Fake Delivery Text Scams in Sri Lanka
Smishing scams in Sri Lanka impersonating courier and postal services to steal banking credentials from smartphone users.
Part of: Fake Delivery Texts
Last reviewed: 1 June 2026
Fake delivery text scams have spread in Sri Lanka as e-commerce and mobile banking adoption have grown. Victims receive SMS or WhatsApp messages claiming to be from Sri Lanka Post, PickMe Logistics, or international courier services, stating that a package is held pending a fee or address confirmation through a provided link.
The link leads to a phishing page collecting bank card details or online banking credentials, which are then used for fraudulent transactions.
How this scam works on Sri Lanka
A victim receives an SMS claiming their delivery from a well-known retailer is on hold pending payment of a customs fee of LKR [amount]. The payment link leads to a page that closely mimics a genuine bank payment portal, collecting card number, CVV, and OTP.
In a WhatsApp variant, a message from an unfamiliar number claims the recipient has missed a delivery and must follow a link to reschedule — the link harvests banking login credentials.
Some campaigns are timed to major Sri Lankan shopping events like online sale seasons, when large numbers of recipients are genuinely awaiting parcels and are less likely to question a delivery complication message.
Common red flags
- SMS or WhatsApp about a delivery problem with a shortened or unfamiliar URL
- Request for customs payment via a link in a message
- Link domain does not match slpost.gov.lk or a recognised courier's official domain
- Payment page asks for full card details and OTP simultaneously
- Courier service cannot confirm the tracking number when you call directly
How to protect yourself
- Never tap delivery-problem links in SMS — go directly to the courier website using a saved or searched URL
- Check parcel status using your tracking number on the official Sri Lanka Post or courier website
- Enable transaction alerts on your bank account to detect any unauthorised charges promptly
- Report smishing messages to your carrier and to SLCERT
- Block and delete delivery text messages that arrive from unrecognised local or international numbers
- Verify any customs fee requirement by calling the courier directly using the number on their official website
How to report it
- Report to SLCERT at cert.gov.lk
- File with Sri Lanka Police Cybercrime Division at cybercrime.police.lk
- Report to your bank immediately if card details were submitted
Frequently asked questions
I'm expecting several parcels during a big online sale event — how do I stay safe from delivery scams during this time?
Check delivery status only by going directly to the courier's official website or app and entering your tracking number yourself, rather than clicking any link sent by SMS. Scam campaigns are often timed deliberately to coincide with high-volume shopping periods when you're more likely to have genuine deliveries in transit.
The payment page asked for my card number, CVV, and OTP all at once — is that ever legitimate?
No — legitimate payment portals don't need your one-time password on the same page as your card details, since the OTP is meant to confirm a transaction with your bank separately. A page requesting all of this together is a strong sign of a phishing attempt.
Does Sri Lanka Post send payment requests via SMS links?
No. Sri Lanka Post does not send payment request links via SMS. Any customs fees for international parcels are communicated through official customs notifications, not by text message link. Treat all such messages as phishing attempts.