ACCC warns Australian online shoppers of Flubot parcel tracking scam

Authorities have labelled a text message “dangerous” which is the last thing Australians need as they turn to online shopping during lockdown.

The masterminds behind the ‘Flubot’ scam text messages being sent to thousands of Aussies have changed their strategy in a bid to catch out more people.

For the last few weeks, phone users have been receiving scam messages asking to click on a link to listen to a missed voicemail.

However, over the weekend, the scammers pivoted to something new which is bound to trick more Australians.

From Sunday, users are being enticed into clicking the link by checking out when a parcel is due to arrive.

“Your package is due to arrive, track here,” it reads, along with a website address that will infect your phone with malware.

The ploy is particularly concerning considering that Australia’s two largest states, NSW and Victoria, are currently in lockdown, meaning online shopping is on the rise.

Scamwatch, a division of the Australian Competition and Consumer Commission (ACCC), confirmed to news.com.au that the parcel messages were related to the Flubot malware scam.

Since the scam was first reported on August 4, Scamwatch has received 8400 reports of the Flubot text messages, with over $9000 in reported losses, as of Tuesday.

ACCC warns Australian online shoppers of Flubot parcel tracking scam

An ACCC spokesperson said: “We can confirm Flubot messages have moved from variants around missed calls and voicemails to ‘schedule your package delivery’ texts, changing on the August 29, 2021.”

The messages reported include: “Hi. We have (1) package pending on your name. Schedule delivery now”, “Your package with DHL (ePacket) is now in transit” and also, as seen in the photos obtained by news.com.au: “Your package is about to be delivered, track here.”

Delia Rickard, deputy chair of the ACCC, told news.com.au the scam has been widely reported in Europe and now it’s come to Australian shores.

In Europe, the scam originally started out as voicemail messages then evolved to be a more sophisticated fake parcel text.

Australia is following the same pattern, according to Ms Rickard.

“It’s a very sophisticated scam and potentially very dangerous. It can compromise people’s bank accounts,” she previously told news.com.au.

“Whatever you do, don’t click on the link.”

Instead, block the number, delete the message and report it to Scamwatch.

ACCC warns Australian online shoppers of Flubot parcel tracking scam

The malware only infects Android phones.

If you click on the link, it will take you to an app called Voicemail71. APK. Once you download the app, your android phone is infected.

Not only can it now watch you type in all your passwords, it also gets hold of all the contacts in your phone.

That means all the texts you’re getting aren’t from a scammer – it’s from an unknowing victim.

“If you download it, the malware gives the permission to read SMS messages, it allows it to send SMS messages, it could initiate the phone call without going through the dialler,” Ms Rickard warned.

“It reads the user’s contact details. Could send out messages and calls all night without you knowing.”

She said the ACCC had received a “number of complaints” to this effect, where Australians had been abused over the phone as people called them up mistaking them for scammers because they had sent the text.

In reality, they were the scam victims.

I’m getting so many of these malware spam SMSs now that I don’t even look at my phone when it dings. pic.twitter.com/zcdquI3iw4

— Shaun Ewing (@swewing) August 20, 2021

Another postal scam to watch out for

Scamwatch also said another postal scam is circulating.

It’s important to note this one is in no way related to the Flubot scam.

The text message phishing campaign sends instructions such as “Please confirm your details for shipment today otherwise your parcel will be returned to the retailer: 1m8me.redacted”.

The domain to the website varies.

This second campaign is after credit card details and states “3.95 AUD has to be made for successful verification. Amount will be refunded”.

An ACCC spokesperson noted: “Providing credit card details results in charges significantly exceeding this amount.”

What should I do if I clicked on the Flubot link?

You should immediately contact your bank to make sure you haven’t lost any money.

Ms Rickard said there were three ways to get rid of the malware.

“Just getting rid of that app doesn’t get rid of that problem,” she warned.

You need to go to an IT professional to wipe the virus, download an antivirus software that gets rid of it, or you can do a factory reset.

“As long as your phone is infected, don’t go into any of your accounts,” she added.

If you have lost personal information to a scammer you can contact IDCARE or call 1800 595 160. You can also make a report to ReportCyber if you have been a victim of this cybercrime.