‘Your Parcel Is on Hold’ Could Be a Trap: Cybercriminals Target Bank Accounts Through Fake Delivery Alerts

Fraudsters impersonate India Post and courier companies, using tiny ‘address update’ payments to harvest card, net-banking and UPI credentials

Jaipur | SDNA

A message saying “Your parcel is on hold due to an incorrect address” may look like an ordinary delivery notification. But for unsuspecting users, it could be the opening move of a carefully designed cyber-fraud.

The Rajasthan Police Cyber Crime Branch, R4C, has warned the public about scams in which criminals impersonate India Post, Speed Post and other courier services. Through fake SMS messages, WhatsApp alerts, emails and phone calls, fraudsters create a sense of urgency and push victims towards phishing links, fraudulent websites or suspicious mobile applications.

The apparent problem may be a parcel. The actual target, however, could be the victim’s bank account and digital credentials.

The Scam Often Begins With Just ₹10 or ₹50

The fraud typically starts with a simple story.

A potential victim is told that a parcel cannot be delivered because the address is incomplete or incorrect. The recipient is then asked to update the address or pay a small fee to restart delivery.

The amount may be as little as ₹10, ₹25 or ₹50.

That seemingly insignificant payment is often used to move the victim into the next stage of the scam.

During the fake payment or address-verification process, criminals may attempt to obtain card details, CVV, net-banking credentials, OTPs or UPI PINs. Once sensitive information falls into the wrong hands, the financial consequences can be far greater than the small amount initially requested.

Fake Websites Designed to Look Genuine

One reason these scams can be convincing is the appearance of authenticity.

Fraudsters may create websites that resemble the official pages of postal or courier companies. Victims are instructed to enter delivery information, update their address or complete a small payment.

In some cases, criminals may also attempt to persuade users to download an APK file or another suspicious application.

The presence of a familiar company name, logo or delivery-related branding should therefore never be treated as proof that a message is genuine.

One Suspicious App Can Create a Bigger Security Problem

The danger does not always end with a phishing page.

A malicious or untrusted application installed on a mobile phone can expose users to additional security risks. Rajasthan Police has specifically advised people not to install remote-access or screen-sharing applications such as AnyDesk or TeamViewer at the direction of unknown callers or suspicious contacts.

Users should be particularly cautious when someone claiming to be a courier representative asks them to install an application to “complete verification” or “resolve delivery problems.”

Want to Track a Parcel? Open the Official Website Yourself

The safest approach is simple: do not use the link received in an unexpected message.

Instead, open the official website or application of the postal or courier service yourself and check the shipment status there.

For India Post-related services, users should independently access the official India Post website rather than relying on a link embedded in an unsolicited SMS or WhatsApp message.

The complete website address should also be examined carefully. A familiar-looking name or logo does not automatically make a website legitimate.

Why the Small Payment Is Part of the Trap

A demand for only ₹10 or ₹20 can actually make a fraudulent message appear more believable.

People may think that such a small amount does not justify further verification. That lowered suspicion can give fraudsters an opportunity to collect much more valuable information.

The real danger is therefore not the ₹10 payment. It is what criminals may attempt to obtain during the transaction.

Never Hand Over the Keys to Your Digital Banking

No legitimate delivery problem should require a stranger or an unverified website to obtain your confidential banking credentials.

Users should never disclose their:

• OTP
• UPI PIN
• ATM PIN
• CVV
• Debit or credit card details
• Net-banking password

A bank-related OTP or UPI PIN should be treated as highly confidential information. Once such credentials are disclosed, fraudulent transactions can happen quickly.

Check Your Call-Forwarding Settings Too

Rajasthan Police has also advised users to periodically check the call-forwarding status on their mobile phones.

If unusual changes appear after interacting with a suspicious message or caller, they should not be ignored. Unknown numbers and suspicious messages can also be blocked and reported as part of basic digital hygiene.

If Money Is Stolen, Report It Immediately

Victims should not wait before reporting a cyber-fraud.

Rajasthan Police has advised citizens to seek immediate assistance through:

Cyber Crime Helpline: 1930
Cyber Helpdesk: 9256001930 / 9257510100
National Cyber Crime Reporting Portal: cybercrime.gov.in

A complaint can also be made at the nearest police station.

Speed matters in financial cybercrime because early reporting can help authorities initiate the appropriate response.

The Bigger Story: Cybercrime Is Exploiting Trust, Not Just Technology

The most significant feature of this scam is the psychology behind it.

Fraudsters do not necessarily begin by talking about banking, investments or large sums of money. Instead, they introduce a familiar everyday problem: a parcel, a delivery delay or an address correction.

That makes the message feel routine.

The small payment then lowers suspicion, while urgency—“update your address now or the parcel will be returned”—discourages careful verification.

By the time the victim realizes that the delivery message was fake, the actual objective may already have been achieved: access to sensitive financial information.

The New Digital Safety Rule: Verify Before You Click

In an increasingly digital society, every message appearing on a mobile phone cannot be assumed to be genuine simply because it carries the name of a trusted institution.

The safest habit is straightforward:

Do not access important services through unexpected links. Open the official website or app yourself and verify the information independently.

If a parcel genuinely exists, its status should also be available through the legitimate delivery channel.

A few seconds of verification can prevent a much larger financial and personal-security crisis.

In the digital age, the first line of defence is not the technology in your phone—it is the decision to pause before you click.

(SDNA)