A sophisticated fraud targeting women is spreading rapidly through WhatsApp, using fake delivery notifications to steal personal data and financial information. Scammers are posing as representatives of reputable courier companies, claiming a parcel is held at a local hub due to an “unpaid customs fee” or “address error.”
The scheme relies on psychological pressure. Victims receive a message—often featuring the logo of a well-known logistics firm—instructing them to click a link to “verify” their delivery details. Once the link is clicked, the site prompts the user to enter banking credentials or credit card information to pay a nominal “re-delivery fee.”
“They messaged me from an international number, using my full name and home address,” said a Karachi-based professional who narrowly avoided the trap. “It looked like a standard tracking update. When I hesitated to pay the small fee, they became aggressive, threatening that the parcel would be returned to the sender within hours.”
Cybersecurity analysts warn that the scam is a classic phishing operation. The goal isn’t the delivery fee; it’s the harvesting of banking data. Once a victim enters their card details, the scammers use that information to initiate unauthorized transactions.
The Federal Investigation Agency (FIA) has seen a spike in complaints, though officials admit that tracking these groups is difficult. Many of the perpetrators operate from outside Pakistan, using spoofed numbers and encrypted messaging platforms to evade detection.
Data protection experts suggest a simple rule: if you aren’t expecting a package, don’t engage.
“Legitimate courier services in Pakistan do not send payment links via WhatsApp for customs duties,” said a digital security consultant based in Islamabad. “If you receive such a message, ignore it, block the number, and report the account to WhatsApp immediately.”
The surge in these reports highlights a growing vulnerability in Pakistan’s digital space, where personal data is increasingly being traded on the dark web. For now, the best defense remains skepticism. If a parcel notification arrives out of the blue, the safest option is to verify it through the courier’s official app or website—never through a link sent in a chat.
