Landing page banner

The Police would like to alert members of the public to a persistent trend of phishing scams involving the impersonation of courier companies, where scammers obtain victims’ personal details and banking information. Since 24 June 2026, at least 251 cases have been reported, with total losses amounting to more than $1.2 million.

In this variant, victims would receive messages via Apple iMessage. These messages typically originate from foreign numbers bearing country codes such as +212 (Morocco), +63 (The Philippines), +44 (United Kingdom), etc. or from email addresses comprising random alphanumeric strings that appear to belong to recognised couriers such as DHL, NinjaVan, J&T Express and SingPost. These messages inform recipients that their parcels could not be delivered due to an “invalid” address and urge them to update their delivery address within a stipulated timeframe (i.e. by 6pm, 8pm, end of day or within 24 hours) via a link that closely resembles the courier’s genuine URL. In some instances, the messages also include a local helpline number. 

The messages would direct victims to reply "Y" or “1” to acknowledge the message. This is likely an attempt to circumvent Apple iMessage’s inbuilt protections that make a link in a message from an unknown recipient unclickable until the recipient interacts with the sender. Once the recipient responds to the message, they would be able to click the link contained in it.

Upon clicking the link, victims are redirected to a spoofed website that closely resembles the courier company’s official website, where they would be prompted to pay a small “re-delivery fee”. Victims would then be asked to enter their card details and/or internet banking credentials and authorise the transaction using their digital tokens. In some cases, victims’ credit cards were subsequently added to Google Pay or Apple Pay and/or their bank digital tokens were provisioned to unfamiliar devices after the victims were tricked into providing their One-Time Password (OTP), thinking they were facilitating the parcel delivery. Some victims also observed unauthorised logins to their bank account from unfamiliar devices. Many victims would only discover that they had been scammed upon noticing unauthorised transactions made to their cards or bank accounts.

Courier companies typically do not use iMessage in their communications with their customers. Instead, they would usually communicate with their customers through the following channels:

• Messages sent through their registered SenderIDs. Members of public may verify the ownership of the SenderID at https://smsregistry.sg/web/sid-query.
  
  
• Delivery drivers may also contact recipients directly via phone calls, SMS or WhatsApp to verify delivery details. However, unless the parcel is cash-on-delivery or the shipment requires GST payment before delivery, delivery drivers will not request any form of payment from recipients.

In addition, below are some additional communication channels used by the respective courier companies: 

• NinjaVan may also contact customers through Facebook Messenger and Telegram, using their verified business pages. They are also working with WhatsApp to send out notifications through their WhatsApp Business account.
  
  
• J&T Express Singapore uses a combination of communication channels, including SMS, WhatsApp and email, to provide customers with delivery-related updates and customer support. SMS notifications are generally used for routine shipment and delivery updates. These messages are sent using the registered Sender ID “J&T Express”. J&T Express Singapore does not charge parcel redelivery fees.

Police would like to advise the public to adopt the following precautionary measures:

• ADD – ScamShield App and security features (e.g. enable Two-Factor Authentication (2FA), Multifactor Authentication for banks and set up transaction limits for internet banking transactions, including PayNow). 
  
  
• CHECK – the authenticity of the information with the official website or sources. You may check the legitimacy of suspicious messages, phone numbers, and website links via the ScamShield Website at www.scamshield.gov.sg. Even if you are expecting the delivery of a parcel, do not click on links provided in unsolicited messages or emails.
  
  
• TELL – authorities, family, and friends about scams. Report any fraudulent transactions to your bank immediately and report the messages to through the in-app reporting functions.

Members of the public are advised to update their iMessage settings by ensuring that “Filter Unknown Senders” and “Filter Spam” are turned on (refer to Annex B), and to report suspicious messages using the in-app reporting function (refer to Annex C) to protect themselves against such scams.

Anyone with information on such scams may call the Police Hotline at 1800-255-0000 or submit information online at www.police.gov.sg/i-witness. If you require urgent Police assistance, please dial '999'. For more information on scams, members of the public can visit www.scamshield.gov.sg or call the ScamShield Helpline at 1799. Fighting scams is a community effort. Together, we can ACT Against Scams to safeguard our community.

Annex A – Examples of Phishing Text Messages

Annex B – Steps to Activate “Screen Unknown Senders” and “Filter Spam”<sup>1


1</sup>Steps extracted from https://support.apple.com/en-sg/guide/iphone/iph203ab0be4/ios

Annex C – Steps to Delete and Report Scam on iMessage

²Steps extracted from https://support.apple.com/en-sg/guide/iphone/iph3f94d910d/ios