Getting an SMS about a "held" parcel or customs fee? Here's how the fake courier delivery scam works in India — and how to spot it before you tap. You didn't order anything, but your phone just buzzed:"Your parcel is on hold at customs. Pay ₹15 to release it." Or:"Update your delivery address to receive your package." It looks routine — almost boring. That's exactly why the fake courier delivery scam works so well.
**Why Is This Scam Spreading?
**India's courier and e-commerce delivery volume has grown rapidly, and scammers know that delivery notifications are easy to make believable. A message about a delayed or held parcel doesn't immediately raise suspicion in the same way as a lottery or fake job offer. Most people are expecting something to arrive. Government cyber advisories have repeatedly warned about fake delivery notifications that impersonate well-known courier brands. The result is a scam that blends into an everyday activity: **online shopping and parcel delivery.
How Does the Fake Courier Scam Work?** Although scammers change the wording and courier brand they impersonate, the basic pattern is usually the same.**
- You Receive a Trigger Message** You receive an SMS or WhatsApp message claiming that your delivery has encountered a problem. Common claims include:
- Your parcel is stuck at customs.
- Your address is incomplete.
- A delivery attempt has failed.
- You need to pay a small customs fee.
- You need to confirm your delivery details. The message is designed to make you act quickly.**
- The Message Contains a Suspicious Link** The scam message usually contains a link. The URL may be:
- A shortened link
- A lookalike courier domain
- A domain with extra characters or words
- A website designed to look like the real courier company's website The goal is to make the link appear legitimate enough that you won't stop to verify it.**
- You're Asked to Pay or Install an App** This is where the scam can take two different directions. You may be asked to pay a small "customs fee" or "redelivery fee." Alternatively, you may be instructed to download an "official delivery tracking app." That app can actually be a malicious APK.**
- The Real Damage Begins** A fake delivery APK may request dangerous permissions such as SMS and Accessibility access. If those permissions are granted, attackers may be able to:
- Read incoming OTPs
- Monitor activity on your screen
- Simulate taps
- Interact with other applications
- Potentially access banking or UPI applications This means the real financial risk may be much greater than the small fee mentioned in the original SMS.** Why Are Fake Delivery APKs So Dangerous?** The "small customs fee" version of the scam can already steal money, but the fake delivery APK can potentially give attackers much broader access to your device.** SMS Permission** SMS access can allow a malicious application to read incoming messages, including one-time passwords sent by financial services.** Accessibility Permission** Accessibility features are designed to help people interact with their devices. However, malicious applications can abuse these permissions to:
- View what's happening on the screen
- Simulate taps
- Interact with other apps
- Potentially operate banking applications** Overlay Permission** Overlay access can allow an application to display content on top of another application. Attackers may abuse this to create fake screens that resemble genuine banking or payment interfaces and attempt to capture sensitive information.** Why the Combination Is Dangerous** When several powerful permissions are combined, a malicious app can potentially give an attacker significant control over a compromised device. That's why fake delivery APKs should be treated as a high-risk threat, not simply an annoying spam message.** Why Is It So Easy to Fall For?** These scams work because they are designed around situations that already feel normal.** The message may arrive at the right time** You may have genuinely ordered something online recently. When a delivery-related message arrives, your brain naturally connects the two events.** The requested amount is small** A request for ₹15, ₹25, or another small amount may not seem worth investigating.** The branding looks convincing** Scammers can copy courier company logos, colors, layouts, and terminology to make a message appear authentic.** There's a sense of urgency** Messages may claim:"Your parcel will be returned if you don't confirm today." That urgency is deliberate.** The Psychology Behind Courier Scams** Fraud becomes more effective when it fits into a pattern that the victim already expects. Courier scams don't ask you to believe something unusual. They insert themselves into a normal routine. If you shop online, receiving a delivery notification isn't automatically suspicious. It's just another delivery message. Scammers also exploit loss aversion — our tendency to react strongly to the possibility of losing something. Compare:"You've won a reward." with:"Your parcel will be returned if you don't confirm today." The second message creates a fear of losing something you already expect to receive. That can make people act quickly without stopping to verify the message.** Examples of Fake Courier Scam Messages** Scammers frequently rotate the courier company they impersonate, but the basic wording tends to follow recognizable patterns.** Example 1 — Address Update"Your package could not be delivered due to incomplete address. Please update your details here: [link]" Example 2 — Customs Fee"Your parcel is held at the customs office. Pay a nominal customs duty of ₹XX to release it: [link]" Example 3 — Fake Tracking App"Failed delivery attempt. Reschedule your delivery by installing our tracking app: [link]" Example 4 — Fake Live Tracking"Your order is out for delivery today. Track live location here: [link]"** Notice the common pattern. None of these messages initially sound extremely alarming. The request appears administrative and low-risk. That's the point. How to Protect Yourself From Courier Scams A few simple habits can significantly reduce your risk.**
- Never Click Delivery Links From SMS or WhatsApp** Instead, open the courier company's official website or application yourself. Use your order number or AWB number to check the delivery status.**
- Never Install an APK From a Message** Do not install an Android APK that someone sends through SMS, WhatsApp, email, or another messaging platform claiming to be a courier tracking application. If you need a courier application, obtain it through the appropriate official app store or the courier company's verified website.**
- Carefully Check the Sender and URL** Look for:
- Unusual domains
- Extra characters
- Strange spellings
- Suspicious subdomains
- Shortened URLs
- Unexpected payment requests Don't trust a website simply because it contains the courier company's name.**
- Don't Enter Payment or Banking Information** If a delivery message unexpectedly asks for:
- Card details
- UPI credentials
- Banking passwords
- OTPs
- PINs Stop and verify the request independently.**
- Verify With the Courier Company** If you believe the message might be legitimate, find the courier company's customer-care details through its official website. Do not use the phone number or contact information provided inside the suspicious message.** What Should You Do If You've Already Clicked?** If you've already interacted with a suspicious courier link, don't panic — but act quickly.** Step 1: Disconnect From the Internet** If you suspect that a malicious application has been installed, turn on airplane mode or disconnect from Wi-Fi and mobile data. This can help interrupt an active connection between the malicious app and a remote server.** Step 2: Uninstall the Suspicious App** If you installed an APK from the suspicious link, uninstall it as soon as possible.** Step 3: Don't Enter Any Sensitive Information** Do not enter:
- Banking credentials
- UPI details
- OTPs
- Card information
- Passwords even if the resulting screen looks legitimate.** Step 4: Check Your Bank and UPI Transactions** Review your transaction history for any unfamiliar activity. Pay particular attention to transactions made after you interacted with the suspicious link or application.** Step 5: Change Relevant PINs and Credentials** If you believe your banking or UPI applications may have been compromised, change your relevant PINs and credentials.** Step 6: Report the Incident** Report suspected cybercrime through the National Cyber Crime Reporting Portal or the appropriate cybercrime reporting channel. Early reporting can be important, particularly when financial transactions are involved.** Step 7: Restart Your Phone** Restarting the device may help clear some non-persistent malicious processes, although a reboot should not be treated as proof that a compromised device is clean.** Frequently Asked Questions Can a courier scam affect me if I only clicked the link?** Simply opening a phishing link is usually less dangerous than entering information or installing an application, but it is not completely risk-free. Some malicious pages may attempt automatic downloads or exploit browser vulnerabilities. If you accidentally open one, close the page immediately and don't download anything or enter personal information.** How Can I Tell a Real Courier Tracking Link From a Fake One?** Carefully compare the domain with the courier company's official website. Look for:
- Extra words
- Unusual hyphens
- Misspellings
- Different domain extensions
- Suspicious subdomains The safest approach is not to use the link at all. Instead, open the courier company's official website or application separately and enter your order or AWB number.** Do Legitimate Courier Companies Charge Customs Fees Through SMS Links?** Be extremely cautious with any unexpected customs-fee request delivered through SMS or WhatsApp. Rather than paying through a link in the message, independently verify the shipment and any applicable charges through the courier's official channels and the relevant customs or government process.** Is It Safe to Reply "STOP" to a Suspicious Message?** It's better not to engage with suspicious senders. Replying can potentially confirm that your number is active, which may result in additional unwanted messages. Instead, block the sender and report the message where your carrier or messaging application provides that option.** How Arjuna Helps Detect Courier Scams** This is exactly the type of situation Arjuna's Fake APK Detection and AI URL Scanner are designed to help with. Before tapping a suspicious "track my parcel" link received through SMS or WhatsApp, Arjuna can check the destination for suspicious URL and phishing patterns and identify potentially risky sideloaded applications. The goal is simple: Detect the threat before you interact with it — rather than after your account has already been compromised. Scan Suspicious Links Before You Open Them Use Arjuna to check suspicious delivery links and identify potential threats before interacting with them.
**Get Arjuna on the App Store **Get Arjuna on Google Play**
Key Takeaways**
- Fake courier messages are a common scam format in India.
- A small "customs fee" may be only the beginning of the attack.
- Fake delivery APKs can request powerful permissions such as SMS and Accessibility access.
- Never install an APK sent through an unexpected SMS or WhatsApp message.
- Don't click delivery links blindly — verify the shipment through the courier's official website or app.
- Never provide OTPs, UPI credentials, PINs, or banking information through an unsolicited delivery link.
- If you've installed a suspicious app, disconnect from the internet and take action immediately.
- Use a security tool such as Arjuna to check suspicious URLs and potentially malicious applications before interacting with them. ** Sources**
- I4C Cyber Alerts: https://cybercrime.gov.in
- Arjuna Cyber Alerts: https://myarjuna.com/cyber-alerts