It's a very common scam in my neck of the woods as well. I'm constantly receiving emails with text like "your package is held up at customs, please pay $2.50 to release it".

Are enough people buying online AND losing track of their orders that they will just blindly take the bait? I fail to see how this vector is more lucrative than the "your computer is infected" route.

Anecdotally for me, roughly once every ~10-20 orders does the attack coincide with an order that I'm waiting for. But then I know where the order is coming from, I know which courier is handling my package, and the store 9/10 times have an online tracker and the shop itself will alert me if there are any delivery shenanigans going on.