The Phishing Messages Imitating Qatari Banks, Delivery Companies and Government Apps

What if a text message in the early afternoon announced that the package you ordered had missed delivery and that you had to pay a few euros to have it redelivered within an hour or so? It sounds plausible since you've ordered something online recently. But one single tap will lead you to a fake page to steal your money.

That's a typical phishing e-mail here. The phishers can relate to familiar situations; they copy the body text from genuinely legitimate organizations, and also put us under pressure with our "dillydallying". They reach residents, expatriates, and business owners via WhatsApp, email, SMS, or social media with these types of messages. The clues make it easier to prevent an emotional reaction.

1. Fake Bank Messages

Messages from your bank might say a card has been disabled, flagged for unusual activity, or that a payment didn't go through. Some will try to get you to log in, update your account, or verify a transaction by entering a one-time password.

How these messages may seem convincing if you've received these types of messages, they may seem convincing, as your bank is encouraging you to take action and protect your money. Never! We will never send you an email or call you for your PIN, password, or a one-time verification code.

If your message mentions suspicious transactions, contact your bank by calling the number on the back of your card or through your banking app.

2. Fake Delivery and Courier Notifications

Fake delivery scams often reference an undelivered parcel, a customs charge, an additional redelivery fee, or a request to confirm your address. Often, these scams arrive within an hour of an authentic online purchase.

Verify on the merchant's website or the courier's app that your order is confirmed and check the shipping tracking status before paying anything. If the amount you are claiming seems too fresh, vulnerable, or suspicious and calls for research, contact the entity using verifiable contact details.

Don't assume it's legitimate just because it mentions a parcel you're waiting for.Or a suspicious notification doesn't mean your retailer or courier has been hacked.

3. Fake Government Service Messages

An additional typical method makes use of claims for unpaid penalties, residency, or visa paperwork, tax problems and also refunds. The sender might recommend that action must be taken quickly to avoid a penalty or service disruption.

Do not click the link provided. Instead, go to the government service through its official website or app. Verify if the notification is present in your account and, if you need advice, use the contact details given there.

For more information, check the Qatar Ministry of Interior website. The National Cyber Security Agency is an additional official source for general Cyber Security tips and advice.

Why Do These Messages Look Genuine?

Messages can mimic well-known brands, appear to be sent from a plausible sender name and send users to genuine-looking websites. Some messages may even be delivered through existing messaging threads and callers may already know some simple details about their victims.

They're meant to validate a message, not to suggest a device has actually been targeted and taken by a specific entity. Even if it looks like it's from an expert sender, includes a recognizable name, or even has some authentic personal info, it isn't real.

A Simple Routine for Checking Messages

Repeat the same steps for any message if it is related to any of what comes next:

1. Stop. Don't be forced into making decisions by deadlines, pressure threats, or scare tactics.

2. Don't use the link provided. Don't ring any numbers included in a suspicious message.

3. Navigate to the official service on your own. Access the official app or write the trusted web address into your browser.

4. Cross-check. Do not trust blindly if you have doubts, contact the organization, contactable via its website or other reliable sources.

5. Secure your passwords. Never share your password, PIN, or a one-time code with a caller you weren't expecting.

6. Check financial requests. If they ask for money or details about a bank account, call the bank using the phone number on the back of your card.

Invest a few minutes in yourself and make sure the hasty choice doesn't prove costly.

Add Other Layers of Protection

You can also help protect yourself online to lower your chances of being hacked. Have a different password for each of your most valuable accounts (and maybe for all of your accounts a trustworthy password manager can help), enable two-factor authentication where available, make sure your device and apps are always current, and enable the correct transaction alerting and/or limit(s) with your financial institution.

"Wi-Fi and internet connection": What if I'm entering my financial/government websites on Wi-Fi anywhere at airports, shopping malls, and coffee shops? Use a free VPN to encrypt your connection.

What If You Have Already Responded?

No shame. The messages are designed to trick you if you react fast you can limit the damage.

• If you gave your bank details or paid: Contact your bank to stop any compromised cards and ask whether they can stop the transactions.

• Your password: Change it on a device you trust, update all your other accounts where you've used this password, and log out of any other sessions you're able to.

• If you provided a verification code: Contact the relevant service now and secure your account.

• Preserve information: Retain any screenshots, the full message, details about the sender, transaction data and any other communication.

• Report the incident: Use the official reporting mechanism of the concerned organization and follow the latest reporting guidance shared by Qatar's Ministry of Interior/National Cyber Security Agency. Contact your telecom operator through official channels for guidance.

Never send money to anyone who offers to help you get your money back for a fee.

A Note for Small Businesses

Teach employees to recognize scam emails and verify unexpected instructions for bank payments or changes to suppliers' bank accounts. If practical, keep separate accounts for business banking and order deliveries, and restrict staff access to sensitive information as needed.

Your Quick Phishing Checklist

Before you answer any unknown text, ask yourself:

• Is it pressuring me to act immediately?

• Is it asking for a money password, PIN or verification code?

• Is it possible to double-check the statement on the official website or app?

• Have I confirmed the sender using their publicly available contact information?

• Am I using a secure, updated device and connection?

The easiest solution is to do nothing: don't click, don't share the code, verify for yourself. Any organization that actually needs your action should give you an alternative means of confirming the message without forwarding a suspicious request. And again, being cautious is not being alarmist; it's just a sensible precaution.