NZ Post, Westpac warn of text message phishing scam aimed at infecting devices

Scammers posing as NZ Post staff have sparked a new warning about fake parcel delivery texts sent from email addresses.

NZ Post said it was aware of the text message campaign.

“Your package has arrived at the warehouse and has been suspended for delivery due to a missing home number in the package,” one such text reads.

The message then urged recipients to open a link.

NZ Post also advised people not to click the link, but to report the message to the Department of Internal Affairs by forwarding it to 7726.

Westpac has also warned customers about the new parcel delivery text phishing scam.

The latest phishing scam has been sent to Kiwi mobile phone numbers from various email accounts. Photo / NZ Post

The bank shared examples, one of which was sent from an Outlook email address and another from a Gmail account.

Westpac urged people not to click on the link in the message.

“These links direct people to malicious sites that will either infect their device or obtain personal details to compromise their bank accounts.”

The bank said people should report the scam to Internal Affairs, then delete the message and block the sender.

“Please be extremely vigilant for any unexpected or suspicious phone calls or text messages,” Westpac said.

The "suspended delivery" parcel message is designed to infiltrate people's phones. Photo / Jason Dorday

“Read carefully to understand what is being asked for. If you believe you’ve been targeted by a scam, contact your bank immediately.”

Parcel delivery scams have been reported before, but tend to be more common near Christmas.

Cybersecurity agency Cert NZ’s latest quarterly report said NZ Post was the country’s most impersonated brand in late 2023.

The agency’s phishing disruption service received 1086 reports of websites impersonating NZ Post in the fourth quarter of the year.

Scammers on phishing expeditions sometimes trawl through public databases to find contact details.

Phishing broadly refers to scammers contacting many people, hoping some will click on links or take the bait, allowing con artists to harvest more information about the target, or gain access to bank accounts or credit card numbers.