Yahoo Finance Fake ‘DHL’ email targeting Aussies you should never open
Australians should beware of a phishing email masquerading as delivery company DHL that aims to steal victims’ personal and banking details.
Email security software platform MailGuard said it had intercepted emails that looked like delivery alerts that asked recipients to “complete the shipping transaction” to get the delivery of a package that doesn’t exist.
“Dear customer, you have a package pending delivery in Terminal 1! due [sic] to the unpaid shipping cost,” the email reads.
“Please complete the shipping transaction.
“Confirm the payment 2.99 AUD of the shipment to be able to deliver it,” it continues.
The email also comes with a warning that the package will be sent back to the sender within 48 hours if no action is taken.
MailGuard warned that users who click on the hyperlinks will be sent to a fake page using DHL branding that asks them to input personal information such as their name, phone number, and home address.
Users are then taken to the following page, which asks for their credit card number, expiration date and CVV.
“The domains used in the URLs of these pages, however, do not belong to the shipping company. These are actually phishing pages hosted on a domain that appears to be made specifically for phishing purposes,” MailGuard warned in its latest blog post.
“Once users submit all the information required by these pages, the attacker harvests them for later use.”
Under no circumstances should users click through or provide any of their details, the software platform warned.
“We strongly advise all recipients to delete these emails immediately without clicking on any links.”
Scams tend to increase as the end of financial year approaches, according to MailGuard, with many people likely doing more online shopping and anticipating packages due to deals and sales.
“We’re all eager to get our shopping on time, so we might not think twice before clicking a link in parcel-delivery notifications,” MailGuard said.
The email uses certain techniques, such as creating a sense of urgency by asking users to take action within 48 hours, to motivate people to punch in their banking details without thinking.
Additionally, the inclusion of fake features like a false verification code enhances the perception that the email is real.
But there are many factors that indicate the email isn’t real, such as the absence of a first name (“dear customer”), and spacing and grammatical errors.
If you’ve received this email, forward the email to DHL at phishing-dpdhl@dhl.com.
“Official DHL communication is always sent from @dhl.com, @dpdhl.com, @dhl.de, @dhl.fr or another country domain after @dhl,” the shipping company said on its website.
“We never use @gmail, @yahoo or other free email services to send emails.
“We never link to a website other than our own starting with for example https://dhl.com/, https://dpdhl.com/, or a country/campaign website.”
Australians who receive scam attempts should report them to Scamwatch.
Read more:
Follow Yahoo Finance on Facebook, LinkedIn, Instagram and Twitter, and subscribe to the free Fully Briefed daily newsletter.
