Alert for a scam that uses fake messages about "delayed or held shipments" to steal data.

In an age where online shopping is becoming more common, cybercriminals take advantage of any distraction to deceive and steal personal information . Phishing , which uses fake notifications about delivery problems, continues to gain ground in Argentina .

The message appears to come from a courier company, warning about a supposed delay or held package, and asks the user to enter personal or banking information. That's when you fall for it, and they get what they expected.

The cybersecurity company ESET Latin America issued a warning about this type of fraud, which is already circulating via email, WhatsApp, and other digital platforms. These attacks often appeal to urgency with phrases such as: "Your package is being held," "Fatal delivery information," or "Immediate action required."

Fake email with link to pay supposed customs fees

ESET

ESET analyzes some current examples of email phishing cases, in which cybercriminals simulate a notification from well-known courier companies, using the excuse for contacting them as a supposed need to resolve a problem with a package delivery.

"As with most phishing emails, they use social engineering and appeal to people's feelings, such as anxiety, urgency, or fear. They generally seek to engage people with highly persuasive email subjects," says Camilo Gutiérrez Amaya, Head of the ESET Latin America Research Lab.

The impersonated courier companies identified by ESET are well-known, such as FedEx, DHL, UPS, and Correo Argentino, to name a few. The body of the message resembles the real brand with a high degree of similarity.

• ExpressService: In this case, the malicious actors use the name of a supposed courier company called "Express Service" and appeal to a sense of urgency, claiming a package delivery has been suspended. Upon clicking the button to supposedly resolve the issue, the user is taken to a fake form where the data entered will be used only by the cybercriminals.
• FedEx: Another example is one that impersonates FedEx, asking the potential victim to confirm their information so that the supposed package can be shipped.
• Shipping companies : Another commonly used lure is a supposed shipping update. They urge people to check the details to find out the delivery status.

Example of a fake email inviting you to enter a phishing link.

ESET

"In these last two cases, we see how a customs charge is what would delay the delivery of the supposed package. So, in addition to the theft of information on false forms, it also leads to a payment that will only go to the cybercriminals' account," notes Gutiérrez Amaya of ESET Latin America.

ESET offers recommendations for identifying a malicious email from a genuine one and avoiding scams:

• Stop and think about whether you're really expecting a shipment. If the answer is "no," it's likely a scam.
• Check if the sender is legitimate. These types of scams typically present a sender that's clearly different from the legitimate one, so it's always a good first step to keep an eye out for them.
• Be alerted if there's a request for sensitive information, whether personal or banking . This should set off alarm bells.
• Check where the link included in the email leads : It's always important to verify that it leads to the official site.
• Observe if there are any spelling or writing errors , although Artificial Intelligence has significantly improved this type of email.

ESET also emphasizes that there are several key points to consider to significantly reduce the risk of falling for this type of scam. These include:

• Pay special attention and be wary of communications that arrive unexpectedly and with a strong sense of urgency. Do not click on or download attachments.
• Communicate through the official channels of the courier and parcel service regarding the authenticity of the email received and the alleged package in question.
• Always check the page you access to provide personal data: it must be secure and the URL must correspond to the real one.