UAE authority warns public over phishing links posing as major courier companies

The UAE's telecoms watchdog has warned consumers to be alert for unexpected SMS messages that appear to be from well-known courier companies, as they could be a phishing scam.

Cybercriminals attempt to entice users to click on a link leading them to a site where they are asked to submit personal information, said the Telecommunications and Digital Government Regulatory Authority.

This is then used to steal the consumer's money or identity.

These phishing attempts often purport to be from major postal and courier companies and ask recipients to click on a link to pay delivery fees or track a delivery.

The TDRA issued its warning after blocking a message sent to several UAE residents on Tuesday that turned out to be a phishing scam.

“TDRA took the necessary action by stopping the source of the message and blocking the links,” the authority said in a tweet.

It urged users to establish whether links are genuine before clicking them.

“TDRA strongly advises the public to check through the official websites or apps of these entities in order to prevent electronic fraud. Please alert police about the fake messages,” it said.

Abdulla Al Hashimi, director of information security at Emirates Post, said recently many scammers have used the postal service's name in a bid to deceive victims.

“We received many calls and messages from people who were scammed. Please be careful,” said Mr Al Hashimi in a video posted by Emirates Post on its social media channels.

He advised consumers to verify the source of the phone number and any email link before replying.

The public were urged to call 600599999 or email custservice@emiratespost.ae

How does the scam happen?

Customers awaiting an order may receive an email or a text message from a delivery company requesting payment for a delivery or customs clearance fee.

Following the link from the message, customers are redirected to a fake page that requests their bank card details to process the payment.

As soon as the customer submits the form, the “fee” is deducted from their bank account and transferred to cybercriminals, along with the customer's bank card details.

DHL says on its website that SMS scams often include a shortened URL — sometimes starting with https://bit.ly/ — to hide the final destination of the link and the sender number is not visible, replaced instead with a generic name such as 'Delivery'.

It said anyone who has received a suspicious SMS should send a screenshot to phishing-dpdhl@dhl.com and include the suspicious phone number in the message.

Aramex delivery company advises customers who receive an Aramex tracking number to verify its authenticity by entering it on its website.

“If there are no tracking results returned, it is not a valid tracking number and Aramex did not send the email,” the company said.

It urged customers to be suspicious of any request not coming directly from an Aramex employee or domain name.

Dubai Police said anyone who falls prey to scammers should report the incident through E-crime platform by Dubai Police.

“Always remember not to share your bank details through the phone call or online,” said Brig Saeed Al Hajri, director of Cybercrime department at Dubai Police.

“We've highlighted the cybercrime issue from the early stages. Cybercrime is constantly evolving, especially in light of the rapidly advancing technology which helps to commit crimes from overseas.

“Fraudsters will be jailed for at least one year and fined between Dh250,000 ($68,000) to Dh1 million if they commit such fraud, as per UAE laws.”

E-crime platforms were used by 25,841 people to report cybercrimes in the country in 2021.

“The e-crime platform has significantly helped curb cybercrime and detect new methods of scamming people. It is easy to use,” Brig Al Hajri said.

Last year, Sharjah Police said household names, including Aramex and Emirates Post, had been impersonated by hackers, sending customers links to bills via WhatsApp or text message for a small delivery charge of Dh10 and then stealing bank account or card details.

Research in 2021 by UK technology website Comparitech estimated that UAE residents lose $746 million a year to cybercrime.