New fraud on WhatsApp uses a real photo of your order to deceive and steal user data

An increasingly sophisticated form of digital fraud is spreading through WhatsApp, using information and even real photographs of orders to deceive consumers. Conhecido as a “order scam”, the scheme aims to trick victims into paying non-existent release fees or providing personal and financial data on false pages.

Criminals exploit the anxiety of those waiting for a delivery, especially purchases made on international websites. The fraudulent message, which can arrive at any time of the day, contains the victim’s full name, address and, in the detail that gives the scam high credibility, an authentic photo of the package awaiting shipment at a distribution center.

The tactic has proven to be effective for personalizing the attack, breaking the user’s initial distrust. When viewing the real image of their own package, the victim tends to believe in the veracity of the communication and follows the malicious instructions, which invariably lead to financial losses and the compromise of sensitive information.

How order fraud works in practice

The scam process begins when the victim receives a message from an unknown number on WhatsApp. The text informs about a supposed pending issue or irregularity that prevents the delivery of a package, using the person’s precise data to generate immediate trust.

Along with the message, the scammers attach the actual photograph of the order, obtained through improper access to carrier systems. Then, a link is presented that supposedly directs to a tracking page or to regularizing the issue upon payment of a fee.

The fake website is a faithful copy of the pages of well-known logistics companies, such as Correios or private transport companies. Nele, the victim is instructed to enter information such as CPF, full address and, most importantly, credit card details or to make a payment via Pix to an account controlled by the fraudsters.

Once the data is provided or payment is made, criminals stop contact. The real order, which was never held up due to pending taxes or clearance fees, follows its normal delivery flow, and the victim only realizes the scam days later, upon receiving the product at no additional cost or upon noticing improper transactions on their account.

The origin of the information used by criminals

The victims’ main question is how scammers gain access to so much precise data, including the package image. The answer lies in security breaches and data leaks that occur at different points in the logistics chain. Bases of data from carriers, marketplaces and partner companies are constant targets of cyber attacks, resulting in the exposure of customer information. Criminals purchase these data packages on dark web forums or obtain them through phishing targeting transportation company employees.

This information often includes full name, CPF, delivery address, telephone number and the order tracking code. The package photograph, the most convincing element of fraud, is usually captured from within the carriers’ own systems, which record images of packages during the sorting and handling process. Improper access to these systems, whether by a malicious employee or a security breach, allows scammers to associate the image with the correct recipient, creating an almost perfect scenario for the scam.

Warning signs to identify the trap

The first and most important warning sign is the communication channel. Empresas of logistics and Receita Federal do not contact each other via WhatsApp or SMS to request payment of fees or the settlement of pending issues.

Be wary of any message that creates a sense of urgency, threatening to return the product if payment is not made immediately. Essa is a psychological pressure tactic common in digital scams to prevent the victim from thinking clearly.

Always check the sender and links sent. Mesmo that the website appears legitimate, analyze the address (URL) carefully in search of small changes, such as changed letters or domains different from the official ones (.com instead of .com.br, for example). When in doubt, never click on the link received.

Differences from previous scams

The current version of the order scam is distinguished by its high customization capacity and technical sophistication. Enquanto Previous attacks were generic and sent mass messages with vague information, the current modality uses specific and real data from each victim, making the fraud much more difficult to identify.

Cybersecurity experts point out that the quality of fake pages has also evolved significantly. Fraudulent websites now have security certificates (the padlock on the browser), responsive design and an interface practically identical to that of the original portals, which confuses even the most attentive users.

Essential protective measures

The main recommendation to avoid becoming a victim is to centralize the tracking of your orders exclusively on the official websites or applications of stores and carriers. Digite the address directly in the browser instead of clicking on incoming links.

Also, keep two-step verification enabled on messaging apps like WhatsApp. Essa extra layer of security makes unauthorized access to your account difficult if your number is cloned or stolen.

What to do if you were a victim of the scam

If you have made a payment, contact your bank immediately to try to block the transaction and request a refund, especially if the operation was carried out via Pix, using Mecanismo Especial of Devolução (MED). If credit card details have been provided, request immediate blocking of the card.

It is essential to file a police report, which can be done online in most states. The registry helps authorities investigate the origins of fraud and identify the gangs behind these crimes. Altere passwords for emails and other online services, especially if you tend to repeat passwords on different platforms.