Parcel Locker Phishing on Facebook
Facebook Groups and Messenger messages distribute fake parcel locker notifications that direct users to phishing sites collecting card details to pay fabricated locker access or customs fees.
Part of: Parcel Locker Phishing Scams
Last reviewed: 1 June 2026
Facebook's community Groups and Messenger are used to spread parcel locker phishing content that mimics legitimate carrier notifications. Community Group posts that appear to come from neighbours or local administrators about uncollected parcels carry a degree of local trust that cold phishing emails cannot replicate.
Messenger campaigns reach users directly, bypassing email spam filters and presenting as peer-to-peer communications from known contacts whose accounts may have been compromised.
How this scam works on Facebook
A Facebook community Group post informs members that parcels are accumulating in a local locker and includes a link to check whether any are theirs. Alternatively, a Messenger message from a contact shares a parcel tracking notification containing a phishing link.
Users who click the link reach a convincingly designed carrier website that requests card details for a small release fee. The fee itself is minor — designed to seem plausible — while the card details are harvested for later fraudulent use.
Common red flags
- Facebook Group post about parcel lockers with an external link to pay a fee
- Messenger message from a contact sharing a parcel tracking link that was not solicited
- Parcel release site requests card details for a nominal fee
- Link domain does not exactly match the genuine carrier or locker operator website
- Post or message creates urgency about a return deadline
- Contact who sent the Messenger message has been behaving unusually — account may be compromised
How to protect yourself
- Never follow parcel links shared via Facebook Groups or Messenger without independently verifying against your own order history
- Contact carriers directly through their official apps or websites — not through shared links
- Alert friends whose accounts may be sending phishing parcel links without their knowledge
- Report the Facebook post or Messenger content using the three-dot menu and selecting 'Report'
- Check your own account security if you sent or shared parcel links you do not recall
How to report it
- Report the Facebook post or Messenger message using the three-dot menu and selecting 'Report'
- Notify Group moderators to remove the post before more members click the link
- File a complaint with Action Fraud at actionfraud.police.uk or the FTC at reportfraud.ftc.gov
Frequently asked questions
A Facebook Group admin posted the parcel locker link — does their role make it more trustworthy?
No — admin accounts can be compromised or an admin might unknowingly share a scam link they received themselves. Message the admin through a separate channel to confirm before others in the group click, and report the post regardless of the poster's role.
How can I tell if a Messenger message about a parcel is from my actual friend or their compromised account?
Look for anything unusual in how the message is written, and if in doubt, contact your friend through a different method, such as a phone call, to confirm they meant to send it, since account compromise often shows no other outward signs.
I paid a small 'release fee' on a fake locker site — what should I do about my card?
Contact your card issuer immediately to report the card as compromised and request a replacement, then monitor your statement closely, since a small initial charge is sometimes followed by larger unauthorized transactions.
My Facebook friend sent me a parcel tracking link — should I click it?
Only if you are expecting a parcel and the link matches the official carrier domain exactly. If in doubt, message your friend separately to confirm they intentionally sent it — their account may have been compromised.