What is Reconfirm Shipping Documents Email Scam

Reconfirm Shipping Documents Email Scam is a phishing attempt that aims to trick users into giving away their email login credentials. The email informs users that goods have been sent to them and they need to reconfirm shipping documents in order to receive them. The sender claims to be from Pan Ocean, a shipping company based in South Korea.

Reconfirm Shipping Documents Email Scam

There are two files attached to the email, supposedly documents that the recipient needs to urgently review and reconfirm. However, if users try to open the files, they would be prompted to log in to their email account. And if they fall for this phishing attempt and type in their email login credentials in the window that pops up, that information would immediately be sent to the malicious actors operating this phishing scam. This would allow the phishing campaign operators to hijack users’ email accounts and then steal all the information that can be found in the account.

The two files attached to the emails are titled PAYMENT SLIP.HTML. They’re both detected as malicious by anti-malware programs. As soon as you open them, you would be prompted to “verify your identity”. One of the prompts requests that you type in your email password while another wants you to log in using your Adobe ID. Whatever you type in those fields will be immediately transferred to the malicious actors operating this phishing campaign. Once they have the login credentials, the malicious actors can then either use them themselves or sell them to other cybercriminals. Whatever they do, it could lead to your email account being hijacked. If the hijacked email account is connected to other accounts, they could be hijacked as well. Overall, successful phishing attacks can have disastrous consequences for the victim.

The full Reconfirm Shipping Documents Email Scam reads as follows:


Dear Sir,

FYI we got instruction from our client to contact you based on the above subject. We kindly ask you to reconfirm shipping documents asap and revert back immediately before goods are dispatched.

Regards Barbara P. MarshallPan Ocean Co., Ltd.
TEL : 82-2-316-5472
MOBILE : 82-10-6619-9689

How to recognize phishing emails?

In many cases, phishing emails are not difficult to identify as long as you know what to look for.

A quick search with Google shows that there is indeed a shipping company based in South Korea named Pan Ocean. The provided address, as well as phone numbers, are different from the ones provided by the shipping company on their website but similar enough that users not paying enough attention may not notice the difference. Using a legitimate company’s name in malicious and phishing emails is a known trick and does work in some cases. Users who are unsure about whether an email is legitimate or not may look into the sender’s company, and if it does exist, they’re more likely to click on the link or open an attachment.

One thing that stands out in this Reconfirm Shipping Documents Email Scam is the use of informal words that you would not see in such correspondence if it was legitimate. For example, the “FYI” abbreviation for “for your information” or the usage of “asap”. You would never see such informal words in an actual email from a shipping company because it looks very unprofessional. And while this particular email lacks overly obvious grammar and spelling mistakes, they can often be seen in other malicious emails. It is believed that the mistakes are made on purpose to filter out more attentive users because users who do not notice the signs are more likely to interact with the email and do what it asks.

Another thing that you should always pay attention to is how an email addresses you. The Reconfirm Shipping Documents Email Scam addresses you as “Sir”, while the email’s content implies that they should know your name. In many cases, when you receive an email from a company whose services you use, you will be addressed by name. However, phishing or malicious emails often use generic words (e.g. Sir, User, Member, etc.) because they do not have access to personal information besides the email address.


More information about SpyWarrior and Uninstall Instructions. Please review SpyWarrior EULA and Privacy Policy. SpyWarrior scanner is free. If it detects a malware, purchase its full version to remove it.

  • WiperSoft Review Details WiperSoft (www.wipersoft.com) is a security tool that provides real-time security from potential threats. Nowadays, many users tend to download free software from the Intern ...

  • Is MacKeeper a virus? MacKeeper is not a virus, nor is it a scam. While there are various opinions about the program on the Internet, a lot of the people who so notoriously hate the program have neve ...

  • While the creators of MalwareBytes anti-malware have not been in this business for long time, they make up for it with their enthusiastic approach. Statistic from such websites like CNET shows that th ...


Site Disclaimer

2-remove-virus.com is not sponsored, owned, affiliated, or linked to malware developers or distributors that are referenced in this article. The article does not promote or endorse any type of malware. We aim at providing useful information that will help computer users to detect and eliminate the unwanted malicious programs from their computers. This can be done manually by following the instructions presented in the article or automatically by implementing the suggested anti-malware tools.

The article is only meant to be used for educational purposes. If you follow the instructions given in the article, you agree to be contracted by the disclaimer. We do not guarantee that the artcile will present you with a solution that removes the malign threats completely. Malware changes constantly, which is why, in some cases, it may be difficult to clean the computer fully by using only the manual removal instructions.

Leave a Reply