How this scam typically works
You receive an SMS, WhatsApp message, or email claiming a courier — a real delivery brand or a generic "logistics" name — tried to deliver a parcel and failed: customs is holding it, an address is missing, or a small duty is unpaid. A link is provided to "reschedule the delivery" or "pay the outstanding fee." The link leads to a fake page designed to look like the courier's site, which then asks for your card number, online banking login, or OTP — details a genuine delivery-fee page would never need in that form.
A variant skips the phishing page and instead asks you to download and install an app — usually an Android APK file — to "track" or "release" the parcel. That app is malware, not a tracking tool. This follows the same playbook as other fake-app scams; see APK sideload / fake app malware for how that part works and what it does once installed.
Some victims are set up first with a "brushing scam": an unsolicited real parcel — often something cheap and unordered — genuinely arrives in your name. This is used as social proof to make a follow-up fee request feel more credible, since you did receive something. The parcel itself is usually harmless; the fee request or app-install request that follows is not.
Warning signs
- An unexpected delivery notice, especially with urgency ("pay within 24 hours or the parcel will be returned")
- A request to pay any fee through a link in an SMS or WhatsApp message
- A request to install an app to "track" or "release" a parcel
- A real, unordered parcel arrives, followed by a message asking for payment or personal details
If you're being targeted right now
Don't click the link and don't install anything. Delete the message, or verify independently by going directly to the courier's own official app or website — typed in yourself, not tapped from the message — and checking your tracking number there. Don't enter your card details or OTP on any page you reached through a delivery-notice link.
If you've already lost money
See Scammed in Malaysia? The first 24 hours for the exact steps to take next — who to call, in what order, and what to preserve as evidence.
FAQ
Why did I get a delivery notice for a parcel I never ordered?
Two different things can cause this. It may be a phishing message unrelated to any real parcel, sent out broadly hoping some recipients happen to be expecting a delivery — or it follows a "brushing scam," where an unsolicited real parcel is sent to you first to make a later fee or feedback request look credible. Either way, treat the payment link or app-install request as the actual scam, regardless of whether a parcel shows up.
Is it ever normal to pay a customs fee to receive a parcel?
Genuine customs duties are handled through the courier's own official channels or Malaysian Customs directly, not a link inside an unsolicited SMS. If in doubt, look up your tracking number directly on the courier's real app or website rather than clicking through the message.
The link asked me to install an app to track my parcel — is that safe?
No legitimate courier requires you to install a separate app, especially an APK file sent outside an official app store, just to track a parcel. See APK sideload / fake app malware for what these apps actually do and what to check if you've already installed one.