It arrives while you're doing something else. Your parcel couldn't be delivered, the address is incomplete, and there's a link to fix it. Maybe you ordered something last week. Maybe a relative said they'd sent you something. It seems like a thirty-second chore.
That's the trick. Most scams feel alarming. This one feels boring. Nobody thinks they are being defrauded while fixing a typo in their address.
This isn't a handful of pranksters
In January 2026, the Press Information Bureau's Fact Check Unit called one such India Post message fake. It said India Post never sends messages asking people to update their address for delivering articles, and told people not to click those links.
The operation behind messages like these can be large. In 2024, security researchers described a campaign falsely telling iPhone users a package was waiting at an India Post warehouse. Fortinet researchers counted more than 470 domain registrations mimicking India Post's official domain between January and July 2024 alone. The messages carried short URLs leading to fraudulent websites, so you couldn't easily see where the link went.
Think about what those 470 domains mean. Someone was registering lookalike addresses at a steady pace for months. If one gets blocked, another is ready. Checking whether a link looks right is a losing game.
How one text becomes a stolen card
Our reading of how these usually unfold, step by step:
The hook. A believable reason you need to act, usually an address problem or a small redelivery fee.
The clock. A short deadline, so you act before you think.
The lookalike. A page styled like the real courier. It asks for your address first, because that feels harmless and gets you into a rhythm of filling in boxes.
The ask. Then comes the small fee, or a card number, or an OTP. By now you've already said yes three times, and a very small payment doesn't feel risky.
The money was never about the small fee. The small fee gets you to hand over your payment details.
What gives it away
- It wants you to fix something through a link. The official warning covers India Post. Our advice is to treat a similar message from any courier the same way.
- It's in a hurry. Real deliveries rarely collapse within hours.
- It wants a small payment, card details, or an OTP to release a parcel.
- The link is shortened or strange. But don't rely on this alone, because a convincing address is cheap to buy.
- You weren't expecting anything. Though being in the middle of a real delivery doesn't make the message genuine. These messages are sent widely, and some land at just the right moment.
The one habit that beats all of it
Don't try to judge the message. Ignore the link and go around it.
Open the courier's app or type its website yourself. Enter the tracking number from your order confirmation. If there's a real problem, it'll be there. If it isn't, you've lost nothing and it took less time than reading this section.
If you already tapped
Tapping alone isn't a disaster, and there's no point panicking. What matters is what you did next.
- Entered card or bank details? Contact your bank now, using the number on your card.
- Lost money? Report it on helpline 1930 or at cybercrime.gov.in and read what to do in the next hour.
- Entered only your address? Close the page and be extra careful about follow-up calls and messages, since they may now know where you live.
Then tell someone. This text works because it feels too dull to mention, and one message in a family group could save someone else the trouble.