.

I am now wondering what may have happened. Is this a mere coincidence, with me randomly receiving spam via SMS (something I have never had before)? Or is it some scam connected to the purchase? Maybe the seller didn't do anything bad, but a rogue employee in the shipping service read my number off the package label and entered it into a scammer's database? Or could it even be that some small local delivery company is trying to give me a real way to track my real package, but their system is terribly implemented?

What is also strange is that my real name is on the message - but misspelled, in a way that just screams "human error". I don't know how the message sender got my number, but it was not from some electronic form where I entered my own name.

I am leaning towards the scam interpretation, but I have never heard of that particular scheme before. Is it known, and is there something I have to/can do to protect myself further?

4
11

There is a recent scam going the rounds which is very similar to this. See US warning and UK warning and the comment by BernhardDöbler on Germany.

The basics are that you get a text supposedly from a mail/parcel/delivery service with a link. Either in the text or on the website if you click on the link, you are advised of a minor additional payment needed, and asked to enter payment details which can then be stolen.
In these times of lockdown, a lot of people have ordered items online and are likely to expect packages, so this scam doesn't even need to be specifically targeted at anyone.

Do not click the link - or if you do, do not enter any details on the website (and leave quickly as OP did).

If you need to check on the parcel, talk with the seller as the other answers suggest

3
  • 2
    There was an interesting twist I read about the other day - someone fell for one of these sites, got scammed out of like $2, and then the scammers posed as their bank - "you fell for a scam, we need to send you a new bank card, please confirm your bank details". The first scam lent credence to the more effective second scam. – ceejayoz Apr 8 at 17:24
  • I've always wondered, does leaving quickly really help? Computers can execute a lot of code in the bare minimum second or two a human will take to recognize a scam web page. – stannius Apr 11 at 15:26
  • @stannius. True, if the link itself is the source of problems then as soon as you've clicked you are in trouble and something may download long before you see a webpage (if you even do). That's why "do not click links" is always the best policy. However with "social engineering" scam sites that want you to enter bank details like this one, leaving quickly is better than staying & filling in forms, or having a "helpful" chat window start asking you questions. – Dragonel Apr 12 at 15:02
6

Messages like this (I've usually seen them without the name) are often phishing messages with the goal of getting you to provide your personal information to enable the scammers to do nefarious things (gain access to your bank accounts, borrow money in your name, etc.). Having some of your information, but not enough for such actions, can make it easier for a scammer to craft a believable message to get the rest of your information needed for such theft. I would typically consider this a phishing message and ignore it (and maybe worry about where they scammer got my name and phone number - if publicly listed information, not much a of a problem, but if stolen from somewhere then what else might they have gotten with it?).


Since you are expecting a package (and it sounds like you don't know how it will be shipped), it is possible that this is legitimate. This means that if you follow the link and enter your information, either 1) you get details about your shipment or 2) your information gets stolen. Rather than take the risk, you should contact the seller/shipper directly and ask for an update or tracking information related to the package.

3
  • 4
    It's a scam for sure. The "Deutsche Post" doesn't ask recipients to confirm their data. The Sender defines where a package is sent, not the receiver in the internet. – Aganju Apr 7 at 15:46
  • Considering the recent publication of Facebook scraped data with name + phone number that might be a potential source of that information. – David Mulder Apr 8 at 9:06
  • Two more signs that this is a phishing attempt is the "http" link (instead of "https") and the grammatical error in the text: "Bestatigen" should be "Bestätigen" here. – Katai Apr 8 at 9:27
3

Just a phishing attempt.

I checked trasuawhite.com which is cited in the text. I can't recognize the language/alphabet, but looks like a fastfood/restaurant.

Screenshot

This screenshot is interesting. Perhaps the website owner doesn't spend much time or resources on maintenance, and the website uses WordPress, one of the most famous and most attacked CMS ever.

My suspect

The website was hacked in order to upload a phishing website under the /pkge/ directory. Clearly the main website is not a parcel delivery service. By not having the full URL, which may contain some fake delivery ID code, I couldn't display the page asking for information

Why I "clicked" on the link", or at least why I tried reaching the website

In general, it should be advisable not to click for a variety of reasons. If the linked page asks for credentials or payment (as described in the other answers) it is mostly innocuous. Some phishing pages also ask for installation of extensions (read, malware). A rare number of page might exploit a browser vulnerability to install malware without user consent. Another number of page will attempt to redirect the browser and clevery use Javascript to prevent the user from leaving the page.

This is why general users should not attempt to follow the links, and why security experts would use a container/VM to try to browse the affected website. Experienced users know how to clear cookies, correctly close a tab that refuses to be closed.

2
  • Oh interesting, I tried researching whether trasuawhite.com is a known malicious site before posting here, but found no results. I never thought of visiting the site without the fake delivery code. Now that it is clearly not connected to a real package addressed to me, I can give you the rest of the URL if you are interested - after 'pkge' comes '/?xw65ho1ejpsu'. I was able to close it normally, on Chrome on Android, but since I don't have an antivirus package on the phone, I don't know if something further might have happened. I have not enabled installation from outside of playstore though. – rumtscho Apr 8 at 11:54
  • Interestingly, the page is blank. I.e. it returns no HTML code. But SmartScreen warns me about the dangers of visiting that URL and I had to override. I suspect that the server side scripting requires a certain browser to return a meaningful answer. I have seen this in mobile trojan injection. Remember that browser vulnerabilities are unicorns. – usr-local-ΕΨΗΕΛΩΝ Apr 8 at 12:10
2

Why don't you contact the seller you bought from through Etsy itself and ask if they have the information correct to shi your merchandise?

Since you bought it through Etsy then that seems like the simplest solution.

Otherwise, consider it a phishing scheme and don't fall for it.

1

Had a similar one in an email last week (U.K.) DHL logo, the lot. Said that in order to deliver my parcel (I'm expecting several), would cost me £2. Asked for details of card so I could pay. Needed a code, which arrived at the same time on my phone. Given 2 minutes to tap in code. Stupidly I did it all, then realised it was a scam.

There was a list of others, all with same email provider, all in alphabetical order. Bit of a giveaway! Couldn't confirm with DHL, so rang bank, cancelled card - they were luckily too slow to clean me out, but still have relevant details.

Do nothing, please.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.