Dubai: Received that package you were expecting? Great. But before you dispose the cardboard box, take a moment to rip off the delivery label that has all your personal contact information – it could save you from being spammed or hacked.

What’s in a delivery label and why should I remove it?

Digital Dubai, the government entity established to digitise all aspects of life and business in the emirate, recently shared cautionary advice on how delivery labels are often overlooked – to the individual’s detriment.

Shipping and delivery labels often contain sensitive personal information, including the following:

  • Your full name
  • Phone number
  • Residential address
  • QR codes with encoded personal details

Leaving packages unattended or throwing them away with labels intact, gives scammers easy access to your private information.

Shahbaz Khan, a Canadian systems administrator, said: “A delivery label can reveal more personal information than people realise. Think of it as a small piece of your personal identity. On its own, it may seem harmless, but in the wrong hands, it can become part of a much bigger security problem.”

What kind of security risks could I be exposed to?

Leaving a label in the hands of unknown individuals can lead to potential privacy breaches, targeted scams or even harassment. For instance, in Digital Dubai’s video post, an individual’s personal data is lifted off a delivery label and sold to hundreds of companies – from sheep farms to crypto and real estate brokers – leading to the person being constantly spammed by telemarketing ads and calls offering services he never signed up for.

Khan outlined a few other scenarios that could occur:

Targeted phishing attacks: Since the scammer knows your name, address, and even the retailer you purchased from, they can send you a convincing text, asking you to pay a certain amount as pending charges. Khan said: “Because the message contains genuine personal details, you’re more likely to trust it and click on the link in the text.”

Identity theft and impersonation: Hackers use the label’s data as a starting point, combining it with publicly available information to build a more complete profile of you, as an individual. Khan said: “They may use this information to impersonate you when contacting businesses, banks or attempting account recovery.”

Social engineering: This occurs when, instead of hacking technical firewalls or cracking passwords, hackers target human trust or fear. Khan shared an example: “A scammer could call a delivery company, pretending to be you. They might use your name, address and tracking number to convince customer support that they are the legitimate recipient.”

Physical security threats: In extreme circumstances, giving away your information could create physical threats, such as stalking and harassment, or targeted burglary.

How can I protect myself?

Digital Dubai advises peeling off or cutting out the delivery label from your package, and properly destroying or shredding it, rather than leaving it intact.

Khan added: “Black out barcodes and QR codes, not just your name and address, as it may contain shipment identifiers or encoded personal information. Never share tracking numbers publicly, and always be suspicious of delivery-related SMS notifications that request payment or personal information.”

The key is to be proactive and ensure you’re not leaving valuable information in the wrong hands. Khan said: “A delivery label isn’t like a passport or credit card, and someone generally cannot steal your identity using the label alone. But it still provides valuable pieces of a person’s identity that can be combined with other information to accelerate fraud, phishing, impersonation and other threats.”

How do I report a scam?

If you’re already the victim of an impersonation scam, phishing attack, or other similar security breach, you can report it via Dubai Police’s eCrime Hub – its dedicated portal for reporting cybercrimes.

Learn more about the eCrime Hub, and follow these steps to report an incident:

  • Visit ecrimehub.gov.ae or ecrime.ae. On the top-right, in the Menu bar, click on the green ‘Report’ button. Alternatively, you can navigate to the ‘Report and Recover’ tab and select ‘Report eCrime’.
  • Fill out the form with details of the incident.
  • It’s best to ensure you have evidence, such as screenshots of messages, websites, profiles, receipts or emails. You can upload your evidence to help validate your concerns.
  • Provide personal details by entering your full name, Emirates ID, and your contact information.
  • Submit your report.

The service is available 24/7 and based on the nature of the report, it will be transferred immediately to the relevant department for prompt action.