Fake Parcel Delivery SMS: the Tracking Link Trap

"Your package is held at the depot. Confirm your address and pay the R35 release fee within 24 hours." The text names a courier you trust and arrives in the same week you actually ordered something online. It feels routine — which is precisely why fake parcel-delivery SMS is one of South Africa's most effective smishing scripts. Behind the tracking link sits a fake payment page built to harvest your card details, and sometimes a premium-SMS subscription trap as well.

Why this scam works so well

Online shopping has trained us to expect delivery updates by text, and scammers exploit every part of that habit:

• Volume: with millions of parcels moving through PostNet, RAM, Aramex, Courier Guy, Takealot, DHL, and Fastway, a blanket "parcel held" message will always reach people genuinely waiting for deliveries.
• Familiar branding: the message names a real courier and the fake page copies its colours, logo, and tracking layout closely enough to fool a quick glance.
• Small amounts: a "release fee" or "customs charge" of a few dozen rand feels too trivial to be a scam — but the fee is bait. The real prize is your card number, expiry date, CVV, and any OTP you enter next.
• Urgency: "within 24 hours or your parcel is returned" pushes you to act before thinking.

The criminals do not know you ordered anything. They send the same text to thousands of numbers and let coincidence do the targeting.

The current variants

The script mutates constantly, but most delivery smishing falls into a few patterns:

1. The release fee. Pay a small amount to release a held parcel. The payment page captures your card details and may trigger a real small charge to test the card before larger fraud follows.
2. The address confirmation. No fee — just "confirm your delivery address" on a page that also asks for ID number, banking logins, or app credentials. Pure data harvesting.
3. The customs charge. A parcel from "overseas" needs duties paid. Often paired with a fake courier brand or a vague "postal service" identity.
4. The missed delivery. "We attempted delivery twice. Reschedule here." The rescheduling page is the trap, and it works even on people who ordered nothing, because everyone fears missing a delivery.
5. The app download. "Track your parcel in our app" with a link to install software outside the official app stores. That software is malware — never install it.

All five share one feature: everything important happens through a link in an unexpected text. Real delivery problems are solvable without that link.

Red flags in the message itself

• A link with a strange address. Long-press (without tapping) to preview it. Couriers do not send tracking through random domains, URL shorteners, or addresses full of hyphens and odd suffixes.
• Generic greeting and vague parcel. No order number you recognise, no retailer name, no detail only the real sender would know.
• Payment demanded by SMS link. South African couriers resolve genuine fees through their official apps, websites, or at collection — not through surprise text links.
• Threatening urgency. Real couriers send reminders; they do not threaten immediate return-to-sender over a tiny fee.
• Sender oddities. The message comes from a random long number rather than the courier's usual sender ID — though note that sender IDs can be spoofed too, so a familiar-looking sender is not proof of legitimacy either.

The two-minute verification check

Every delivery text can be verified without touching its link:

1. Open the retailer's or courier's official app (or type its web address yourself) and check your tracking there. If a parcel genuinely needs attention, it will say so in the official channel.
2. Match the order. Does the tracking reference correspond to something you actually bought? Scam texts almost never include a real order number.
3. Contact the courier directly through published support channels if anything is unclear — never through contact details in the suspicious text.
4. Delete the text once you have confirmed it is fake, after screenshotting it for a report.

This check takes less time than entering your card details on a fake page, and it works against every variant of the scam.

What to do if you already tapped or paid

• Tapped but entered nothing? Close the page, clear your browser data, and run a security scan if you downloaded anything. You are probably fine — but stay alert for follow-up smishing, since your number is now confirmed active.
• Entered card details? Call your bank's fraud line immediately (number on your card, not from any text), freeze or replace the card, and dispute any charges. Change passwords for any account whose credentials you entered.
• Entered an OTP? Treat it as a compromised account: bank first, then passwords, then a police case for real losses.
• Report it. Send the details to your carrier, lodge a complaint with WASPA through waspa.org.za, and forward courier-impersonation details to the real courier's fraud contact — couriers track impersonation campaigns and issue customer warnings based on reports.

Make delivery texts boring again

The safest posture is simple: treat every delivery text as a notification, never as an instruction. Let texts tell you that something might need attention, then do everything — tracking, paying, rescheduling — inside official apps and websites you opened yourself. Two minutes of verification beats weeks of reversing card fraud, and every report you file helps get the fake pages taken down faster.