Fake parcel delivery messages steal your card and bank details
Phishing emails impersonating bpost claim a €4.95 customs fee to trick Belgian customers into submitting card and bank details on fake courier sites.
A recent campaign targeting customers of the Belgian postal service bpost uses Dutch-language emails claiming a package was undelivered due to unpaid €4.95 customs duties, then directs victims through a URL shortener to fake bpost domains such as bpost.center that harvest personal data, IBAN, and full card details. Similar parcel delivery scams impersonate USPS, Colissimo, Chronopost, Correos, Poste Italiane, and PostNL across multiple countries. Stolen card data may be used for fraudulent purchases or sold to other criminals.
- Emails claim €4.95 unpaid customs duty to lure victims to fake bpost sites
- Links route through a URL shortener (qr.paps.jp) to lookalike domains
- Fake pages collect name, phone, IBAN, and full card details
- Parallel campaigns impersonate USPS, Colissimo, Chronopost, Correos, Poste Italiane, PostNL
- Advice: verify deliveries via official apps, freeze exposed cards, contact bank
- Vendors
- Malwarebytes
- Victims
- bpost customers
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | bpost.be-pakje-ontvangen-nl-recevoir-colis-fr.my.id | ampaign used several fake bpost domains, including: hxxps://bpost[.]be-pakje-ontvangen-nl-recevoir-colis-fr[.]my[.]id/ bpost[.]center , which is the domain shown in the sc |
| domain | bpost.center | /bpost[.]be-pakje-ontvangen-nl-recevoir-colis-fr[.]my[.]id/ bpost[.]center , which is the domain shown in the screenshots below. The |
| domain | qr.paps.jp | ink first passes through a URL-shortening service ( hxxps://qr[.]paps[.]jp/1GWsa ) before redirecting to a fake bpost site. The ca |
| url | https://bpost.be-pakje-ontvangen-nl-recevoir-colis-fr.my.id/ | e. The campaign used several fake bpost domains, including: hxxps://bpost[.]be-pakje-ontvangen-nl-recevoir-colis-fr[.]my[.]id/ bpost[.]center , which is the domain shown in the scr |
| url | https://qr.paps.jp/1GWsa | ks The link first passes through a URL-shortening service ( hxxps://qr[.]paps[.]jp/1GWsa ) before redirecting to a fake bpost site. The campaign |
From the original article
3 min read at malwarebytes.com
Parcel delivery phishing messages impersonate familiar couriers and use small fees or promised refunds to steal personal and financial information.
By @malwarebytes · malwarebytes.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.