The Singapore Shopper’s Guide to Fake Parcel and Delivery Messages, What SingPost and Couriers Really Send, and How to Check a Delivery Before You Tap
Description: How fake parcel and delivery messages work in Singapore: the “failed delivery” SMS, email or WhatsApp, the small fee, the phishing page that captures card details and OTPs, what SingPost says it does and does not send, the “Likely-SCAM” sender label, ScamShield checks and what to do if you already clicked.
Primary Keyword: fake parcel delivery message
Secondary Keywords: parcel delivery scam Singapore, SingPost scam SMS, failed delivery SMS, fake tracking link, Likely-SCAM SMS, SMS Sender ID Registry, ScamShield 1799, delivery phishing scam, OTP scam, WhatsApp SingPost scam
Website: wahliao.com
Article Type: Series Guide
Parent Article: How Shopping Works | Shopping Scams in Singapore
Last checked: 18 October 2026
Quick Answer
A fake parcel delivery message is a text, email or WhatsApp message dressed up as a courier, most often SingPost, telling you a delivery has failed.
It asks you to tap a link to “confirm your address”, “arrange redelivery” or pay a small fee.
The link leads to a fake page that collects your card details and, often, your one-time password (OTP).
The fee is never the point.
Your card is.
SingPost says it does not take payments through online links, and does not ask for personal or banking details by SMS.
The smart shopper does not only ask:
“Am I expecting a parcel?”
The smart shopper asks:
“If I check this parcel from my own side, through the app or site I already use, does the problem still exist?”
1. A Parcel Message Is the Perfect Disguise
Most scams have to make you want something.
A fake parcel delivery message does not.
It borrows a want you already have.
So a message saying “your parcel could not be delivered” does not feel strange.
It feels like admin.
That is the design.
The message is short, slightly urgent and boring in a believable way.
The police have warned that these scams tend to rise around big shopping events, such as Singles’ Day, Black Friday, Cyber Monday, 12.12 and the year-end festive season.
More parcels in the air means more people who will believe the message.
Expecting a parcel is not a reason to trust a message. It is the reason the message was sent.
2. How the Scam Works, Step by Step
The route is almost always the same.
The Singapore Police Force (SPF) set it out in a November 2024 advisory on parcel delivery phishing scams.
You receive a message saying a delivery has failed.
It asks you to tap a link to confirm your address or details.
The link opens a website that looks like a courier’s page.
The page asks for your card details, sometimes to pay a small “redelivery” or “release” fee.
The scammers use those details for purchases you did not make.
You find out later, when strange charges appear on your card or bank statement.
An earlier SPF advisory, from December 2023, described a version where the message asks for an extra payment to release a parcel, made to look like it comes from a postal or delivery company.
Notice what is missing from that route.
No parcel ever changes hands.
The whole scam happens between your thumb, a link and a form.
3. What the Scam Is Really After: Card Details and OTPs
The small fee is bait.
The fake page needs a reason to ask for your card, and a fee gives it one.
Once you type in your card number, expiry date and security code, the scammer has what they need to try other transactions.
Then comes the OTP.
Your bank sends an OTP to confirm a transaction.
The fake page shows a box asking you to type it in, as if it were part of paying the small fee.
But the OTP may be for a much larger purchase somewhere else.
SPF’s March 2026 advisory on WhatsApp messages impersonating SingPost said victims typically found unauthorised foreign-currency transactions in their accounts.
That detail matters.
A local redelivery fee would be in Singapore dollars.
If the OTP message from your bank names a different currency, a different merchant or a bigger amount than the page showed you, the page lied.
ScamShield’s guidance on phishing scams is direct: never share personal information, account details or OTPs.
An OTP is a signature. Read what you are signing before you give it away.
4. Same Script, Different Channels: SMS, Email and WhatsApp
The fake parcel delivery message used to be mostly an SMS problem.
SPF’s November 2024 advisory said at least 631 parcel delivery phishing cases had been reported since the start of that year, with losses of at least S$1.1 million. At least 505 of those cases involved scammers pretending to be SingPost.
Email is the second channel.
The December 2023 advisory covered both texts and emails, and named SingPost alongside other postal and e-commerce logistics companies.
WhatsApp is the newer one.
In March 2026, SPF warned of WhatsApp messages claiming a SingPost parcel could not be delivered because of incomplete information, with a link to arrange redelivery. At least 10 cases with losses of at least S$22,000 had been reported since 15 March 2026, according to the advisory.
The channel changes.
The script does not.
Examples:
an sms saying your parcel is “on hold” because the address is incomplete
an email with a courier logo asking you to pay a small fee to release a parcel
a whatsapp message from an unknown number with a “redelivery” link
a message saying the parcel will be “returned to sender” unless you act within 24 hours
a “customs” notice asking you to settle charges through a link
Whatever the channel, a link that asks you to pay or log in is the moment to stop.
5. What SingPost Says It Does and Does Not Do
The easiest way to spot a fake is to know what the real thing looks like.
SingPost publishes its own scam advisory on its website, on a page called Online Security & You.
As of October 2026, that page says SingPost will not:
ask for personal or banking information, such as your full name, ID number, home address or card details, by SMS
accept payments through an online link
send SMS about things unrelated to delivery, such as lucky draws, loans or job offers
send emails asking you to fill in online applications
It also says payments are accepted only through the SingPost Mobile App, SAM machines or a post office.
And it explains what happens when a delivery genuinely fails.
You receive a physical Non-Delivery Advice, and you collect the item from a post office or POPStation.
Since 28 February 2022, SingPost says it has used app push notifications instead of SMS for service updates.
It still sends SMS for a few things: OTPs for verification or app sign-up, POPStation PINs and related updates, post office queue tickets, and customer service follow-ups.
SPF’s March 2026 advisory put the key point plainly: SingPost will not send clickable links by WhatsApp or SMS asking for payments or bank details.
That gives you a clean test.
A “SingPost” message with a payment link is not SingPost.
Other couriers and platforms have their own rules, which can differ. For them, the same principle holds: find their official help or security page yourself, and check what they say they send.
6. The Sender Name: Registered IDs and the “Likely-SCAM” Label
An SMS can arrive from a name instead of a number.
That name is called a Sender ID.
Singapore runs a system to stop scammers borrowing those names.
The Singapore SMS Sender ID Registry (SSIR) is operated by the Singapore Network Information Centre (SGNIC), a subsidiary of the Infocomm Media Development Authority (IMDA). It was set up in March 2022.
Since 31 January 2023, organisations sending SMS to Singapore phones with a named Sender ID must register it.
According to IMDA and SGNIC, SMS from Sender IDs that are not registered are labelled “Likely-SCAM”.
IMDA compares the label to a spam filter.
So if a “courier” SMS arrives tagged “Likely-SCAM”, the system is telling you the name was not registered by anyone.
Treat it as a scam.
But the reverse is not quite true.
SPF’s November 2024 advisory said SingPost’s genuine SMS Sender ID is “SingPost”. SingPost’s own page warns that fakes may use look-alike sender names.
And ScamShield cautions that sender details can be spoofed, so even a familiar sender name deserves care.
A message from a random overseas number, or a WhatsApp chat, skips the Sender ID system entirely.
Ask:
Is the message labelled “Likely-SCAM”?
Is the sender name exactly the official one, or a near miss?
Did it come from a phone number or chat app instead of a named sender?
Even if the name looks right, is the message asking me to pay through a link?
“Likely-SCAM” means stop. A familiar name means keep checking, not relax.
7. Why the Small Fee Works So Well
The fake parcel message is careful to ask for very little, so that paying feels quicker than checking.
It also borrows a real idea.
Genuine charges on parcels do exist.
SingPost’s app page, for example, says customs duties and GST can be paid through the SingPost Mobile App.
So a scam that mentions “customs” or “duties” sounds plausible to someone who has bought from overseas.
The difference is the route.
A genuine charge can be found and paid through the official app, machine or counter.
A scam charge can only be paid through the link in the message.
Ask:
Did I order something from overseas that could actually carry a charge?
If there is a charge, can I see it after opening the official app myself?
Why does this fee need to be paid through this particular link, today?
A real fee waits for you in the official app. A fake fee only lives inside the link.
8. Read the Link, Not the Logo
A courier logo is easy to copy. The web address is harder to fake, and SingPost’s advisory tells you what to look for.
It lists red flags such as links that do not end in its official singpost.com address, and look-alike characters, like a zero in place of the letter O.
As of October 2026, the page lists the domains SingPost says it operates: singpost.com, vpost.com, sglocate.com, ezyparcels.com, speedpost.com.sg, mysam.sg and ezy2ship.net. It notes the list may change.
SingPost also suggests copying a web address into your browser yourself, rather than tapping a link.
Common tricks look like this:
the courier name with an extra word, such as “-redelivery” or “-track”
the courier name followed by an unfamiliar ending
the courier name at the start of a long address that really belongs to someone else
a shortened link that hides the destination
a letter swapped for a number that looks almost the same
ScamShield lists spoofed web addresses that imitate real brands as a sign of phishing.
The padlock in your browser does not settle the question.
It means the connection is encrypted, not that the site belongs to the courier.
Our sibling guide on checking a shopping website before you pay goes through address-bar checks in more detail.
If you would not type that address yourself, do not let a message type it for you.
9. Track From Your Side of the Door
Never check a parcel through the message that told you about it.
Check it through a route you already trust.
ScamShield’s phishing guidance gives the same advice for parcel messages: confirm the details directly with the company or the e-commerce platform, not through the link.
Your own routes might be:
the order page in the shopping app or website where you actually bought the item
the SingPost Mobile App, which SingPost says shows delivery status
the tracking page on singpost.com, typed in yourself
the official app or website of whichever courier the shop told you it used
the shop’s own order confirmation email, opened from your inbox, not from a link in a text
Most online shopping journeys already give you a tracking route at checkout.
Our guide to delivery and returns in Singapore explains how that hand-off from shop to courier usually works.
If the order page says “out for delivery” or “delivered”, and the message says “failed”, believe the order page.
If you have nothing on order at all, the question answers itself.
The message is a rumour. Your order page is the record.
10. ScamShield, 1799 and Gov.sg Messages
ScamShield is the Government’s scam-prevention toolkit.
It includes an app, a website at scamshield.gov.sg and a 24/7 helpline on 1799.
SPF’s March 2026 advisory recommends installing the ScamShield app to filter scam calls and SMS, and using it or the website to check suspicious messages, numbers and links.
If you are unsure about a parcel message, you can call 1799 before you act.
SPF’s advice follows three words: Add, Check, Tell.
Add the ScamShield app and security features such as card transaction limits and two-factor authentication.
Check suspicious messages and links through official sources.
Tell the authorities, your family and friends, and report fraudulent transactions to your bank immediately.
There is a related Government measure worth knowing.
Since 1 July 2024, government agencies have sent SMS under a single gov.sg Sender ID, with limited exceptions for National Service matters and emergency services.
Gov.sg says it has worked with telcos and SMS aggregators to block messages using fake Sender IDs that resemble gov.sg.
That matters for parcels because some fakes dress up as “customs” or another agency.
A message claiming to be from a government agency that does not arrive from gov.sg deserves extra suspicion.
Official Government websites end in .gov.sg.
A check costs a minute. A stolen card costs a weekend of phone calls.
11. The Singapore Layer
SPF’s Annual Scam and Cybercrime Brief 2025 counted 6,264 phishing scam cases in 2025, with about S$39.9 million lost. That was down from 8,552 cases in 2024, but still the second-highest case count of any scam type.
Total scam losses across all types in 2025 were about S$913.1 million.
The brief does not give a separate figure for parcel messages, so the delivery-specific numbers in this guide come from SPF’s individual advisories.
The local tools:
The SMS Sender ID Registry and the “Likely-SCAM” label, run by SGNIC under IMDA.
The gov.sg Sender ID for Government SMS.
The ScamShield app, website and 1799 helpline.
SingPost’s Online Security & You page, its tracking page and its app.
Your bank’s card alerts, transaction limits and two-factor authentication.
The police’s online reporting service.
MAS notes that IMDA’s SMS Sender ID Registry and anti-scam filter have blocked over 20 million SMS since 2023.
They do not catch everything, especially WhatsApp messages and email, which sit outside the SMS registry.
A parcel message arriving while you are queuing for chicken rice deserves the same check as one at your desk.
Shoppers who buy from overseas stores, through forwarders or with customs charges in the picture, see more delivery messages than most. Our guide to buying from overseas stores explains which charges are real and where they normally appear.
This guide is general information, not financial or legal advice.
12. Strong Signs and Weak Signs in a Delivery Message
Strong signs:
you can see the same delivery status in the shop’s own order page
the message matches a tracking number you were given at checkout
no payment or card details are requested through a link
any genuine charge also appears when you open the official app yourself
for SingPost, a failed delivery comes with a physical Non-Delivery Advice
the message asks you to do nothing urgent
Weak signs:
the SMS is labelled “Likely-SCAM”
the sender name is a near miss of the courier’s name
it arrives on WhatsApp or from an unknown number
there is a link to pay a small fee or “confirm” your address
the web address does not end in the courier’s official domain
a countdown, such as “returned to sender within 24 hours”
the page asks for card details, bank log-in details or an OTP
you are not expecting anything at all
Logos, tracking numbers and polite wording are cheap to fake. A matching record in your own order page is not.
13. Practical Method: The Two-Minute Parcel Message Check
Use this every time a delivery message asks you to do something.
1. Do not tap anything yet
Leave the link alone.
Do not reply, and do not call any number in the message.
2. Look at the sender
Is it labelled “Likely-SCAM”? Is it an unknown number or a WhatsApp chat?
Is the name exactly right, or almost right?
3. Look at what it wants
A request to pay, log in or enter card details through a link is the red line.
For SingPost, that alone tells you it is not genuine.
4. Check from your own side
Open the shopping app or website where you placed the order, or the courier’s official app, by yourself.
Compare the status there with the message.
5. Run it past ScamShield
Check the message or link with the ScamShield app or website.
If you are still unsure, call 1799.
6. Pay only through official routes
If a genuine charge exists, pay it through the official app, machine or counter, never through a link in a message.
7. Delete, report and tell someone
Report the scam message through the ScamShield app, then delete it.
Mention it in the family chat. The relative who shops the most is often the one most likely to tap.
14. If You Already Clicked or Paid: The First Hour
Maybe the page took your card details, asked for an OTP, then showed an error.
That is your cue to move quickly, not to wait and see.
1. Call your bank immediately
ScamShield’s advice is to contact your bank straight away if your account or card is involved.
Tell them you entered your card details, and say whether you also gave an OTP or bank log-in.
2. Make a police report
You can report a scam online through the SPF e-service for lodging police reports, or in person at a Neighbourhood Police Centre or Post.
Call 999 only for urgent police help.
Keep screenshots of the message, the sender, the web address and any transactions.
3. Report through ScamShield
ScamShield recommends reporting scams through the ScamShield app.
4. Secure the rest
If you typed in a password, change it, starting with banking and email.
SingPost’s app page gives similar advice for anyone who has been phished: report to the police, change passwords and alert your bank.
5. Watch your statements
Check card and bank transactions closely for the next few weeks, including small or foreign-currency charges.
Call the bank first and feel embarrassed later. Speed matters more than pride.
15. After the First Hour: Banks, Frameworks and Honest Expectations
Once the urgent steps are done, it helps to know which rules may apply.
A fake parcel delivery message is a phishing scam.
Since 16 December 2024, the Shared Responsibility Framework from MAS and IMDA has set duties for banks and telcos to reduce phishing scams, with expectations of payouts to victims where those duties are breached.
Whether your case falls within it depends on the facts, such as what you approved and what the bank and telco did.
Ask your bank directly, and read the framework on the MAS website.
MAS also notes that banks have their own goodwill arrangements for scam victims, separate from the framework.
Fast reporting gives the bank and police the best chance to act, whatever the route.
Be wary of anyone who contacts you afterwards offering to “recover” your money for a fee.
That is often the next scam.
Final Summary
A fake parcel delivery message borrows something you already expect: a parcel on the way.
It arrives by SMS, email or WhatsApp, claims a delivery failed, and sends you to a link.
The small fee is bait. The real target is your card details and your OTP.
SingPost says it does not take payments through online links or ask for banking details by SMS, and that failed deliveries come with a physical Non-Delivery Advice.
Singapore’s systems help: unregistered SMS Sender IDs are labelled “Likely-SCAM”, Government SMS comes from gov.sg, and ScamShield and 1799 are there to check before you act.
But the strongest check is the one you control.
So the smartest question is not:
“Is my parcel stuck?”
It is:
“Can I see this problem when I open my order myself, without touching the link?”
Simple Checklist
Before you act on any parcel or delivery message, ask:
- Am I actually expecting a parcel, and from where?
- Is the SMS labelled “Likely-SCAM”, or from an unknown number or WhatsApp chat?
- Is the sender name exactly right, not a near miss?
- Is it asking me to pay, log in or enter card details through a link?
- Does the web address end in the courier’s official domain?
- Have I checked the order in the shop’s app or the courier’s official app myself?
- If there is a real charge, can I pay it through the official app, machine or counter instead?
- Have I checked the message with ScamShield or called 1799?
- Will I read any OTP message carefully, including the amount, merchant and currency?
- Do I know to call my bank immediately if I already entered my details?
If the answer is unclear, pause.
Leave the link, open your order yourself, and look again.
Where the Facts Come From
Singapore Police Force – Police Advisory on Increase of Parcel Delivery Phishing Scams (22 November 2024)
Singapore Police Force – Police Advisory on Parcel Delivery Phishing Scams (15 December 2023)
Singapore Police Force – Advisory on Phishing Scams Involving WhatsApp Messages Impersonating SingPost (27 March 2026)
Singapore Police Force – Annual Scam and Cybercrime Brief 2025
SingPost – Online Security & You
SingPost – Mobile App
SGNIC – Singapore SMS Sender ID Registry
IMDA – Anti-Scam Measures
Gov.sg – What You Need to Know: gov.sg SMS Sender ID
ScamShield – Phishing Scams
ScamShield – I’ve Been Scammed
Singapore Police Force – Lodge a Police Report (e-service)
MAS – MAS and IMDA Announce Implementation of Shared Responsibility Framework
Prices, rules and platform features change. We last checked this page on 18 October 2026. General information, not financial, legal or medical advice.
Continue Reading
How Shopping Works | Shopping Scams in Singapore
How Shopping Works | The Big Picture
Fake Online Shops: How to Check a Shopping Website Before You Pay
How Shopping Works | Delivery and Returns in Singapore
How Shopping Works | Online Shopping in Singapore, From Search Bar to Doorstep
Buying From Overseas Stores: Shipping Forwarders, Overseas Addresses and Customs
fake parcel delivery message, parcel delivery scam Singapore, fake delivery SMS, failed delivery SMS scam, SingPost scam SMS, SingPost WhatsApp scam, fake SingPost email, fake tracking link, redelivery fee scam, customs fee scam, delivery phishing scam, phishing SMS Singapore, Likely-SCAM SMS, SMS Sender ID Registry, SSIR Singapore, SGNIC, IMDA anti-scam measures, gov.sg Sender ID, ScamShield app, ScamShield helpline 1799, check suspicious link Singapore, OTP scam, card details stolen, unauthorised card transaction, what to do if scammed Singapore, police report scam online, Shared Responsibility Framework, SingPost Non-Delivery Advice, SingPost official tracking, how to track a parcel safely, smart shopping Singapore, how shopping works, Singapore shopper guide, wahliao shopping guide
