Legal information notice: this article provides general information and isn't a substitute for advice from a qualified lawyer.
A WhatsApp message claiming your parcel couldn’t be delivered due to an “incomplete address” or a small pending “customs duty,” with a link to fix it — this is one of the most common phishing formats in India right now, precisely because almost everyone is expecting a delivery at any given time. Here’s how to spot it and what to do if you’ve already clicked.
If you’re genuinely expecting a delivery, check its status directly through the courier’s official app or website using your own tracking number, not the link sent in the message.
Close the page immediately without entering any payment or personal details — simply visiting a phishing link is generally not harmful on its own, unless it prompts a file download.
Report it as a potential compromise right away and ask them to monitor or block the card/account as needed.
Remove the app immediately, run a security scan using a reputable antivirus app, and change your banking passwords from a separate, secure device as a precaution.
File at cybercrime.gov.in or call 1930, including the message content and sender number.
Legitimate courier companies almost never ask you to pay a “customs duty” or “redelivery fee” through a link sent via WhatsApp — real customs charges, where applicable, are typically collected by the courier’s own delivery staff at the time of delivery, not pre-paid through a message link.
| Genuine | Scam Pattern |
|---|---|
| Matches a delivery you're actually expecting, with a real tracking number | Vague or unexpected, often with no specific order reference you recognize |
| Links directly to the courier's own verified domain | Uses a shortened, misspelled, or unrelated domain |
| Any fee is collected by delivery staff in person, or via the official app | Requests payment details through a link sent via WhatsApp |
No. Reporting on cybercrime.gov.in is free, and your bank doesn’t charge to investigate a potential compromise.
Yes — the reporting and account-securing process is designed for direct self-service. A lawyer becomes relevant only if this leads to significant financial fraud that isn’t resolved through your bank’s standard dispute process.
Need professional legal help with this?
Find a Lawyer on VidyodayIf you entered card details on the fake page and see unauthorized charges, see our guide on credit card fraud. For the general phishing/OTP fraud pattern this scam is part of, see our guide on OTP fraud.
Yes — simply reading a message is safe; the risk comes from clicking the link and, especially, from entering information or downloading a file afterward.
Go directly to the courier’s official app or website and enter your own tracking number, rather than clicking any link sent to you.
Report it to your bank immediately as a potentially fraudulent transaction, and report the scam on cybercrime.gov.in as well.
It can install malware designed to read SMS messages (including OTPs) and other sensitive data from your device — uninstall it immediately if this happened.
Some do send legitimate delivery updates, which is exactly why this scam is effective — always verify independently rather than trusting the message’s link directly.
Yes, after reporting it — blocking prevents further messages from that specific number, though scammers frequently use new numbers for each campaign.
Yes, and it’s genuinely useful to do so — reporting the number and message helps authorities track the scale and pattern of the campaign, protecting others.
This article is for general information only and does not constitute legal advice. Scam tactics evolve constantly — always verify delivery notifications directly through the courier’s own official channels.
