The police are receiving up to 20 reports a day from victims of convincing emails and text messages about parcel deliveries that are actually scams to defraud people of up to €5,000. 

The scam has been around since April but intensified in recent weeks with messages being sent in Maltese and English and purporting to come from a range of delivery groups including MaltaPost and DHL.

A police spokesman said investigators have established that the scammers are operating from outside the EU. Similar scams have been reported in France.

Scammers are typically taking between €800 and €1,800 per victim with the highest amount defrauded from one single person reaching €5,000, the police said on Tuesday.

The texts generally come from an unknown number and will say something like: “(DHL) Your package is waiting for delivery please confirm the payment (1USD)” with a link.

An example of a message in Maltese is ‘Hello. Il-pakett tiegħek qed jistenna l-kunsinna jekk jogħbok ikkonferma l-ħas (1.99 EUR) fil-link li ġeja.’

'I wanted to cry and smash my phone'

One victim told Times of Malta she received a text message on her phone while on the beach on Saturday claiming to be from DHL. Clicking on a link in the scam message cost her €950.

“I knew there were scams around. So when it happened to me I wanted to cry and smash my phone,” she said.

Like many people, she buys online and, at the time of the scam, had several pending orders including clothes, shoes and vitamins.

Examples of scam messages circulating at present in the country.

The woman said a legitimate text message she received from DHL on the same day informed her that a package she had ordered would be delivered the following Monday.

Shortly afterwards, she received another SMS – which later turned out to be the scam – telling her she had to pay a postage fee of €1.99.

“Had I not received the first legitimate message I may not have fallen for it,” she explained.

“I usually receive my parcels at work and I did not want our receptionist to have to pay postage fees. So, I wanted to clear it immediately. I clicked on the link in the scam message. I was directed to a form that looked pretty official. Since my phone has an autofill function it filled in my personal details in a flash. All I had to do was press ‘submit’.”

Hours later, she began receiving bank notification messages informing her that money was being withdrawn from her account.

“Three messages came in at once. I called the bank and was told that I was scammed,” she said.

The bank told her scammers had taken €950. She blocked her account and was told to cut up her card. The bank asked her to send them a screenshot of the notifications she received and a photo of the card cut up.

They advised her to fill out a charge-back form and file a police report. She did so and was told there is no guarantee she would get her money back.

“My salary had just come in and this was a big chunk of my money gone. I was planning a holiday soon but I may have to postpone it,” she said.

While victims think they are authorising the debit of a small amount – such as €1.60 – fraudsters use their details to debit a much bigger sum.

In another bank notification scam, victims are deceived into providing their credentials after they are informed of a “suspicious transaction”.

They are requested to press on a link designed to steal their details. One of Malta’s main banks, Bank of Valletta, urged victims of such scams to immediately file a police report.

Asked if customers will get their money back, a spokes-person said the bank “does everything in its power to retrieve the money for the customer” but urged people to be “very careful before giving any card or other details.”

How can I tell if a message is a scam?

• Look at the sender’s number. Scams are unlikely to come from an official number from a recognised company and are more likely to look like a normal number but won’t be a contact.
• Do not click on links that do not contain the official URL of the delivery company or use shortened links like bit.ly or tinyrul.
• Be careful about deliberate misspellings such as maltapost-up.com instead of the correct maltapost.com
• Stop and think, especially if the communication comes out of the blue and check before entering your personal or financial details on a website.
• Keep records of any items that you are expecting by mail and check accordingly.