Rise of the FluBots: Why clicking that ‘parcel delivery’ text could cost you dearly

Are you one of the tens of thousands of South Australians being inundated with “parcel delivery” texts? Here’s why you should never click on the link.

The insidious FluBot mobile phone scam is targeting South Australians at a level never seen before by the Australian Competition and Consumer Commission.

Deputy chair Delia Rickard said the ACCC had received more than 10,000 complaints about the racket, which involves text messages sent about fake parcel deliveries.

If the receiver follows the message’s instructions, they can inadvertently download the FluBot malware to their phone, leaving them vulnerable to hackers.

An example of a FluBot spam text. Source: KnowBe4

“I have never seen anything like FluBot in terms of the number of complaints we’ve had,” Ms Rickard said.

“It started towards the end of the first week of August and we are seeing complaints like we’ve never seen connected to any other scam.”

ACCC deputy chair Delia Rickard.

Ms Rickard said FluBot, which currently can only infect Android phones, had two malicious functions.

The first, she said, was to harvest numbers from the phone’s contact list and use those to send out more copies of the virus.

The second, and more worrying, function was to collect log on details and passwords for online banking and other secure sites.

“The really concerning thing is that it appears (and) it can read passwords, and then bring up replicas of your bank’s website. They can then get your credentials and from there go and commit fraud and take money from your account.”

Ms Rickard said the fact that many people were shopping online during the pandemic meant the “missed parcel” element of the FluBot scam was likely to be more successful.

She said anyone who thought they might have downloaded the FluBot virus needed to make sure it was removed before using their phone for anything requiring passwords.

“Don’t do any banking or access your social media until you have had that phone properly cleaned,” Ms Rickard said.

“You’ll need to take it to someone who can remove the virus, or download an anti-malware app. You can also contact your service provider for advice on what steps to take.”

Ms Rickard said that while most people realised that the FluBot messages were scams before any serious damage was done, there were some who’d had their bank accounts emptied by the fraudsters.

“Not large numbers of people have reported losing money, but we suspect that it’s underreported and the real number is probably larger,” she said.

For more information, visit scamwatch.gov.au.

Have you fallen victim to this scam? Email [e-mail] to tell your story