AI photos make long-running ‘parcel for you’ scams more credible In France

Warnings are being raised in France over an increasingly popular scam that sees victims sent a text showing an AI generated parcel that has their name on it. 

The text, supposedly from a courier for a popular service such as Mondial Relay, explains that the parcel was too large to fit in the recipient’s mailbox and had to be taken back to the logistics centre. 

It includes a clickable link to reschedule the delivery, which leads users to a fraudulent page mimicking the official website of the supposed courier service.

Information handed over on the site by the victim (names, addresses, bank information, etc) can then be used to either directly take money from an account or otherwise as part of a future ‘phishing’ scam. 

Use of AI enhances scam

This style of scam – texts containing a link to a fraudulent website that mimics an official one – has been around for a long time.

In recent years, it has become more popular due to the rise of courier services and at-home deliveries.

What makes the new scam different however, is the accompanying photo of the courier supposedly holding the parcel that clearly has the potential victim’s name on it. 

This photo is AI generated and completely fake, with the personal information (the combined name and phone number it was sent to) of the victim most probably taken from a previous cyberattack or phishing attempt. 

A string of recent high-profile cyberattacks on both public and private databases has seen data from millions of residents in France leaked, often including names, email addresses, and telephone numbers – all which can be used for this type of scam.

As the examples below show, the same base photo is used, with AI applied to change the name on the parcel.

Tips to avoid scam 

In response to the scam, Mondial Relay has reminded users that it never asks for bank information nor ask users to click on such a link.

The company states on its website that it will never "reschedule a delivery for a later date, [ask you to] contact a premium-rate number, pay additional shipping fees, or provide confidential information (such as your parcel collection code, login details, or bank details for 'parcel tracking').” 

The use of AI can make it harder to avoid such scams, particularly if you only glance at the photo quickly or if you are expecting a parcel when it happens so are more inclined to click the link. 

To avoid the scam, some important advice to remember includes: 

• Checking the phone number the message is sent from. If it starts with 06 or 07, it is a mobile number and most likely a scam. 

• Never clicking on any link sent or emailed to you. If in doubt about a parcel, go to the courier’s website and track it using the given code 

• Contacting the courier’s customer service to check if a text is legitimate 

• Reporting any scams using the SignalConso website

More generally, residents in France should engage in best practices to avoid falling victim to the growing number of cyberattacks. 

While you cannot prevent your data being stolen from an encrypted database (such as the recent leak of health records, or last year’s hacking of mobile website SFR), you can minimise the risk of being impacted by any follow-up phishing scams. 

Remember to keep your security information private, stay vigilant over incoming calls, never hand out personal data over the phone or online, and regularly check accounts for suspicious activity. 

More information on protecting yourself against cyberattacks can be found in our article here.