What is the fake courier SMS scam?
You get a text message that looks like it comes from TCS, Leopards, PostEx, or Pakistan Post. It says your parcel could not be delivered, your address is incomplete, or a small customs fee is due. There is a link to “track” the parcel or “confirm” your details.
None of it is real. The sender is a scammer. The link opens a fake website designed to look like the courier company, and the small fee is the trap — the page asks for your full card details or personal information to process a payment that a real courier would never ask for online.
This trick is called smishing (SMS phishing), and Pakistan has seen repeated waves of it. Cybersecurity researchers have documented smishing campaigns in Pakistan impersonating Pakistan Post, TCS and Leopard, sending messages about undelivered packages and demanding payment and card details for extra fees. In other words: the brands you trust with your deliveries are the brands scammers pretend to be.
How the scam works
- You receive an SMS or WhatsApp message claiming to be from a courier company. It may use the company’s name, logo in the linked page, and a plausible consignment number.
- The message creates a small problem with an easy fix. Common versions: “your parcel is held at customs, pay Rs. 200 clearance fee”, “your address is incomplete, confirm it here”, or “reschedule your delivery”.
- The link leads to a lookalike website. It copies the courier company’s colours and layout. It shows a fake tracking timeline with one problem at the end, then asks you to enter your name, address, and card number to pay the tiny fee.
- Your details are harvested. Once you submit them, the scammers can attempt fraudulent purchases with your card, or reuse your personal details to make later scams more convincing.
Some variants skip the link entirely. In October 2026, the Pakistan Telecommunication Authority (PTA) warned that criminals were calling people posing as courier-company representatives and asking them to share one-time passwords (OTPs) to “complete the delivery”. In one reported case, the National Cyber Crime Investigation Agency (NCCIA) said it arrested a suspect in Lahore in August 2026 who allegedly posed as a courier representative to obtain OTPs from citizens and then hack their WhatsApp accounts.
What the PTA says
The PTA has issued multiple public warnings about fake courier messages (reported by ARY News, Times of Karachi and Geo TV). The key points from the authority:
- Fraudsters send fake delivery notifications and emails in the name of courier companies, asking people to click links, make payments, or share OTPs.
- Genuine courier companies do not ask you to enter verification codes to receive your parcel.
- The PTA urges citizens never to share OTPs, passwords, PINs or banking details with unknown callers, and to verify any delivery issue through the courier company’s official website, app or helpline — never through numbers or links in the suspicious message itself.
Red flags: how to spot a fake
| Real courier message | Fake courier message |
|---|---|
| Comes from the courier’s official sender name or short code | Comes from a random 03xx mobile number |
| Refers to a consignment number from an order you actually placed | Arrives even though you are not expecting any parcel |
| Never asks you to enter card details on an outside website | Asks for a small “customs fee”, “redelivery fee” or address confirmation via a link |
| Never asks for your OTP or verification code | Asks you to share an OTP or verification code |
| The link domain matches the courier’s official website | The link is shortened, odd-looking, or on a different domain |
A useful rule: no real courier in Pakistan asks for card details through an SMS link. Delivery fees in Pakistan are almost always paid cash-on-delivery to the rider or through the official app — never through a link in a surprise text message.
How to protect yourself
- Do not click the link. If you are expecting a parcel, open the courier company’s official app or website yourself (type the address, do not follow the SMS) and check the consignment number there.
- Never share OTPs or verification codes with anyone claiming to be a courier representative — over call, SMS or WhatsApp. Real couriers never need them.
- Check the sender. A delivery update from a random mobile number about a parcel you never ordered is almost certainly a scam.
- Look at the domain. On the linked page, check the website address carefully. A page pretending to be TCS but sitting on an unfamiliar domain is a fake.
- Report it. Forward scam messages to the FIA Cybercrime complaint portal (complaint.fia.gov.pk, helpline 1991) and report the sender’s number through the PTA’s complaint system. Reporting helps authorities track the networks behind these messages — the same playbook shows up in other fake-SMS schemes too, such as the fake BISP 8171 messages.
- Pause before paying. Scammers create urgency — “pay within 24 hours or your parcel is returned”. A real delivery issue can wait while you verify it independently.
- Warn your family. Older relatives and frequent online shoppers (who genuinely have parcels coming) are the easiest targets. Share this article with them — the OLX fake-buyer scam and fake Easypaisa/JazzCash payment screenshots use the same pressure-and-trust tactics, so recognising one protects against the others.