Singapore Police said phishing scams impersonating courier firms such as TracX Logis, uParcel and Park N Parcel have resurfaced on Apple iMessage, with victims losing more than S$1.2 million across at least 251 cases reported since 24 June.
Messages typically arrive from overseas numbers with country codes including +855, +84, +63 or random email strings, claiming a parcel failed because of an invalid address. Victims are told to update details within hours via lookalike URLs, then asked for card details and one-time passwords on spoofed pages charging small "re-delivery fees."
How the bypass works
Apple's iMessage filters block clickable links from unknown senders until the recipient interacts. Scammers exploit that design by prompting a one-letter reply, which unlocks the link. The Cyber Security Agency's separate advisory on smishing notes the same pattern for messages urging users to disable protections.
Police stress legitimate couriers seldom use iMessage for customer service, relying instead on SMS from short codes, in-app notifications or email from verified domains. Including a genuine helpline number in the scam text is a social-engineering trick to build trust before victims tap the bad link.
CSA and device settings
CSA tells users to keep "Filter Unknown Senders" enabled under Settings > Messages and to verify delivery issues through official courier sites or the ScamShield helpline at 1799. Apple users can report phishing screenshots to reportphishing@apple.com.
Hardware matters: Police urge installing the latest iOS build so anti-scam mitigations ship with security patches. Banks' money-lock features and transaction limits add a second layer if OTPs leak.
Corporate responses
uParcel and peers have published blog posts urging customers to type official URLs manually rather than click embedded links. Logistics firms cannot block iMessage entirely, so education and rapid takedowns of spoof domains remain the main defence.
For Singapore households juggling parcel volumes from cross-border shopping festivals, the practical rule is to treat unexpected delivery texts like unsolicited loan offers: pause, call the courier on the number listed on its corporate site, and delete the thread if the agent has no record of the parcel.
Reporting path
Victims should alert banks immediately, file a police report, and submit numbers to ScamShield. Community reporting feeds takedown requests that Starhub, Singtel and M1 use to block SMS and rich-message routes. Until platforms close the reply-to-unlock loophole, user discipline remains the cheapest fix.