Parcel delivery scam using Android group messages
Take action: Don't rush! Never trust unexpected delivery messages in group chats, especially from foreign phone numbers - legitimate postal services don't operate this way. Go directly to your postal service's official website or call their official number to check if you actually have a package.
Learn More
An active delivery notification scam is impersonating postal services distributed through Android RCS group messaging. The attackers are attempting to steal personal information and potentially payment details by creating urgency around a fake package delivery.
The variant that was reported is a message in Macedonian, translating to:
"Reminder for Macedonia Post: Your package has been delivered to our warehouse, but we are unable to deliver it due to incomplete address information. Please carefully fill in the information and resubmit it. We guarantee that your package will be delivered within 24 hours of receiving the correct information. Click here to access your address."
There are some grammar errors in the code, indicating that the site is auto-translated ("нашој"). It's also illogical for a message about an individual package to be sent to a group chat, but the criminals don't care beause they hope someone will click on the link.
On top of that, the primary sender of the message is+55 21 92041-0984 (Brazilian number) and the group creator is +225 05 46 22 1252 (Ivory Coast number). None of this makes sense.
The link leads via a URL shortener to a site kinohg.com/mkk/content. Because there is a path in the url related to Macedonia (mkk), it is very possible that there are other paths that impersonate different posts or parcel services on the same server.
The page layout and font color make no sense compared to the original page. The page looks very rushed in editing, and probably nobody tested it.
The attackers are attempting to steal:
- Personal Information
- Card payment Information
- Possibly Identity Documentation:
This vector of scam via a group message is effective because group messages appear more trustworthy than individual spam. Members may think others in group received legitimate notifications. It's also much harder to report spam from a group chat than traditional one-to-one messages. Encryption of these messages makes detection more difficult for security systems
How to stay safe:
- Don't rush - nothing is too urgent
- Never trust unexpected messages - don't click on any links, open files or call numbers in unexpected messages.
- Verify independently - check for a parcel via the official website and contact services of your parcel services.
- Consider the context - International phone numbers and messages in a group chat make no sense for domestic postal services
