Stay alert to phishing messages and fraudulent websites

Hongkong Post reminds the public to stay vigilant to phishing attempts

How to identify phishing messages

1. 1. Check the Email Address of the sender

   Emails of Hongkong Post are sent via the following official domains :-

   • @hkpo.gov.hk
   • @hongkongpost.hk
   

   While phishing emails may use addresses with keywords like hongkongpost, hkpo, gov, and etc., such as hongkongpost@xmail.com or posthk@post.hk, it is impossible for them to use the above official domains of Hongkong Post.

   
   

2. 2. Check the URL of the embedded link

   All websites of Hongkong Post are hosted on the following official domains :-

   • hongkongpost.hk
   • hongkongpost.gov.hk
   • ecert.gov.hk
   

   Although the fraudulent websites may copy the designs and contents from those of Hongkong Post, their URL addresses such as “www.hongkongpost.cc” or “www.hongkongpost.hk.com” or “posthongkong.info” are only imitations of the official domains of Hongkong Post. These websites are not affiliated with Hongkong Post.

   
   

3. 3. Check the Item Number

   Message with item number that cannot be verified on the official website of Hongkong Post (www.hongkongpost.hk) should be considered a phishing message.

   

Common fraudulent tactics (Last Update: 28.11.2022)

Below are some screenshot examples of reported phishing email and SMS message that the public should stay alert to:

• About settlement of customs duties or other chargesOpen/collapse

  Such messages claim that a mail item has been detained by the customs authority or pending for delivery, and that a link is embedded to request for a payment so that arrangement could be made for the delivery of the item. Please note that request for payment to any customs duties in arrears, if applicable, would be made by the customs authority of destination to the recipient directly and this would not be processed by Hongkong Post.

  Examples of About settlement of customs duties or other charges

  Screen Capture	Remarks
  	The actual URL does not use any of the official domain names of Hongkong Post Hongkong Post will not send links requesting customer to settle payment
  	The email address does not use any of the official domain names of Hongkong Post The actual URL does not use any of the official domain names of Hongkong Post Hongkong Post will not send links requesting customer to settle payment
  (Chinese version only)	Message is not complete
  	The actual URL does not use any of the official domain names of Hongkong Post Hongkong Post will not send links requesting customer to settle payment
  	The actual URL does not use any of the official domain names of Hongkong Post Hongkong Post will not send links requesting customer to settle payment
  	The URL does not use any of the official domain names of Hongkong Post Hongkong Post will not send links requesting customer to settle payment
  (Chinese version only)	The URL does not use any of the official domain names of Hongkong Post Hongkong Post will not send links requesting customer to settle payment
  (Chinese version only)	The actual URL does not use any of the official domain names of Hongkong Post Hongkong Post will not send links requesting customer to settle payment
  (Chinese version only)	The URL does not use any of the official domain names of Hongkong Post
  (Chinese version only)	The URL does not use any of the official domain names of Hongkong Post The actual URL does not use any of the official domain names of Hongkong Post
  	The actual URL does not use any of the official domain names of Hongkong Post Hongkong Post will not send links requesting customer to settle payment
  	The actual URL does not use any of the official domain names of Hongkong Post The email address does not use any of the official domain names of Hongkong Post Hongkong Post will not send links requesting customer to settle payment
  	The actual URL does not use any of the official domain names of Hongkong Post Hongkong Post will not send links requesting customer to settle payment
  	The actual URL does not use any of the official domain names of Hongkong Post The email address does not use any of the official domain names of Hongkong Post Hongkong Post will not send links requesting customer to settle payment
  	The actual URL does not use any of the official domain names of Hongkong Post The email address does not use any of the official domain names of Hongkong Post Hongkong Post will not send links requesting customer to settle payment
  (Chinese version only)	The actual URL does not use any of the official domain names of Hongkong Post The email address does not use any of the official domain names of Hongkong Post
  	The URL does not use any of the official domain names of Hongkong Post
  	The actual URL does not use any of the official domain names of Hongkong Post The email address does not use any of the official domain names of Hongkong Post

• Confirmation or Provision of Delivery AddressOpen/collapse

  Those messages claim that arrangement has to be made for the redelivery of a parcel due to incorrect recipient’s address or that a parcel is pending for delivery, thus requesting for confirmation or provision of the correct recipient’s address by clicking the link embedded which connects to a fraudulent website. Please note that Hongkong Post only delivers mail items according to the addresses indicated. If a mail item is undeliverable due to incorrect recipient’s address, Hongkong Post will return the item to the sender. If the item does not bear the sender’s address, it will then be processed according to the established procedures. Hongkong Post will not ask recipients to confirm or provide their delivery addresses, or solicit their personal information through email, social media or SMS.

  Phishing messages of Confirmation or Provision of Delivery Address

  Screen Capture	Remarks
  (Chinese version only)	The actual URL does not use any of the official domain names of Hongkong Post The email address does not use any of the official domain names of Hongkong Post
  	The actual URL does not use any of the official domain names of Hongkong Post The email address does not use any of the official domain names of Hongkong Post Hongkong Post will not send links requesting customer to settle payment
  (Chinese version only)	The URL does not use any of the official domain names of Hongkong Post
  (Chinese version only)	The URL does not use any of the official domain names of Hongkong Post
  (Chinese version only)	The URL does not use any of the official domain names of Hongkong Post
  	The actual URL does not use any of the official domain names of Hongkong Post The email address does not use any of the official domain names of Hongkong Post
  	The actual URL does not use any of the official domain names of Hongkong Post
  (Chinese version only)	The email address does not use any of the official domain names of Hongkong Post
  	The email address does not use any of the official domain names of Hongkong Post
  	The email address does not use any of the official domain names of Hongkong Post Hongkong Post will not send links requesting customer to settle payment
  	The email address does not use any of the official domain names of Hongkong Post Hongkong Post will not send links requesting customer to settle payment
  (Chinese version only)	The actual URL does not use any of the official domain names of Hongkong Post
  	The email address does not use any of the official domain names of Hongkong Post Hongkong Post will not send links requesting customer to settle payment
  	The email address does not use any of the official domain names of Hongkong Post
  (Chinese version only)	The actual URL does not use any of the official domain names of Hongkong Post
  	The email address does not use any of the official domain names of Hongkong Post

• Ownership ConfirmationOpen/collapse

  A photo of a packet is attached to the following message, asking for confirmation of the packet’s ownership. Please note that Hongkong Post will only deliver mail items according to the addresses indicated and will not send any photos to recipients or senders for confirmation of the items’ ownership.

  Phishing about Ownership Confirmation

  Screen Capture	Remarks
  	The actual URL does not use any of the official domain names of Hongkong Post

• About online lucky drawOpen/collapse

  Such fraudulent websites impersonating those of Hongkong Post invite participation in online lucky draw through pop-up windows, and request participants to provide personal and/or credit card information to win a prize. Please note that Hongkong Post has not conducted any lucky draw at the moment.

  Examples of online lucky draw

  Screen Capture	Remarks
  (Chinese version only)	The URL does not use any of the official domain names of Hongkong Post
  (Chinese version only)	The URL does not use any of the official domain names of Hongkong Post
  (Chinese version only)	The URL does not use any of the official domain names of Hongkong Post

Fraudulent Websites (Last Update: 26.10.2022)

Below are some screenshot examples of reported fraudulent websites that the public should stay alert to:

• Examples of Fraudulent WebsitesOpen/collapse

  Examples of Fraudulent Websites

  Screen Capture	Remarks
  (Chinese version only)	The actual URL does not use any of the official domain names of Hongkong Post Related Official Notices
  (Chinese version only)	The actual URL does not use any of the official domain names of Hongkong Post
  	The actual URL does not use any of the official domain names of Hongkong Post
  (Chinese version only)	The actual URL does not use any of the official domain names of Hongkong Post

Useful Links

• Anti-Deception Coordination Centre (ADCC)
• Protecting against Phishing Attacks - InfoSec.gov.hk
• Beware of Phishing Attacks - Cybersecurity.hk

Action to Be Taken in Response to Suspicious SMS Messages or Emails

If you receive any suspicious SMS messages or emails, please take the following actions:

1. Do NOT click on any embedded links or download any attachments in the SMS message or email;
2. Check the webpage that the embedded links will lead to against the official domain names of Hongkong Post, i.e. hongkongpost.hk, hongkongpost.gov.hk and ecert.gov.hk;
3. Delete the suspicious message or email immediately;
4. If in doubt, email us at hkpo@hkpo.gov.hk with information such as the caller’s phone number, sender’s email address, message content or screenshots of the SMS message or email in question for our verification.