Treat every unexpected delivery notice, payment warning or change of bank details as unverified. Check through a route you already know, never sign in from an emailed link, and if someone clicks, act within the hour.

The notice that looks like all the others

In December parcels are expected everywhere: at the warehouse door, at reception, at home. Delivery notices arrive all day, and most of them are real.

Mixed in are notices that are not: a parcel could not be delivered, a customs fee is owed, a label needs printing. Each carries a link or an attachment, and each looks much like the real ones.

Behind them is somebody hoping for a password, a card number, or a program installed on an office computer.

What arrives this month

The fourth is the most expensive. A fake invoice that persuades a business to pay a real supplier's bill into a stranger's account moves real money, and it is rarely recovered.

Why December suits them

Volume is the main reason. When forty genuine notices arrive in a day, the forty-first gets the same quick glance.

Routine helps them too. Staff covering for colleagues on holiday handle unfamiliar suppliers, temporary staff do not know which emails are normal, and everybody is in a hurry.

And more email is read on phones, where the sender's real address and a link's real destination are harder to see.

What they have in common

Spelling mistakes are no longer a reliable sign. Many fakes are well made, copied from genuine emails with the logos intact.

The common thread is what they ask for: a click to a page that wants a password, an attachment to open, a payment to make, or a change to how payments are made. And they want it quickly.

So rather than judge the email, check the claim through a route you already know. That works however convincing the email is.

Habits that defeat them

Track parcels from the order itself: the confirmation from the store you bought from, or the carrier's site typed in by hand. Never from the link in an unexpected notice.

Never enter an email password on a page reached from an email. A delivery company has no reason to ask for it, and a sign-in page that appears after a delivery link is the trap itself.

Treat attachments in delivery notices as suspect. Carriers do not need you to open a compressed file, and a document asking you to enable editing or content is asking permission to run a program.

Confirm any change to a supplier's bank details by calling the supplier on a number you have on file, never one given in the email. Confirm any urgent gift card request from the owner by voice.

A worked example

A packaging supplier in an industrial park ships boxes, tape and void fill to a few hundred business customers, and receives freight and parcels of its own every day.

One morning its shipping coordinator received a notice saying a parcel could not be delivered, with a link to arrange a new time. The link opened a page that looked exactly like the company's email sign-in screen.

She entered her password, the page reloaded, and she moved on. Nothing seemed to have happened.

That afternoon two customers phoned about an invoice sent from her address, with a link to view it. The office manager changed her password and signed her account out everywhere.

He also found a new rule in the mailbox forwarding a copy of every message to an outside address. It was how the intruder planned to keep reading after any password change.

The rule was removed, customers were warned by phone, and two-step verification went onto every mailbox in the company that week.

What to do after a click

If you clicked but entered nothing and opened nothing, close the page and tell whoever looks after your computers. Usually that is the end of it.

If you entered a password, change it straight away from another device, and anywhere else it is used. Then check the mailbox for forwarding rules you did not create, sign out other sessions, and turn on two-step verification.

If you entered card details, call the bank on the number printed on the card. If you opened an attachment or ran something, disconnect the computer from the network and call whoever maintains it before doing anything else.

Thank people who report

The difference between a near miss and a costly week is usually how quickly somebody says I clicked something.

Staff who expect blame stay quiet and hope. Staff who know they will be thanked report within minutes, while a changed password still stops the damage.

Say it out loud this week: if you click something odd, tell someone straight away, and nobody will mind.

Your customers get fakes in your name

If your business ships, fakes imitating your own notices may reach your customers too.

Make your emails easy to recognise: a consistent sender address, no attachments, links only to your own domain, and order numbers that match the order.

Then say so on the website's shipping page: you will never ask for a fee, a password or card details through a delivery email.

The counter-case

Not every unexpected notice is fake. Colleagues order things, customers send gifts, and suppliers do change banks.

Email filters catch a great deal, and a business receiving few parcels is less exposed to delivery fakes, though invoices and account warnings reach everyone.

The habit holds regardless: check the claim through a route you already know, and make it easy to say I clicked.

This month

  1. Track parcels from the original order only.
  2. Never sign in from an emailed link.
  3. Phone suppliers before changing bank details.
  4. Turn on two-step verification for email.
  5. Check mailboxes for unfamiliar forwarding rules.
  6. Tell staff what to do after a click.
  7. Thank whoever reports a mistake quickly.

Step three protects the most money. A fake delivery notice usually costs a password and an afternoon; a changed bank account on a real invoice can cost the whole payment.

Keeping automated junk out of your website's own forms is covered in reCAPTCHA v3 and fewer traffic lights.

Frequently asked questions

How can I tell a fake delivery notice?

Often you cannot by looking, since many copy real emails closely. Check the parcel through the original order or the carrier's site typed by hand instead.

Why are fake notices worse in December?

Because real notices arrive constantly, staff are covering for each other, and more email is read quickly on phones, where addresses and link destinations are harder to see.

What is the most expensive kind?

A genuine-looking supplier invoice with new bank details. Confirm every change by calling a number you have on file before any payment is made.

What should I do after entering a password?

Change it at once from another device and anywhere else it is used, remove unfamiliar forwarding rules, sign out other sessions, and turn on two-step verification.

What if someone opened an attachment?

Disconnect the computer from the network and call whoever maintains your computers before doing anything else. Attachments in fake notices often install programs.

How do I protect my own customers?

Keep your delivery emails consistent, without attachments, with links only to your own domain, and say on your site that you never ask for fees or passwords by email.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Not sure what to do after a click?

Call us before anything else. We will check the mailbox, the forwarding rules and the accounts with you.

Start a Conversation