The text says a parcel is being held, or a fine is unpaid, or the bank has locked the login. The logo is familiar. The person who sent it often did not design any of that. They bought the page, the hosting and sometimes the account, the way someone else buys a shirt from a catalogue, and they sent the message the same day.
Microsoft and Japan's police followed a wave of those messages and found the shops. The familiar brand is the costume. The catalogue is the business.
How it works
- A marketplace sells accounts and ready-made sites that copy banks, shops, government offices and delivery firms. Templates let the buyer swap the logo and the language. The same skeleton can be a tax office in the morning and a parcel firm after lunch.
- You get a text or an email about a payment, a parcel or a security check. The deadline is short because the page does not need to survive for long.
- The page, from the kit, wants a password, a card or a code. That is the only original part of your morning: the details you type.
- The person who sent the message did not build the page. Microsoft said its investigators confirmed the shop by making controlled purchases. They bought what a scammer buys, and the goods arrived.
The screenshots are the catalogue made visible. One shop is selling logins to Microsoft 365 and Google Workspace. The texts are the fine and the parcel. The pages underneath are delivery, tax, housing and a bank, in more than one language, because the template was built to be translated.
Signs and red flags
A message about a fine, a missed delivery or a locked account, with a link and a deadline. A site that uses a real organisation's name and a domain that is one step off, or a page that asks you to sign in before it will "release" something. The same wording appearing for banks, airlines and police departments in different countries is a hint that the page came from a template, not from that organisation. A real fine does not need you to discover it through a link you did not ask for.
Cases and figures
Microsoft said on 14 October 2026 that three pieces of this market, YAM Store, CoGUI and Iron Man, had since January 2026 enabled more than one billion malicious messages aimed at over 75,000 organisations, including more than 750 million messages pointed at Microsoft customers, in more than 150 countries. Iron Man alone had more than 2,300 templates copying banks, retailers, hospitals, transport bodies, police and government agencies. A template count of 2,300 is why the parcel text and the hospital text can look equally finished. Someone drew them once and sold them many times.
With a US court order, Microsoft and the health-sector group Health-ISAC seized domains. Microsoft said it had disabled more than 20,000 accounts tied to YAM Store and was blocking more than 100,000 impersonation domains. YAM Store sold fraudulent Microsoft and Google accounts. CoGUI supplied the sites and the messages. The court papers name a defendant, Yang Jian, doing business as Yam Store. That is a civil action and a disruption, not a criminal verdict.
A seized domain does not unsend the text that already arrived. If the password was typed, the catalogue has done its job even if the shop later goes dark.
What to do and where to report
Do not use the link. Open the bank, the post office or the government site yourself, or use the app you already installed. If you typed a password, change it from a device that did not open the link, and tell the organisation. In the United States file at reportfraud.ftc.gov and, if money moved, at ic3.gov. In the United Kingdom use Action Fraud.
If you were hit, start at Get help. A message that offers to reverse the fine, or recover the card, for a fee is the catalogue's second product: Fake recovery.
This is general information, not legal or financial advice. The rules and the figures change. If money has already left, contact the bank and the authorities through the help pages.