The fake parcel
A message announces a held parcel and asks for a trivial sum to release it. The sum is not the point: what the message has come for is your card number, and it is counting on the fact that nobody is suspicious over so little.
The bait
A tiny sum and a real expectation: waiting for a parcel is all it takes for the message to land right.
The signs
None is proof on its own. One is enough to stop.
- The sum is trivial, and that is the point: nobody is suspicious over so little
- The link leads to a page asking for a card, when a carrier bills the recipient in another way
- The address of the site does not match the carrier named, or carries a name that is almost right
- You have not ordered anything anywhere, or you cannot tie this message to a particular order
- The message creates a deadline: without an answer today, the parcel goes back
The reflex, in this order
- Do not click the link in the message.
- Check the order in your own account with the seller, or by finding the tracking number the seller sent you themselves.
- If you clicked without entering anything, nothing happened: close the page.
- If you entered a card, have it blocked and watch for small debits: a first tiny amount is often used as a test.
If it has already happened
Nobody gets caught out of stupidity: these traps are built to work. What matters now is the order of the steps.
- Stop the card that was used.
- Ask your bank in writing to cancel the unauthorised operations.
- Report the message: look for the reporting address on the official site of the messaging service or the carrier, never in the message itself.
Who is targeted
- Teenagers
- Adults
- Parents, teachers, carers
This page describes the trap so that it can be recognised. It deliberately gives no script, no message template and no tool: enough to defend yourself, never enough to run it again.