Alert · Phishing & Impersonation
Business named in this report
A courier impersonation kit delivered by SMS, claiming a parcel was held pending a small customs fee. The payment page harvested full card details and then a one-time passcode in real time, which was used to enrol the card in a mobile wallet. Reported card losses reached $38,600 across 22 people, most of it spent within an hour of the code being entered.
Critical: Payment evidence on file, nothing delivered, and nothing refunded. Assume anyone reaching you with these details belongs to the same operation.
Do not wire funds to parcel-customs-settle.example.com. If anyone using the details on this page asks for payment before you are holding documents you can independently check, stop the transaction — the same numbers and addresses reappear behind new company names.
Sample recordAn illustrative alert used while the live intake feed is being connected. The domain belongs to the reserved example.com documentation namespace and does not name a real business.
Objective, checkable findings behind this severity level
What happened, in order
Jul 8, 2026
Domain registered
Jul 14, 2026
SMS campaign begins
Bulk send across multiple carriers using rotating sender IDs.
Jul 16, 2026
First reported loss
$2.10 'fee' followed by $4,200 in wallet transactions within 40 minutes.
Jul 19, 2026
First alert filed
Aug 2, 2026
Registrar notified
Abuse report filed with the registrar and the hosting reseller.
Aug 15, 2026
Host suspended
Hosting account suspended; near-identical domains remain in rotation.
First-hand descriptions from people who paid. Names are shortened at the reporter's request.
Marcus
New South Wales, AU
$4,200
Was expecting a delivery, so the message did not seem unusual. Paid a $2.10 customs fee, then entered a code that arrived by SMS. Within forty minutes there were three contactless transactions at electronics retailers in another state. The bank confirmed the card had been added to a mobile wallet on an unrecognised device.
H.N.
Auckland, NZ
$2,650
Noticed the domain looked wrong only after entering the details. Called the bank within fifteen minutes, which limited the loss to two transactions.
What was checked and what it showed
Domain age at first loss
whois8 days. Registered 2026-07-08, first reported loss 2026-07-16.
Pixel-identical clone
contentMarkup and assets match the courier's real tracking and payment pages.
Passcode harvesting
communicationThe page requests a one-time passcode after card entry and relays it to an operator in real time.
Kit rotation
hostingFourteen sibling domains served identical markup from the same hosting range.
Contact points, wallets, and payment details as reported
Domain
Operator name
Aliases used
Approach platforms
Handles & accounts
None on record
Wallet addresses
None on record
Phone numbers
Email addresses
None on record
Addresses claimed
None on record
Payment routes requested
Bank beneficiaries (masked)
None on record
Assets copied from
Related domains
Bank and card numbers are published in masked form only. Full details are retained for law enforcement requests and are not disclosed publicly.
The questions people search before they pay, answered from this record
parcel-customs-settle.example.com, operating as Parcel Customs Settlement (courier impersonation), carries a severity of "critical" in the Scam Alerted feed — payment evidence on file, nothing delivered, and nothing refunded. Assume anyone reaching you with these details belongs to the same operation. A courier impersonation kit delivered by SMS, claiming a parcel was held pending a small customs fee. The payment page harvested full card details and then a one-time passcode in real time, which was used to enrol the card in a mobile wallet. Reported card losses reached $38,600 across 22 people, most of it spent within an hour of the code being entered. This alert was first published Jul 19, 2026 and last updated Aug 15, 2026.
$38,600 across 22 reporting parties who supplied payment evidence. Read that as a floor, not a total: this figure counts only losses backed by documents we have seen, so it can move in one direction as further reports arrive.
The domain was registered Jul 8, 2026 through Registrar with automated bulk provisioning, making it about 2 months old. Genuine phishing and impersonation operators do not run a business of this size on a domain that new, so registration age alone is a significant warning sign.
Buyers were dealt with by phone on Sender IDs rotated across 40+ alphanumeric SMS headers. The website is parcel-customs-settle.example.com. Related domains on record: parcel-fee-settle.example.com, courier-hold-release.example.com. These are published so that anyone searching a number, an address, or a domain before paying finds this record first. An address or phone number shown on a website is not proof that a business trades from it — verify it against the state business register and independent imagery before you send funds.
Reported payment routes: Card details harvested directly, Wallet enrolment using a stolen one-time passcode. All of these rails move funds without buyer protection or reversal rights.
Brand names and aliases: Global Parcel Settlement, Courier Fee Portal. Phone numbers: Sender IDs rotated across 40+ alphanumeric SMS headers. Searching these identifiers is usually what links a brand-new site to an operation already on record.
The window is set by the rail you paid on, and it starts closing the moment the payment settles rather than the moment you realise. A wire is the narrowest: while the funds are still sitting in the receiving account, your bank can ask the beneficiary bank to send them back, which is why the first call is your own bank's fraud line and not the seller. Card and PayPal goods-and-services payments carry a formal dispute route that stays open for weeks. Cryptocurrency has none at all. Once your bank has opened a recall, file with your national fraud body so investigators can approach the receiving institution independently of you. Anyone who contacts you afterwards offering to recover the money for a fee up front is running a second attempt on the same victim.
Act on the payment route first, the paperwork second
Elsewhere in the feed
superiorequipandrent.com
A buyer reports losing $26,000 to Superior Equipment & Rental of Sheldon, Iowa, on a 2017 Kubota SVL95-2s compact track loader advertised at superiorequipandrent.com/listing/2017-kubota-svl95-2s. What makes the account checkable is the paperwork rather than the sale. A used machine crossing state lines normally generates an invoice naming a legal entity, a bill of sale carrying the machine PIN, a lien search, a bill of lading against a carrier with an MC number, and a cargo insurance certificate. By the reporter's account, not one of those documents was ever issued. The seller required the full amount by bank wire ahead of release, the funds settled, and the phone and sales address went quiet.
Reported lost
$26K
Reports
1
verdant-solar-rebate.example.com
Verdant Solar Rebate Scheme advertises a government-backed solar rebate and collects a processing fee plus identity documents through a portal. No confirmed loss has been reported yet, but the scheme name does not appear in any government programme register, the domain is nine weeks old, and the document upload flow requests more identity material than any rebate requires.
Reported lost
—
Reports
0
asset-reclaim-unit.example.com
Asset Reclaim Unit approaches people who have already lost money, quoting the exact amount and platform involved. It presents a case portal showing 'recovered' funds and requests a retainer, a blockchain gas fee, and a release tax. Five people who had already been defrauded lost a further $46,900. The contact handle is shared with a trading platform in this feed.
Reported lost
$46.9K
Reports
5