Be careful with fake delivery notice through SMS. Do not access the URL! Never enter ID or password!

Local consumer affairs centers and the like across Japan have received inquiries and complaints about fake delivery notice through SMS.

Such a fake message includes a URL that directs a recipient to a fake website. In some cases, consumers accessed a fake website and installed a fraudulent app, as a result of which an identical SMS message was automatically sent to many recipients from their smartphones and they were billed for communication charges that they didn't recognize.

In addition, some consumers entered personal information (e.g. ID, password, security code, authentication code, etc.) on a fake website and the data was misused for mobile payment. Later, they were billed for unknown charges.

How consumers get in trouble

1. A consumer receives a fake SMS message: "We tried to deliver a package to you, but unfortunately you were out. The package is still with us. Please access the following URL to check the status."
2. The fake SMS message includes a URL to direct a recipient to a fake website.
3. Case 1: After accessing a fake site and installing a fraudulent app, an identical fake SMS message is sent to a large number of recipients from the consumer's smartphone. Later, the consumer will be billed for unknown communication charges.
4. Case 2: After accessing a fake site and entering ID and password, the personal information is misused for mobile payment. Later, the consumer will be billed for unknown charges.

Sampling of inquiries and complaints

[Case 1] After accessing a fake site, an SMS messages was automatically sent to numerous recipients from my smartphone.

My smartphone received a delivery notice through SMS. When I accessed a link on the message to check the status, it appeared that something was being downloaded on my smartphone. The screen soon returned to normal appearance, so I did nothing. A few days later, unknown persons called me one after another to receive a package that was not delivered due to absence. I said, "I have nothing to do with it" and disconnected the call.
Later, I visited a mobile phone company shop to change my phone number. Then I found out that I was billed for unknown communication charges costing over 10,000 yen: an SMS message was sent over 100 times from my phone to foreign numbers. I want the company to cancel the bill.

(complaint received in August 2020 from a man in his 40s)

[Case 2] After accessing a fake site, my personal data was misused for mobile payment.

A few months ago, I received an SMS message that looked like a delivery notice from a courier. I accessed a URL on the message. I don't remember exactly but I might have entered and sent my personal information such as name. Later, I found out that about 110,000 yen was paid for e-money through mobile payment without my knowing it.

(complaint received in May 2020 from a man in his 40s)

Advice for consumers

1. If you have received a delivery notice through SMS or email, do not access the URL on the message without careful consideration.
2. If you have accessed the URL, do not install an unidentified app or enter personal data such as ID and password.
3. If you have installed a fraudulent app on your smartphone, switch your smartphone to airplane mode and uninstall the app.
4. If you have entered your ID and password on a fake site, change them immediately.
5. Prepare for spam SMS/emails and fraudulent use of ID and password.
   • Use security services provided by your mobile phone company and a security software.
   • Do not use the same ID or password for multiple purposes.
   • Set the upper limit for mobile payment to the minimum necessary, or disable the mobile payment function.
6. In case of trouble or concern, consult your local consumer affairs center.