"Parcel on hold": the fake SingPost SMS and other courier scams

"Parcel on hold": the fake SingPost SMS and other courier scams

"SingPost: your parcel could not be delivered due to an incomplete address. Pay the redelivery fee (S$1.68) here." Plus a link. This kind of SMS can use the name of SingPost or of any courier you might be expecting, such as Ninja Van, J&T Express, Qxpress or DHL, and it is a classic smishing lure. It works because almost everyone shops online and almost everyone has a parcel on the way at some point: the message lands on fertile ground.

The amount is deliberately tiny. The goal was never to collect those two dollars: it is to get you to enter your full card details on a fake website that imitates the delivery company, and sometimes also the one-time password (OTP) you receive next, so that they can make much larger charges.

Why it works even when you are not expecting a parcel

The scammers do not know whether you are expecting an order. They do not need to:

• Volume. They send the same SMS to thousands of numbers. With so much shopping done online, a large share of recipients really do have something on the way, or had one recently, so the message fits.
• A negligible amount. One or two dollars does not set off any alarms. Nobody checks a payment of S$1.68 the way they would check one of S$300.
• Urgency and zero friction. "Pay now and get it tomorrow" pushes you to sort it out on the spot, on your phone, without stopping to look at the sender or the domain.
• A rotating disguise. When one brand burns out (people start warning that "the SingPost SMS is fake"), the campaign switches to another courier. The skeleton is always the same as the fake traffic-fine or ERP charge SMS: a well-known name + a pending matter + urgency + a payment link.

How to spot the fake SMS

None of these signs alone is conclusive, but together they make a fairly reliable diagnosis:

• It asks you to pay a fee through a link. Delivery companies do not collect customs or postage payments through a link in an unexpected SMS. Real duties and charges are communicated through traceable channels, with the shipment's documentation.
• The link is not the official domain. Domains with extra hyphens ("singpost-redelivery", "ninjavan-fee", "sg-parcel-track") or odd extensions. On a phone screen, in a hurry, they slip through; look calmly and they stand out.
• There is no real tracking number. The fake SMS talks about "your parcel" in general terms because it does not know which one it is. A genuine notice includes the tracking number, and that number matches the one the shop gave you.
• The sender varies. Sometimes it is just any mobile number, sometimes a name imitating the company. A sender name on its own proves nothing.
• Stylistic slips. Clumsy translations, odd capital letters, exaggerated urgency ("final notice before your parcel is returned"). Real companies write better than this.

How to check a real delivery

The method is always the same, and it works for any company:

1. Do not tap the link in the SMS. Close it.
2. Open the official channel yourself: the app of the shop where you bought the item, the order confirmation email, or the courier's official website, typing the address yourself (for SingPost, singpost.com).
3. Enter your tracking number there. If there is a real issue (customs, an incomplete address, a failed delivery), it will show up in the official tracking. If nothing shows up, the SMS was fake.

This sequence (close the message, go to the official channel yourself) is the same one we recommend for checking a call or SMS from your bank and for checking a message from IRAS or the CPF Board; you will find both among our guides. It is the habit that stops the most fraud at the root.

What to do if you have already entered your card details

• Call your bank now, explain what happened and ask them to block the card and issue a new one: that stops the problem in its tracks. If you think your bank account itself is at risk, use your bank's emergency "kill switch" to freeze it.
• If you also entered a one-time password (OTP) that you received by SMS, tell the bank that too: a transaction may already have been authorised.
• Watch your statements over the coming weeks and turn on transaction alerts in your bank's app. Fraudulent charges do not always appear straight away.
• Make a police report online through SPF e-services, with screenshots of the SMS and the link. ScamShield's I've been scammed page lists the steps, and the ScamShield Helpline (1799) can help if you are unsure.
• Report the sender's number in the spam numbers directory.

Quick questions

What if I am expecting a parcel and the SMS matches? The coincidence proves nothing: with so many orders in circulation, hitting the mark by chance is easy. Always check through the official channel with your tracking number. It takes a minute and removes all doubt.

Do delivery companies send real SMS? Yes, some send delivery notices or failed-delivery alerts. The difference is that a genuine notice does not ask you to pay through a link: it points you to the official app or website, mentions your tracking number and does not rush you with threats of an immediate return.

Does the same thing happen on WhatsApp or by email? Yes, the same bait circulates on WhatsApp, by email and even through QR codes on fake stickers (quishing, which we also cover in our guides). The channel changes; the defence does not: never pay through a link you receive, and always check through the official channel yourself.

If you have received one of these messages, report it in the NoCall spam numbers directory: these campaigns reuse numbers for days, and your report is the warning the next person will see before entering their card details.