The scam involves sending small, unsolicited parcels containing low-value items to random members of the public. Along with the package is a QR code which claims to provide information about the sender. However, instead of providing information, the QR code is designed to gather personal and payment information. Learn more here.
 

We’ve been informed that one of our customers has received a fraudulent message while believing they were corresponding with our New Zealand Couriers team via email. At this point, we are only aware of one customer who has received a communication of this nature. However, fraudulent actions/scams such as this are viewed very seriously.

The email appears to be sent from a team member, with the only difference being a slight change to the email address. 

If you receive an email that appears to be from a New Zealand Couriers team member and notice the email has any character changes such as an “i” appearing así with an accent.

Please be aware:

• There has been no change to the Bank Account number for New Zealand Couriers' customer payments (or ‘secondary account numbers’).
• Please do NOT change your payment instructions.

Emails from our team will always end with “@nzcouriers.co.nz”

We've been informed that a volume of New Zealand-based email addresses have received a phishing/scam email.

Some of the receivers of this scam email are New Zealand Couriers’ customers, some are not.

This email appears to be sent from accounts@nzcouriers.co.nz, but we want to clarify that these are part of a scam, and there has been no breach of our systems or information theft.

The scam attempts to get the receiver to type in their Microsoft Office 365 credentials to an online form (it tries to get the user to click on a link that looks like an attachment… see below).

To keep you protected, we aim to inform you about the distinguishing features of this phishing email.

If the email you have received contains either of the identifiers below, DO NOT CLICK or fill in the credentials on the attachments.

• The phishing email has an attached file called "Invoice.pdf.html"

• The subject line always contains the account number "2298548"

Why did this happen?

An organisation's information was breached, and invoice details were duplicated in an attempt to get others to share their Microsoft Office 365 credentials.

Since being notified, the following actions have been taken:

• The organisation has been contacted about this compromise.
• The phishing email has been reported to CERT NZ, AbuseIPDB and Microsoft's 3rd party mail platform.
• A report has been made to the hosting website to which the phishing email's links direct users.

To be clear, there has been no compromise of our systems or information, however, if you receive communication of this nature, please do not click the attachment and report it to your IT/Security team.

Please be aware that New Zealand Couriers has just released an invoice run, and you may be receiving a legitimate invoice. (below)

We have been advised that one of our customers has received an email communication with our logo titled (EFT) INFORMATION advising a secondary bank account number for all incoming payments.

Below is a snapshot of the fraudulent advice:

At this point, we are only aware of one customer who has received a communication of this nature - however, fraudulent actions/scams such as this are viewed very seriously.

Please be aware:

• There has been no change in the Bank Account number for New Zealand Couriers' customer payments (or ‘secondary account numbers’).
• And please do NOT change your payment instructions.

Please let a New Zealand Couriers' accounts team member (accounts@nzcouriers.co.nz) know if you receive a communication of this nature.

Some malicious individuals have an active fraudulent Facebook scam where people are ‘selling’ items to others and then directing to a payment page branded as New Zealand Couriers (it is definitely not New Zealand Couriers).

It harvests credit card/bank account information. These perpetrators are using deceptive tactics to target unsuspecting individuals (it is a nasty scam).

It is strongly recommended not to scan QR codes in this scenario (nor to click on links).

Thus far, the following actions have been taken:

• The website has been reported to Google
• The Domain Registrar has been contacted and asked for assistance in cancelling the fraudulent domain
• The scam has been reported to CERT NZ [cdd873w13]

If you are targeted by these scammers, please contact your bank and https://www.cert.govt.nz/ immediately.

There is a scam whereby users are being directed to a link via Facebook messenger to pay for the delivery of a purchase. This is considered a fake escrow scam.

Users purchasing from Facebook Marketplace are directed to a URL similar to: nzcouriers.jloads.site/*****  or nzcouriers.reserwe-g.site/*****  or nzcouriers.sends-q.online do not click on the link. 

There may be other variations of the URL since this scam has been identified, so please be aware if any links direct you to pages that looks like the below.

The URL link takes you to a page like the above and from this page if attempts to take your payment information to steal your money for a false delivery.

We recommend not to click on the link and to contact your bank and https://www.cert.govt.nz/ immediately if you are targeted by these scammers.

There is a fake New Zealand Couriers Facebook page. If you come across this page please report it. We are confident that users have identified this page as a scam and responses from this page indicate that it is not a real Facebook page. 

If you come across a Facebook page acting as New Zealand Couriers, please report the page to Facebook.