Parcel Locker Phishing on WhatsApp
Fraudsters send WhatsApp messages posing as parcel locker services, claiming a package is held at a collection point and requesting payment or login credentials via a phishing link to release it.
Part of: Parcel Locker Phishing Scams
Last reviewed: 1 June 2026
Parcel locker phishing on WhatsApp exploits the growing use of automated collection points by pretending a delivery has been placed in a locker that requires the recipient to 'activate a code' or pay a small redelivery fee online. The messages often arrive with a convincing brand name and a shortened URL designed to obscure the real destination.
Because legitimate parcel locker services do send genuine WhatsApp notifications in some markets, victims can be genuinely confused about whether a message is real. Scammers time these campaigns to coincide with peak delivery seasons to maximise plausibility.
How this scam works on WhatsApp
A WhatsApp message arrives stating that a package could not be delivered and has been placed in a nearby locker. To retrieve it, the recipient must tap a link and enter a delivery PIN or pay a small holding fee. The link leads to a convincing clone of a real parcel locker provider's website, asking for card details or account login credentials.
In some variants, the phishing page also requests address confirmation, date of birth, and the last four digits of the victim's payment card — enough data for downstream fraud. The page may display a real-time locker map to heighten authenticity.
Other versions claim a locker code is expiring and the parcel will be returned unless the victim clicks within 24 hours, adding artificial urgency.
Common red flags
- WhatsApp message from an unknown number claiming to be a parcel locker provider
- Request to click a link to pay a small fee or enter a PIN before you can collect a parcel
- Shortened or mismatched URL that does not match the official locker provider's domain
- Message not addressed to you by name
- Request for full card details to pay a fee of a few pence or cents
- Extreme time pressure — told the parcel will be returned within hours if you do not act
How to protect yourself
- Track parcels only through the retailer's official website or app, not via unsolicited WhatsApp links
- Type the parcel locker provider's URL directly into your browser rather than tapping any link
- Never enter payment card details on a site reached through a messaging app link
- Use WhatsApp's link-preview feature to inspect URLs before tapping
- Report and block the sender immediately
- Contact the retailer you are expecting a delivery from to verify the status of your order
How to report it
- Use WhatsApp's 'Report' function on the message to flag it to WhatsApp
- Report the phishing website to your national cybercrime authority or internet abuse team
- Inform your bank if you have entered card details on the fraudulent page
Frequently asked questions
How can I tell if a parcel locker WhatsApp notification is genuine?
Legitimate parcel locker operators will identify the sender number in their verified business profile, and links will go to their known official domain. When in doubt, ignore the WhatsApp message and check your order status directly through the retailer's app or website.