Parcel Delivery Scam Messages Exploit an Expected Knock

The Message Arrives at the Exact Wrong Moment

A parcel-delivery message feels convincing when a real order is already on the way. That is the uncomfortable advantage behind parcel delivery scam messages: the lie does not need to invent an errand. It only needs to arrive while the recipient is waiting for one.

The useful habit is simple. Treat the parcel as expected and the message as unverified. A three-minute check is enough to separate an ordinary delivery update from a link, payment request, or OTP prompt that should stop the interaction immediately.

A Safer Route Through the Parcel-Message Mess

The Message Arrives at the Exact Wrong Moment
The Message Problem in One Minute
Delivery Convenience Creates a Trust Shortcut
Use the Expected Parcel, Unexpected Message Rule
Know When the Message Has Crossed the Line
A Parcel Can Wait Longer Than a Bad Decision
Frequently Asked Questions
References

The Message Problem in One Minute

Best for: People receiving parcels at homes, offices, lockers, lift lobbies, and neighbourhood collection points.
What this covers: Low-risk checks for suspicious parcel messages, payment requests, delivery links, and redelivery prompts.
What this does not cover: A guarantee that every delivery message, website, or app notification is legitimate.
Main caution: Expecting a real parcel does not make an unexpected link safe.
When to get professional help: Contact your bank immediately after an unauthorised transaction or after entering card details, banking credentials, or an OTP on a suspicious page.

Delivery Convenience Creates a Trust Shortcut

Urban delivery systems solve a real problem. Parcels can travel across a dense city, reach a locker, arrive at a lift lobby, or wait at an approved collection point without requiring the recipient to spend an afternoon beside the door.

IMDA's Federated Locker and Collection Points Programme describes a delivery network designed to improve last-mile fulfilment and create a more consistent parcel-delivery experience across locker operators, delivery companies, marketplaces, and retailers.

That convenience creates a mental shortcut. People receive more legitimate delivery notifications, so a message about one more parcel feels ordinary. The scammer does not need a dramatic story. A small failed-delivery claim can be enough.

Three Messages That Look Similar but Are Not

Message type	Typical purpose	Safer response	Reason to stop
Expected delivery update inside an official app	Track or manage an order	Open the trusted app directly	The app unexpectedly sends you to an unfamiliar website
Physical non-delivery notice	Tell you where to collect an undelivered item	Follow the official collection instructions	The notice asks you to send banking details through an unrelated channel
Unexpected WhatsApp, SMS, or email link	Claim that delivery failed or information is incomplete	Do not tap the link; verify through the official app or website	The page asks for payment, card details, banking credentials, or an OTP

The important detail is not whether a parcel exists. It is whether the requested action fits the official process.

The March 2026 Example

On 27 March 2026, the Singapore Police Force published an advisory about WhatsApp messages impersonating SingPost. The messages claimed that a parcel could not be delivered because information was incomplete. Recipients were directed to an embedded link for redelivery.

The linked phishing sites requested banking credentials, credit or debit card details, and OTPs. SPF said that at least 10 cases had been reported since 15 March 2026, with losses amounting to at least S$22,000.

The message worked because failed delivery is plausible. People miss calls. Lift-lobby instructions can be unclear. A parcel locker may require collection. An address may need confirmation in a legitimate marketplace app. The scam borrows that everyday friction and turns it into pressure.

The Pattern Is Not New

A November 2024 SPF advisory described a surge in parcel-delivery phishing scams after major online-shopping events. Since 1 January 2024, at least 631 cases had been reported, with losses of at least S$1.1 million. SPF said at least 505 of those cases involved impersonation of SingPost, with losses of at least S$955,000.

The lesson is not that every delivery update is suspicious. The lesson is that an expected shopping period can make a fake delivery message easier to believe.

Use the Expected Parcel, Unexpected Message Rule

The rule fits on one line:

Expect the parcel. Verify the message separately.

Do not let a real order lend credibility to an unrelated link. Open the official platform, courier app, or company website yourself instead of entering through the message.

The Three-Minute Parcel-Message Audit

Minute 1: Stop Before Tapping

Read the message without opening the link.

Ask:

Did I expect this message through WhatsApp, SMS, email, or another channel?
Does it create urgency around a failed delivery, address problem, customs fee, or redelivery charge?
Does it ask me to use an embedded link?
Does it request payment or personal details before I can see the parcel status?

A message that demands immediate action is not proof of urgency. It is a reason to slow down.

Minute 2: Open the Trusted Route Yourself

Use the official route you already know:

Open the merchant or marketplace app directly.
Open the courier's official app or type the official website address yourself.
Use the tracking number from the original order record when available.
Check whether the delivery status inside the trusted route matches the message.

SingPost says parcels should be tracked through its mobile app or official tracking page. It also says payments to SingPost should not be made through an online link sent in a message.

Minute 3: Check the Request, Not the Story

A message can sound ordinary while the request is wrong.

Stop when the page asks for:

Full personal details that should not be needed for a routine tracking check.
Credit or debit card details through an unexpected link.
Banking credentials.
An OTP.
An app download outside an official app store.
A small “redelivery fee” that appears designed to make payment feel harmless.

A small fee can create a large problem when it collects card details or login information.

The Lift-Lobby Scenario

Imagine receiving a message at 19:20 while travelling home. A parcel is expected, and the building entrance has caused delivery confusion before. The message claims that the rider could not complete delivery and asks for S$1.80 to schedule another attempt.

The amount is small. The timing feels believable. The link is still the problem.

The safer route is to close the message, open the original shopping app, check the order status, and use the courier's official contact route when needed. A legitimate delay can wait three minutes. A suspicious link does not deserve the benefit of the doubt.

Know When the Message Has Crossed the Line

SingPost's security guidance says scammers use SMS and email phishing disguised as delivery notifications to direct customers to fake websites for payments or sensitive personal information. It lists warning signs such as sender variations, URLs that do not end with the official domain, and requests for personal details or online payment.

SingPost also says it switched to mobile-app push notifications for service updates in 2022, while retaining SMS for limited situations such as verification PINs, POPStation-related updates, digital queue tickets, and selected customer-service follow-ups.

That does not mean every SMS is fake. It means the content and requested action still matter.

What Not to Assume

“I ordered something this week, so the message is probably real.” Scammers benefit from ordinary shopping habits. Verify through the original order record.
“The fee is only S$1.80, so the risk is small.” The amount may be bait for collecting card or banking details.
“The sender name looks familiar.” Sender names, logos, colours, and page layouts can be imitated.
“The website has a polished design.” A convincing layout does not prove the site is official.
“I should fix the address before the parcel is returned.” Pressure is not verification. Check the delivery status independently.

Red Flags That Deserve an Immediate Stop

A WhatsApp, SMS, or email message contains an embedded payment link.
The page asks for an OTP.
The link leads to a domain that does not match the official company website.
The message claims a failed delivery but provides no reliable tracking context.
The message requests card details for a small redelivery fee.
The page asks for banking credentials.
The sender pressures you to act before a short deadline.
The message asks you to install an app from an unfamiliar website.

What Not to Do

Do not reply with personal information. Do not tap the link merely to see where it goes. Do not enter a card number because the fee appears minor. Do not provide an OTP. Do not download an app from a page opened by an unexpected message.

Do not assume that a delivery problem needs to be fixed immediately while standing in a queue, leaving a station, or carrying groceries through a lift lobby. That is the exact moment to use the slower route.

Use a Safer Parcel Routine Before the Next Order Arrives

A reliable parcel routine should reduce decisions before a suspicious message appears.

Safer Next Steps

Keep order records in the original platform. Check status inside the marketplace or merchant app first.
Use official courier routes. Open the courier app or website yourself instead of following an embedded link.
Keep delivery notes clear. Add the correct entrance, lift lobby, collection point, or locker choice where the platform allows it.
Use lockers when they solve a real handoff problem. A clear collection point can reduce missed-delivery confusion.
Set banking safeguards. ScamShield recommends using official banking apps, enabling security features such as 2FA, and setting transaction limits.
Tell someone when the message looks suspicious. A second glance can interrupt the urgency effect.

After a Suspicious Interaction

What happened	Safer next step
You received the message but did not tap anything	Delete or report it, then verify the parcel through the trusted route
You opened the link but entered nothing	Close the page and use the official app or website directly
You entered personal information	Change relevant account credentials and monitor activity
You entered card or banking details	Contact your bank immediately
You provided an OTP or see an unauthorised transaction	Contact your bank immediately and make a police report
You are unsure whether the message is a scam	Use ScamShield's official checking tools or call the 24/7 ScamShield Helpline at 1799

A Parcel Can Wait Longer Than a Bad Decision

The weakest link in a delivery-heavy city is not always the road, the locker, or the lift lobby. Sometimes it is the message that arrives while an ordinary delivery problem already feels plausible.

Keep the rule simple: expect the parcel, verify the message separately. Open the trusted route yourself. Treat embedded payment links, OTP requests, and unfamiliar pages as reasons to stop.

A delayed parcel is inconvenient. Giving a phishing page your banking details is worse.

Frequently Asked Questions

Q1. Is every parcel-delivery SMS a scam?
No. Some legitimate delivery services may use SMS for limited purposes. Check the requested action rather than trusting the format alone. Use the official app, marketplace account, or company website directly instead of opening an unexpected embedded link.

Q2. What should I do when I am expecting a real parcel?
Open the original shopping or delivery app and check the order there. A real order does not prove that a separate WhatsApp, SMS, or email link is legitimate.

Q3. Is a small redelivery fee safe to pay through a message link?
Do not assume it is safe because the amount is small. A phishing page may use a minor fee as bait to collect card details, banking credentials, or OTPs. Verify through the official courier route.

Q4. Where can I check a suspicious parcel message?
Use ScamShield's official checking tools or call the 24/7 ScamShield Helpline at 1799. Contact your bank immediately after an unauthorised transaction or suspected exposure of banking details.

By: Rex Iriarte
About the author: Rex Iriarte is a Raxan.net contributor covering technology, small business, and practical digital habits.
Last updated: 2026-06-02
Disclosure: No paid placement influenced this post.

Disclaimer

This post provides general scam-prevention information, not a guarantee that a message, website, courier, or transaction is legitimate. Contact your bank immediately if you see an unauthorised transaction or believe card details, banking credentials, or an OTP were exposed. Use official reporting channels when further help is needed.