Sophisticated Phishing Scam Targets Israelis with Fake Customs Fees

A new phishing scam is targeting Israelis by impersonating the postal service and requesting small customs fees to steal credit card information. The fraudulent message, often sent from a regular mobile number, claims a package is held at customs and requires a nominal payment via a shortened link. The fake webpage mimics the official Israel Post website, displaying a tracking number and requesting credit card details, expiration date, and CVV. A second stage involves a fake verification prompt, coinciding with a legitimate SMS from the credit card company containing a one-time code. Scammers trick victims into entering this code on the fake site, which they then use to add the compromised card to a digital wallet or authorize a larger transaction. The customs fee serves as bait, while the verification code is the actual target for theft. Adding a card to a digital wallet is a preferred method for fraudsters, as it allows them to make purchases while the victim still possesses their physical card, with fraudulent charges appearing as normal transactions. The legitimate SMS about adding a card to a new digital wallet is often the first sign of compromise.

Scammers adapt their tactics seasonally, using customs and package delivery scams before holidays, or impersonating city parking ticket notifications or electricity bill payment reminders. Some versions of the scam, reportedly circulated in 2026, include fabricated legal text about cross-border shipment security to justify manual checks and the need for personal details. The article highlights a case where a customer lost NIS 52,000 after clicking a similar link, though most of the money was recovered through negotiation with the bank. Under Israeli law, for unauthorized remote transactions where the card remains with the owner, customers are liable for a maximum of NIS 450, with credit card companies responsible for the remainder within eight business days. A 30-day window exists to dispute such charges. Previously, providing a verification code could negate customer protection, but a 2021 Ministry of Justice opinion clarified that sharing a code with an imposter still keeps the customer within the legal protection framework, a policy enforced by the Banking Supervision Department in 2025.

Victims are advised to immediately block their card, report the misuse to their credit card company, check for unauthorized digital wallet additions, save all messages and screenshots, report the incident to the National Cyber Directorate's hotline (119), and change any passwords entered on suspicious pages. Package status should be verified directly through the official postal website or app, not via provided links. The National Cyber Directorate's hotline handled approximately 13,700 phishing reports in 2025, a 35% increase from the previous year, indicating a significant rise in such scams.