An SMS from India Post says that a parcel is awaiting delivery to your address, but your location needs updating. It urges you to click on the link and do the same, or the package will be returned. While it may seem legitimate, this is a common scam that regularly resurfaces and catches many off guard. With online transactions becoming the norm, cybercriminals exploit your expectations around scheduled deliveries to steal your sensitive information.
Let’s look at how the scam unfolds and what you can do to shield yourself from being duped.
Modus Operandi
Update Delivery Location: You receive an SMS from an unknown number stating that your delivery location needs to be updated within 12 hours, or the package will be returned to the warehouse or facility.
Fake website: To seem genuine, a link that mentions ‘India Post’ in its URL is also attached to the message, directing you to a bogus website that mimics the postal service's official website.
Malware Download: Once you tap on the link, a malicious keylogger installs on your device to record everything you type, including your card details, PINs, passwords, and more.
Add Personal Info: After entering your address on the fake website, you are prompted to pay a small redelivery fee. The payment can only be made with a credit or debit card. Once you input your card details, the keylogger records them. The scammers can access this information and make unauthorised transactions.
Red Flags
An unexpected text from a delivery service when you’re not expecting any parcel.
Creating a false sense of urgency and demanding immediate action while threatening consequences if their demands are not met.
What To Do
Delete: India Post does not send SMS messages to update your address for delivering parcels or documents. Do not tap on the link and report it to the national cybercrime helpline number—1930.
Check URL: Official Indian government website URLs end with ‘gov.in’ or ‘nic.in’.
Alert Bank: If you’ve made a payment, immediately contact your bank to block your card and report any unauthorised transactions.
Report: If you were scammed or were able to spot this scam, then report the incident as soon as possible through a government portal such as Chakshu (https://sancharsaathi.gov.in/sfc/). You can also lodge a complaint with the local police station.
The Quint's Scamguard initiative aims to keep up with emerging digital scams to help you stay informed and vigilant. If you've been scammed or successfully thwarted one, then tell us your story. Contact us via WhatsApp at +919999008335 or email us at myreport@thequint.com. You can also fill out the Google form and help us take your story forward.)
(At The Quint, we question everything. Play an active role in shaping our journalism by becoming a member today.)