You get a text that says your package could not be delivered. There is a link to reschedule, confirm your address, or pay a small customs fee. The message looks like it is from FedEx, DHL, India Post, or another courier you have used before.
This is a scam.
There is no failed delivery or pending parcel. The message is designed to get you to click the link and share your information or make a payment.
Most people have something on order which is what makes this tactic effective. It does not need to be targeted, it just needs to arrive at the right moment.
How it works
The scam follows a predictable sequence. It begins with a fake notification: an SMS or email claiming your parcel could not be delivered due to an incomplete address or an outstanding payment. The message is designed to look like it comes from a legitimate courier company, down to the logo and formatting.
The message includes a link, which takes you to a fake website built to collect your details such as your address, your bank card number, or both. The site may ask for a small re-delivery fee, usually just enough to seem plausible. Debit and credit card payments are typically the only option accepted, which is itself a sign.
Sometimes a phone call follows the message. Someone posing as a courier representative insists the parcel cannot be released until you complete the formalities via the link. The pressure is deliberate — once you pay or enter your information, the scammers disappear, and there is no parcel.
What to lookout for
Scammers rely on urgency and familiarity. The following are clear warning signs:
- Unexpected message: If you are not expecting a delivery, treat the message as suspicious. These scams do not rely on accuracy, only on probability. They are sent in bulk, counting on the fact that enough people will have a parcel in transit to make the message feel legitimate.
- Unverified links: Links that do not match the courier’s official website are a major red flag. Scam links often use slight variations of real domains or shortened URLs to hide their destination. Even when the page looks convincing, it is designed to collect your information.
- Pressure tactics: Messages that demand immediate action, such as resolving the issue within a few hours or risk having the parcel returned, are meant to rush you. This sense of urgency is deliberate, reducing the likelihood that you will stop to verify the request.
- Payment requests via SMS: Legitimate courier companies do not ask for payments through unsolicited messages or random links. Any request to pay a small fee for delivery, customs, or reattempt charges via SMS should be treated as fraudulent.
- Generic communication: Messages that use vague language, generic greetings, or do not include specific shipment details are a clear warning sign. Legitimate delivery notifications typically include identifiable information such as tracking numbers or sender details that can be independently verified.
You can report any cybercrime incidents to the National Cybercrime Helpline by dialling 1930. You can also visit the National Cybercrime Reporting Portal at cybercrime.gov.in to register your complaint online.