Over the past few years,
cybercriminals have been duping people in the name of FedEx, a global courier service. They started tracking people who were frequent travellers abroad and then expanded their reach. These criminals have now expanded to more worrying and dangerous territory—they are using the name India Post to send spoofed messages about letters and parcels, asking people to call or click on a link attached to the message.
What is more serious is the 'creative' use of newer websites that try to mimic the name of India Post. For example, if you glance through the indlapostt.net and indlaposta.com web addresses, you may think they could be related to India Post. However, it is not so. And both these portals (now inactive) were created by fraudsters as deceptive portals to dupe people.
The use of India Post is particularly scary since the government uses this service to send official documents such as passports, Aadhaar, PAN cards, driving licences or service notices about statutory filing and compliances. The chances of people falling victim to India Post fraud are significantly higher.
Here are two messages that are being used or sent by the cybercriminals.
"We are unable to ship your order because the address you entered is invalid. Please fill in the shipping address correctly https://indlapostt.net/in"
When one tries to access indlapostt.net, Firefox blocks and warns about the deceptive nature of this portal. It says, "Firefox blocked this page because it may trick you into doing something dangerous like installing software or revealing personal information like passwords or credit cards."
Several users have reported indlapostt.net as a deceptive (read: fraudulent) website.
The other website, indlposta.com, cannot be found.
Both these websites are registered anonymously and the ownership details are hidden using services provided by PrivacyGuardian.org. While indlapostt.net's site status is inactive, indlposta.com remains active, as per information from Who.is.
Most of these dubious websites ensure that the site owner's details are made private (hidden) from the public view. They also remain active for a very short period—from a few days to a few months—before vanishing. By the time a victim files a complaint and law enforcement agencies (LEAs) can take action, the fraudsters have probably set up a new website to lure other victims. Organisations like PrivacyGuardian.org take quick action once notified by an LEA but, in most cases, fraudsters can remain untraceable for longer.
In a postal delivery or courier scam, scammers trick individuals into thinking they have missed a delivery or need to take action regarding a package. These scams usually take the form of fake emails, text messages, or even phone calls, supposedly from legitimate delivery services like India Post, as mentioned above. These criminals often aim to steal personal information and credit card details or install malware on your device.
Here are some postal or courier delivery scams that you should be wary about since they have defrauded many people:
Missed delivery notification: You receive an email or text stating you have missed a delivery. It may prompt you to click a link to reschedule or view details.
Fake delivery fee: Scammers ask you to pay a fee for a package they claim is waiting for you. This often requires entering credit card information.
Fake tracking numbers: Scammers send a fake tracking number that leads to a malicious website when clicked, potentially installing malware or phishing for data.
Prize or gift delivery: You are told you have won an award or gift and must provide personal information or pay a small fee to receive it.
Phishing via spoofed delivery companies: Scammers impersonate well-known courier services with very authentic-looking emails or websites to gather your details.
As with all cybercrimes, there are no foolproof methods that can protect you. However, following a few suggestions may help you save yourself from becoming a victim.
First and foremost, if you have not sent any parcel or courier and are not expecting one, simply ignore (and delete the SMS/ email). In case you have sent a parcel or are expecting one, then it is always better to visit the official website of the courier company and contact the numbers provided there. You can also find the official numbers on the receipt you received while booking the parcel.
Here are a few more suggestions...
1. Verify the source: Do not click on suspicious links. Instead, visit the official website of the courier company or India Post (as the case may be) and check your delivery status directly by entering the tracking number, if available.
Beware of unexpected messages asking for personal details or payments.
2. Check for red flags: Look for spelling mistakes, incorrect logos, or odd email addresses. For example, both the websites mentioned above try to mimic the India Post name in their URLs.
If a call raises suspicion, hang up immediately. Also, do not respond to calls or messages from unknown numbers. You can use an app to check the caller's identity.
Remember, legitimate companies usually do not ask for personal information via email or text.
3. Avoid giving personal information: Never provide sensitive information like your bank account details, credit card details, Aadhaar number or login credentials via email or over the phone unless you are sure of the recipient's identity.
4. Do not respond to communication from unknown people: Fraudsters often target senior citizens. Therefore, it is crucial for seniors to learn and understand such frauds. You can also help seniors from your home and locality understand the importance of not responding to unknown callers and sharing personal information, including bank and other financial details.
5. Use strong security practices: Enable multi-factor authentication (MFA) on your accounts for added security.
Keep your devices updated with the latest security patches.
Install antivirus software and enable real-time scanning to detect any potential threats.
6. Report the scam: If you receive a suspicious message, report it to the relevant postal service or courier company. They may have a dedicated page for reporting phishing or scam attempts.
You can report suspected fraud communication and unsolicited commercial communication (UCC or spam) on the Chakshu portal (
https://sancharsaathi.gov.in/sfc/) of the department of telecommunications (DoT). However, remember, the Chakshu facility does not handle financial fraud or cybercrime cases.
If you have already lost money due to financial fraud or are a victim of cybercrime, you need to report it to the national cyber crime helpline number 1930 or by visiting the website
https://www.cybercrime.gov.in
Always remember, these fraudsters use sophisticated psychological tactics to manipulate their targets. That is why awareness and preventive measures are your best defence against these cybercrimes.
By staying alert and taking these precautions, you can avoid falling victim to postal delivery scams.
Stay Informed, Stay Sceptical!
How To Report Cyber Fraud?
Do report cybercrimes to the National Cyber Crime Reporting Portal http://cybercrime.gov.in or call the toll-free National Helpline number, 1930. To follow on social media: Twitter (@Cyberdost), Facebook (CyberDostI4C), Instagram (cyberdostl4C), Telegram (cyberdosti4c).
If the fraud is related to your bank account, you need to immediately send an email to the official email ID of your branch (you can find it on the bank's website or your passbook) with a copy to the bank's customer care. Even if you have called the official number for customer care, you must still send an email describing your conversation with the bank executive, along with the time, date, and duration of the call. It will be helpful if you face a liability issue with the bank.
