Parcel-delivery scam SMS: what to do
Fake courier messages use a delivery problem or small redelivery fee to lead victims to credential-stealing pages. Do not use the embedded link; check the parcel in the courier’s official app or site and call 997 quickly if money was sent.
Scam alert
Reported 23 May 2026
Who is affected: Anyone receiving an unsolicited SMS or chat message claiming that a parcel is delayed, an address is incomplete or a small delivery payment is required through a link.
Affected: Messages and cloned web pages impersonating Malaysian or international courier companies, e-commerce platforms and banks.
What to do
Do not tap the message link or install an app. Verify the shipment through the courier’s independently located official app or website.
If money, credentials or an OTP were provided, call the bank and NSRC 997 immediately. Preserve evidence and use a clean device to secure affected accounts.
How the message works
The text creates urgency around an undelivered parcel, incomplete address or small fee. The link opens a page that imitates a courier or bank and asks for card details, banking credentials, an OTP or an app download.
Check safely
Do not reply or tap the link. Open the courier’s known official app or type its official domain yourself, then enter a tracking number you already received from the seller. A parcel you do not recognise is not a reason to provide identity or payment details.
If you only opened the page
Close it and do not download anything. If no information was entered and nothing was installed, risk is lower, but update the device and browser and watch for follow-up messages. Delete any downloaded file without opening it.
If you entered details, installed an app or paid
- Call the bank using the number on its official site or your card; freeze affected cards or access.
- Call NSRC 997 immediately. PDRM states the line operates 24/7.
- If an unknown app was installed, disconnect the device from networks and obtain trusted technical help before using banking apps again.
- Change exposed passwords from a clean device, starting with email and financial accounts; revoke unknown sessions.
- Preserve screenshots, the sender, URL, account number, transaction and app file details for the police and bank.
Related guides
How to request a refund in Malaysia
When goods fail statutory guarantees, document the problem, notify the supplier promptly and request the remedy supported by the Consumer Protection Act 1999. A change of mind is different from defective or misdescribed goods.
What to do when an online seller refuses a valid return
Preserve the listing and unboxing evidence, use the platform dispute before its deadline, make a precise written demand, then consider KPDN or TTPM. A seller’s internal policy does not decide every statutory issue.
How to file a claim with TTPM
TTPM hears eligible consumer claims up to RM50,000 that accrued within three years. Filing Form 1 costs RM5; prepare a focused chronology, serve the respondent correctly and attend with organised evidence.
Common warning signs of a scam website
A polished site, padlock and familiar logo do not prove legitimacy. Verify the legal entity, domain, contact route, payment beneficiary and regulator records independently before entering card details or transferring money.