Yahoo Finance Warning to millions of Australia Post customers: ‘Your package is waiting’
Australia Post has once again been mimicked in a new phishing scam, which intends on stealing customers credit card details.
MailGuard has warned Aussies to be on the lookout for an email with the subject line “Your package is waiting for delivery” with the sender name AUSPOST.
While it may all seem legitimate, the emails are actually coming from random addresses, which are registered in Egypt and the Dominican Republic.
Also read: How this Australia Post road rule could cost drivers $116
Also read: Australia Post to hire 4,000 as parcel deliveries soar
Also read: Australia Post to pay Christine Holgate $1.1 million
“While the email itself is relatively straight forward, you’ll see an Australia Post logo and copyright to provide a level of authenticity,” MailGuard said.
“The text is littered with grammatical errors, but briefly explains that your parcel is on hold in the warehouse, and to track it by clicking the button.”
Here's what the email looks like:
After clicking the ‘Track’ button, the user is taken to an information page which looks similar to the item tracking page Australia Post uses.
“This page does not contain any phishing content, instead it provides background information in the hopes of feigning legitimacy before the attack happens,” MailGuard said.
“At first glance you could be forgiven for thinking this is a legitimate Australia Post page.
“However, on closer inspection, you’ll notice that all of the information is generic. There’s no information on where the package is coming from.”
On this page, the customer is informed that “Your parcel hold in warehouse”, and users are instructed to schedule a new delivery by clicking a button.
Once the customer chooses to schedule a new delivery, they’re taken to the phishing page where they’re informed that they need to pay $2.47.
They are then instructed to enter some personal information, including:
Credit card number
Expiry date
CVV
Last 4 digits of your phone number
If the customer enters information and chooses to ‘Continue’, they’re redirected to a page which appears to be processing the request.
Companies like Australia Post are often the target of impersonation in phishing attacks, due to their widespread customer base and trusted brand.
Although the email itself is relatively simple, the care taken when creating the web pages has the potential to fool many unsuspecting customers.
Australia Post advise customers that they will never:
Email or call you to ask for personal or financial information including password, credit card details or account information
Call or email you out of the blue to request payment
They also ask that if you receive any suspicious emails, please:
Delete them immediately
Do not click on any links or attachments
Report to SCAMwatch or Stay Smart Online
MailGuard advises all recipients of this email to delete it immediately without clicking on any links.
MailGuard urged users not to click links or open attachments within emails that:
Are not addressed to you by name
Appear to be from a legitimate company but use poor English or omits personal details that a legitimate sender would include
Are from businesses that you were not expecting to hear from
Take you to a landing page or website that is not the legitimate URL of the company the email is purporting to be sent from
Follow Yahoo Finance on Facebook, LinkedIn, Instagram and Twitter, and subscribe to the free Fully Briefed daily newsletter.
