This is what can happen if fall for “we couldn’t deliver your parcel” text message

We often talk to victims of online crimes after they get in touch with us to share their experiences. Here we talk to Grace – not her real name – who received an SMS message about a failed delivery from DHL. She responded and this is what happened.

The transcript below has been edited for clarity.

Describe the text message you received.

The message said it was from DHL, and that they tried to deliver a parcel to me but I wasn’t in and needed to pay £2.50 to get it reshipped to me, which I thought was very annoying as most couriers just leave stuff in the shed if we’re not in. But I had been expecting a few things to arrive from a clothing store so, reluctantly, I clicked the link in the message to pay and get the parcel shipped to me.

When you clicked the link, what were you asked for?

It took me to a website that asked for my name and address. Then it asked me for payment details to pay for the shipping cost, including my bank details and my bank account number, and who I bank with. I entered it all into the site and it said thanks for the payment and to expect my parcel in the next 2 working days.

Sponsored Content. Continued below...

What happened after that?

I checked my bank account balance on my online banking site and no money had been taken out for the shipping cost which I thought was a bit weird but then I thought maybe it would be deducted after the parcel got delivered. But the next day I got a call from someone called Colin who said he was from by bank and said I had been targeted by scammers and needed to move my money to a different account to keep it safe.

Okay, before we go too far into that phone call, can you describe the start of it? Did you believe Colin was from your bank to start with? How did he convince you he was legitimate?

He was really convincing from the start. He spoke in a Scottish accent and said he was from [bank name redacted] which is who I really do bank with and he knew my name. He said he had to authorise himself before we could start speaking and he did that by saying my postcode and the last 3 digits of my bank account, which were both right. So I assumed he really was from my bank.

And he said you needed to move money from your bank account?

Yes. He asked if I had received any unexpected text messages and I said about the one from DHL. Straight away he said that was a scam and the scammers were trying to access my account. But he said not to worry because he – as in my bank – had caught the scammers out, but I had to move my money into a safe account belonging to the bank to make sure the scammers didn’t get it. He made it sound really urgent and I had to do it now. He gave me a bank account number and I transferred the money – all of it, which was around £800.

Sponsored Content. Continued below...

Then what happened?

He said the money would be returned the next day and when I logged in there was still nothing in there. So I called my bank myself and they said they had not been in contact with me, and no one there would ask me to transfer money from one account to another. They transferred me to an anti-fraud team and that’s when the ball dropped. The scammers had sent me that first text, and it was also the same scammers that called me up saying they were from my bank. There was no safe account. The bank account belonged to the scammers, and they had taken everything.

What happened after that?

The anti-fraud team said they were going to investigate. I heard back later that my money have been funnelled away from the bank account I had sent it to, so they couldn’t just reverse the transaction. They said I could try and claim the money bank, but because I voluntarily sent the money this may not be possible. They have given me the contact details to their escalations team who I am currently talking to, but right now I don’t know if I’m ever going to see any of my money again.

—

Sponsored Content. Continued below...

This scam is a double phishing scam and has been particularly popular during times of lockdown when high numbers of people are expecting parcel deliveries.

The first phishing scam is the fake text message after the personal details of the victim.
The second phishing scam is the scam phone call from the crook pretending to be from the victim’s bank.

The second phishing scam is the crux of the scam, since the scammer now has the victim’s personal information that they harvested during the first phishing scam.

You can see how “Colin” used the information he obtained from Grace during the first part of the scam against her. He used her name, knew her bank and “confirmed” her postcode and bank account number. He knew this not because he was from Grace’s bank, but because she gave that information away on the spoof website she visited after clicking the link in the fake text message.

Remember –
– No bank will ask you to transfer money from your account to a “safe” account.
– Don’t click on links in a text. If you do, check the web address at the top to make sure you’re not on a spoof website.
– Be cautious of unexpected phone calls, and if in doubt, hang up and call back on an official number you know is genuine.

We have a post dedicated to explaining how to avoid such text scams which you can read here.