Customs payment email is trying to sting you
A customs payment phishing email using the sender domain drlenoreellett.com.au is circulating across NZ, trying to rush you into paying to release a shipment.
You might receive an email with the subject line "1C843" that looks like a delivery or customs notice, telling you your shipment is being held and needs payment before it can be released. It presents itself as a delivery service customs alert and pushes you to use a "PAY NOW" button or link to avoid delays, even if you are not expecting a parcel.
What gives it away is that the message does not properly prove who sent it. Your email system could not verify the sender through normal domain protection checks, even though one basic sending check passed, which is a common trick in spoofed email. The sender domain also does not carry an established reputation as a trusted sender for customs or courier billing, so there is no solid history to support the story the email is telling you.
The attacker is after your click and your payment details. If you follow the link, you could be pushed to hand over card information, personal details, or other data that can be reused for fraud. If you engage with the message, you may also confirm that your address is active and invite more phishing attempts.
This campaign has already been observed across multiple organisations in the last day, which means you should treat any unexpected customs payment email with immediate suspicion. If your team handles freight, purchasing, or accounts, they are the most likely targets.
The domain the message claims to be from. Fresh registrations and known-bad reputations are the strongest technical tells of a spoofed sender.
Practical steps you or your IT provider can take to reduce the risk from this kind of threat.
- Check: Confirm with your courier, freight provider, or supplier through a trusted phone number or website before paying any unexpected customs charge.
- Do not: Click payment links or open forms in unexpected delivery emails, especially if you were not waiting on a shipment.
- Check: Review whether the sender domain matches the organisation claiming payment, and treat messages with failed sender verification as suspicious.
- Report: Use your phishing reporting process or send the message to your IT provider for review so it can be blocked for other staff.
- Contact Decision1: If you believe your business has been targeted, contact the Decision1 team immediately.
See what a genuine NZ Customs message looks like, the real sender domain, the real link destination, and where to report a fake.