"Parcel on hold": the fake NIPOST SMS and other delivery scams

"Parcel on hold": the fake NIPOST SMS and other delivery scams

"NIPOST: your parcel could not be delivered because of unpaid charges. Pay the ₦1,850 clearance fee here." Plus a link. This kind of text, which can carry the name of NIPOST or of a courier such as DHL, GIG Logistics, Red Star Express or UPS, is a classic smishing trick. It works because so many people shop online or expect something from abroad: at any moment someone has a parcel on the way, so the message lands on fertile ground.

The amount is deliberately small. The goal was never to collect that fee: it is to get you to enter your full card details on a fake site imitating the delivery company, and sometimes the OTP that arrives next, so they can make much bigger charges.

There is also a bigger, story-driven version: a "parcel held at customs" that someone you met online, or a "diplomat", has supposedly sent you, which can only be released after you pay a "clearance fee", then another, then another. The packaging is different; the scam is the same.

Why it works even when you are not expecting a parcel

The scammers do not know whether you are expecting an order. They do not need to:

• Volume. They send the same text to thousands of numbers. With so much online shopping, plenty of recipients really do have something on the way, or had one recently, so the message fits.
• A small amount. A fee of ₦1,850 does not set off alarms. Nobody checks a small payment the way they would check a ₦150,000 one.
• Urgency and zero friction. "Pay now and get it tomorrow" pushes you to sort it out on the spot, from your phone, without checking the sender or the address.
• A rotating disguise. When one brand burns out (people start warning that "that NIPOST text is fake"), the campaign switches to another courier. The skeleton is always the same as in fake bank and "BVN update" texts: a known name + something pending + urgency + a payment link.

How to spot the fake SMS

None of these signs on its own is conclusive, but together they are a fairly reliable diagnosis:

• It asks you to pay fees through a link. Even when a charge is genuine, you can settle it through the courier's official website, app or office, starting from your tracking number, so never pay through a link in an unexpected text. Genuine customs charges come with shipment paperwork you can trace.
• The link is not the official domain. Addresses with extra hyphens and words ("nipost-delivery", "dhl-parcel", "gigl-tracking") or strange endings. On a phone screen, in a hurry, they slip through; read them calmly and they stand out.
• It mentions no real tracking number. The fake text talks about "your parcel" in general because it does not know which one. A genuine notice includes the tracking number, and that number matches the one the shop gave you.
• A variable sender. Sometimes an ordinary mobile number, sometimes a name imitating the company. The sender of a text can be faked: it proves nothing.
• Clumsy writing. Odd capital letters, strange wording, exaggerated urgency ("final notice before your parcel is returned"). Real companies write better than this.

How to check a real delivery

The method is always the same and works for any company:

1. Do not tap the link in the text. Close it.
2. Open the official channel yourself: the app of the shop you bought from, the order confirmation email, or the courier's official website, typing the address yourself (for NIPOST, nipost.gov.ng).
3. Enter your tracking number there, or call the courier's official customer line. If there is a genuine issue (customs, an incomplete address, a failed delivery), it will show up through the official channel. If nothing shows up, the text was fake.

This sequence (close the message, go to the official channel yourself) is the same one we recommend for checking a call or SMS from your bank and for checking a message about tax, your NIN or a government grant. It is the habit that stops the most fraud at the root.

What to do if you already entered your card

• Call your bank now, explain what happened and ask them to block the card and issue a new one. That stops the problem at once.
• If you also entered an OTP that arrived by SMS, tell the bank that too: a transaction may already have been authorised.
• Watch your debit alerts over the coming weeks and turn on transaction notifications in your banking app. Fraudulent charges do not always arrive straight away.
• Report it to the police through the Nigeria Police Force's NPF-NCCC e-reporting portal, with screenshots of the text and the link. If you paid "clearance fees" for a parcel from someone you met online, you can also report it to the Economic and Financial Crimes Commission (EFCC), which takes reports of financial fraud.
• Report the sender's number in the spam numbers directory.

Quick questions

What if I am expecting a parcel and the text matches? The coincidence proves nothing: with so many orders around, a lucky match is easy. Always check through the official channel with your tracking number. It takes a minute and removes all doubt.

Do delivery companies send real texts? Yes, some send delivery or failed-delivery notices. A genuine notice mentions your tracking number and does not rush you with threats, and even when a payment is really due, you lose nothing by ignoring the link and paying through the official app, website or office.

Does the same thing happen on WhatsApp or email? Yes, the same bait arrives on WhatsApp, by email and even through QR codes on fake stickers. The channel changes; the defence does not: never pay from a link you receive, and always check through the official channel yourself.

If you have received one of these messages, report it in NoCall's spam numbers directory: these campaigns reuse numbers for days, and your report is the warning the next person sees before entering their card details.