Don’t Get Fooled: The Rise of Package Delivery Scams in NZ & AU

• Delivery Scams
• Email Phishing
• Cybersecurity

Scammers are impersonating NZ Post, DHL, and others to trick you with fake delivery alerts. Learn how to spot these scams and protect your personal information.

Package Delivery Scams Are Getting Smarter

With over 81.9 million courier parcels delivered in New Zealand alone in the past year, many of us receive so many deliveries that it’s hard to keep track. And that’s exactly what scammers are counting on. Package delivery scams are now a constant threat—not just during shopping seasons—and they’re becoming harder to spot.

How the Scam Works

The scam typically starts with an email or text claiming to be from a delivery company like NZ Post or DHL. You’re told there’s an issue with your package and asked to click a link. From there, you might be redirected to a phishing site designed to steal your personal or financial information.

• Impersonation of legitimate services: The scam mimics official layouts and logos, making it seem like a genuine alert.
• Urgent, manipulative language: Messages often claim your package will be returned or held unless you act immediately.
• Fake customs fees: Scammers may ask for small ‘customs’ payments, falsely claiming NZ Customs requires it.
• IPFS-hosted phishing sites: The landing page may look legitimate, but it's hosted on decentralised file systems like IPFS, which legitimate businesses do not use.

Red Flags to Watch Out For

• Suspicious sender address: Emails might come from unusual domains like info@ioxr.art rather than official company addresses.
• Missing shipment details: Legit messages include your name, order details, and tracking numbers. Scam messages are vague.
• Unusual URLs: Hover over links to see where they really lead. Official shipping companies don’t use IPFS or similar services.
• Pre-filled login forms: These pages often auto-fill your email to add false legitimacy and trick you into entering your password.
• Broken design elements: Fake sites often have non-functional language switches, disabled right-clicks, and odd formatting.

When You Should Be Suspicious

Scammers often launch these attacks on Mondays, targeting people with full inboxes who are not yet in full work mode. The attacks are generic and widespread, allowing scammers to hit users across New Zealand, Australia, and globally.

How to Protect Yourself

• Check the email headers: Always inspect the sender's domain. If it doesn’t match the company’s real address, it’s likely fake.
• Verify the landing page: If redirected to a site that doesn’t feel right, do not enter your details. Instead, visit the official website directly.
• Assess formatting and design: Look for inconsistencies or low-quality visuals. Legitimate companies take care with presentation.
• Pause before clicking: Don’t let urgency rush you. Scammers often rely on panic to trick people into hasty decisions.
• Never share personal info via links: Avoid entering sensitive data through links in emails or texts. Go directly to the company’s site instead.

Final Advice

Stay alert to avoid these increasingly sophisticated scams. If you receive a suspicious delivery notice, verify it by going directly to the delivery company’s website. Never rely on links or contact details provided in unsolicited messages. When in doubt, take a breath, double-check, and stay safe online.