Flubot, and the DHL parcel scam by SMS

[#1]

The BBC web site today has an article about malware called Flubot that can steal bank details, and take over Android phones. Flubot: Warning over major Android 'package delivery' scam - BBC News 

I had a text today about a delivery by DHL. A link in the text would lead to the malware if it were followed. Does Plusnet want to see these texts? Is there an email address, or an SMS number to send them to? 

[#2]

I always think it's a bit odd all this shooting yourself in the foot then complaining about the pain.

So you get a message which says install this app. And some actually do.

What was that people used to say when we were a kids. Would you jump in a lake if people told you to as well.

I guess that BBC news article will also serve to give people ideas and well as a warning. It's a sort of follow up to the "we have your package pay us for re-delivery" scam.

[#3]

Yep, as @billnotben says, why follow or comply with an obvious spam link? Unless you are expecting a delivery from a company who have advised you they are using a specific courier, and have advised that said courier will notify you via text of intended delivery date/time, it is clearly rubbish and should be ignored/deleted without opening.

[#4]

I guess some people who receive the message will actually be expecting a parcel to be delivered by DHL and might think a tracking app would be useful.

Not everyone who falls into that category will have the nous to realise it could be scam.

EDIT:  However, having now read the linked article, IMO anyone installing the app would have to be somewhat stupid given the hoops they would have to jump through (which should act as warning signs to most people) to actually do that.

[#5]

Possible, @RobPN , but any company that intends to use DHL/DPD or other couriers with a tracking facility should advise you of the fact, and that said courier will/may advise you of the intended delivery schedule by text and/or email - I know all those I have used who work that way have done so.

[#6]

True @jab1 , and I was adding (editing) to my post above whilst you were posting yours.  

[#7]

Parcel Force must be a pain in the rear to these scammers with their policy of advising that the parcel is 'out for delivery' a couple of days after the customer receives it.

[#8]

So does Plusnet have an email address, or an SMS message centre for forwarding scam texts so that they can be investigated?

[#9]

@Halteres Unfortunately, PN do not have an email address for reporting this, nor do they support short codes (which is one of the reasons they are cheap), but there is nothing stopping you reporting direct to the National Cybercrime unit - Google for the number/email address.

As it is such a well-known scam, you will just be added to a long list, and I doubt you will get a personal reply, although I could be wrong.

As a point of interest, it would be good to note that these spam-artists are close to untraceable, as they most likely are using VoIP technology - which means they can mask the sending number, and could well be operating from outside the UK, which means our national services will be unable to take little, if any, action.

[#10]

OFCOM seem to think that VOIP is the solution to number spoofing, not the cause of it.

https://www.bbc.co.uk/news/business-56934517

Mr Saunders says when VOIP is fully in place, with a target date of the end 2025, the industry will be able to stop number spoofing.

[#11]

Interesting. I wonder how they are going to stop the 'spoofers' in say Russia/China/India? - where most of them are located.

[#12]

using stir / shaken (https://en.wikipedia.org/wiki/STIR/SHAKEN) it's rolling out in the states already.

[#13]

Thanks for that info, @dvorak - Bookmarked for later in-depth reading.