PhonAndroid Parcel scam: this SMS that claims customs fees can ruin your bank account

Beware of this new scam by SMS: a so-called carrier asks you to pay a small sum, in order to send you your package blocked by customs. A scam that only aims to collect your credit card information and use it to make purchases on the Web.

If you frequently order abroad, you have certainly already received a message telling you that you have to pay customs fees before delivery. A link in the SMS lets you pay for them directly online, and until you do, no packages are delivered to you. The procedure is classic and there is nothing illegal about it.

But beware, because a fake SMS is currently circulating and, as evidenced by a reader who contacted us, it is easy to be fooled. The message received is very similar to the one that carriers are used to sending, while the amount requested, which may seem ridiculous, can have serious consequences.

Also read: “Your package has been sent” – this dangerous SMS threatens to empty your wallet

A text message asks you to pay a fee for a package blocked by customs

“Your delivery is being held at our distribution center. Please follow the instructions.” This fairly innocuous SMS followed by a URL does not really arouse suspicion. Especially since when you click on the link provided, the browser does not display any alert and opens it without flinching. And yet, it is indeed a phishing which aims to steal the user's credit card information.

This is the trap into which one of our readers fell and who says: she, who regularly orders in China and who was expecting several packages at the end of last August, clicked on the fraudulent link without really being wary of it. There, a message told her that her package was stuck by customs and that she had to pay 3 euros to unblock the situation.

A minimal sum and a site that looks like two drops of water to that of UPS, there is enough to be easily fooled. Unfortunately, a detail escaped her, she told us. The UPS company logo was actually spelled “IPS”. She noticed it too late and had already entered her credit card information on the fraudulent site.

Two days later, she notices that her card has actually been used to make a purchase on the website of GreenBoozt, whose company is based in Gibraltar. Impossible to say if the site site is at the origin of the phishing or if purchases were really carried out on this one.

A small amount and a proven method

“I made the connection, but I said to myself too bad for 3 euros”, explained the victim to us. The story does not end there, since a week later, a new debit was made on the same site, this time for €44. The turpitudes of our reader could thus have continued until the complete emptying of her bank account if she had not had the reflex to contact her bank. The latter then advised him to launch a complaint for the amounts debited, while affixing an online purchase security on his bank card fixed at zero euros.

Recently, one of the members of the editorial staff also received the SMS in question, the text of which was identical. Only the address had changed. We go from a domain name “itemtt.one” to “f05.me”. In both cases, the URL given is obviously temporary and no longer works at the time of writing these lines. In fact, the entire domain name disappeared within 48 hours of receiving the fraudulent SMS.

The technique is ultimately similar to the one we mentioned a few weeks ago, which consists of asking the consumer by SMS to pay a very small sum in order to reschedule the delivery of a package. Again, you have to pay a small sum (1 or 2 euros) to recover a package.

In conclusion, absolute mistrust when you receive an SMS asking you to pay something before receiving a package. Check the URL carefully: is the carrier only known to you and is its name spelled correctly?. In addition, an amount of 3 euros for customs fees is abnormal. At the very least and in the best of cases, these costs amount to ten euros. Finally, wait a day or two before going to the payment site. If the URL disappears in the meantime, it was definitely a scam.