Parcel on hold: fake Post Office and courier SMSs, and how to check a real delivery

Parcel on hold: fake Post Office and courier SMSs, and how to check a real delivery

"Post Office: your parcel could not be delivered due to unpaid postage. Pay the R25 fee here." Plus a link. Depending on the wave, the same SMS may use the name of the South African Post Office or of a well-known courier such as The Courier Guy, Aramex, DHL or PostNet, and it keeps coming back. It works because almost everyone shops online and almost everyone has a parcel on the way at some point: the message lands on fertile ground.

The amount is tiny on purpose. The goal was never to collect R25: it is to get you to enter your full card details on a fake website that imitates the courier, and sometimes the OTP (one-time PIN) you receive afterwards too, so that they can make much bigger payments.

Why it works even when you are not expecting a parcel

The scammers do not know whether you are waiting for an order. They do not need to:

• Volume. They send the same SMS to thousands of numbers. With so much online shopping, many of the people who receive it really do have something on the way, or had something recently, so the message fits.
• A tiny amount. R25 does not set off alarms. Nobody "checks" a R25 payment the way they would check a R3 000 one.
• Urgency and no friction. "Pay now and get it tomorrow" pushes you to sort it out on the spot, from your cellphone, without stopping to look at the sender or the domain.
• A changing disguise. When one brand gets known for it (people start warning that "that Post Office SMS is fake"), the campaign switches to another courier. The skeleton is always the same as the fake traffic-fine SMS: well-known name + something pending + urgency + payment link.

How to spot the fake SMS

None of these signs is proof on its own, but together they are a fairly reliable diagnosis:

• It pushes you to pay through a link. Even when a real courier has duties or fees to collect, the request matches a tracking number you already have, and you can pay through the courier's official app or website, opened by you. A fee demanded through a link in an unexpected SMS is the trap.
• The link is not the official domain. Domains with extra hyphens ("postoffice-parcel-fee", "courier-redelivery", "dhl-customs-za") or strange endings. On a small screen, in a hurry, they slip past you; look calmly and they stand out.
• There is no real tracking number. The fake SMS talks about "your parcel" in general terms because it does not know which one it is. A genuine notice includes the tracking number, and it matches the one the shop gave you.
• A sender that changes. Sometimes an ordinary cellphone number, sometimes a name that imitates the company. An SMS sender can be faked: it proves nothing.
• Sloppy writing. Clumsy translations, odd capital letters, exaggerated urgency ("final notice before your parcel is returned"). Real companies write better than this.

How to check a real delivery

The method is always the same, and it works for any company:

1. Do not tap the link in the SMS. Close it.
2. Open the official channel yourself: the app of the shop where you bought, the order confirmation email, or the courier's official website, typing the address yourself (for the Post Office, postoffice.co.za).
3. Enter your tracking number there. If there is a real issue (customs, an incomplete address, a missed delivery), it will show up in the official tracking. If nothing shows up, the SMS was fake.

This sequence (close the message, go to the official channel yourself) is the same one we recommend for checking a call or SMS from your bank, or a message from SARS or SASSA, in our step-by-step guides. It is the habit that stops the most fraud at the root.

What to do if you already entered your card

• Call your bank's fraud line now (the number on the back of your card), explain what happened and ask them to block the card and issue a new one. That stops the problem in its tracks.
• If you also entered an OTP you received by SMS, tell the bank that too: a payment may already have been approved.
• Watch your account over the coming weeks and switch on transaction notifications in your banking app. Fraudulent payments do not always come through straight away.
• Open a case at your nearest police station (SAPS) with screenshots of the SMS and the link, and ask for the case number: your bank may ask for it.
• Report the sender's number in the spam numbers directory.

Quick questions

What if I am expecting a parcel and the SMS matches? The coincidence proves nothing: with so many orders on the way, getting it right by chance is easy. Always check through the official channel with your tracking number. It takes a minute and removes all doubt.

Do couriers send real SMSs? Yes, some send delivery notices or missed-delivery alerts. The difference is that you never need the link in the message: a genuine notice quotes your tracking number and does not rush you with threats of immediate return, and anything real can be checked or paid in the courier's official app or website, which you open yourself.

Does the same thing happen on WhatsApp or by email? Yes, the same bait goes around on WhatsApp, by email and even through QR codes on fake stickers. The channel changes; the defence does not: never pay from a link you receive, always check through the official channel yourself.

If you have received one of these messages, report it in the NoCall spam numbers directory: these campaigns reuse numbers for days, and your report is the warning the next person will see before entering their card details.