Parcel Locker Phishing on WhatsApp
Fraudsters send WhatsApp messages posing as parcel locker services, claiming a package is held at a collection point and requesting payment or login credentials via a phishing link to release it.
Part of: Parcel Locker Phishing Scams
Last reviewed: 1 June 2026
Parcel locker phishing on WhatsApp exploits the growing use of automated collection points by pretending a delivery has been placed in a locker that requires the recipient to 'activate a code' or pay a small redelivery fee online. The messages often arrive with a convincing brand name and a shortened URL designed to obscure the real destination.
Because legitimate parcel locker services do send genuine WhatsApp notifications in some markets, victims can be genuinely confused about whether a message is real. Scammers time these campaigns to coincide with peak delivery seasons to maximise plausibility.
How this scam works on WhatsApp
A WhatsApp message arrives stating that a package could not be delivered and has been placed in a nearby locker. To retrieve it, the recipient must tap a link and enter a delivery PIN or pay a small holding fee. The link leads to a convincing clone of a real parcel locker provider's website, asking for card details or account login credentials.
In some variants, the phishing page also requests address confirmation, date of birth, and the last four digits of the victim's payment card — enough data for downstream fraud. The page may display a real-time locker map to heighten authenticity.
Other versions claim a locker code is expiring and the parcel will be returned unless the victim clicks within 24 hours, adding artificial urgency.
Common red flags
- WhatsApp message from an unknown number claiming to be a parcel locker provider
- Request to click a link to pay a small fee or enter a PIN before you can collect a parcel
- Shortened or mismatched URL that does not match the official locker provider's domain
- Message not addressed to you by name
- Request for full card details to pay a fee of a few pence or cents
- Extreme time pressure — told the parcel will be returned within hours if you do not act
How to protect yourself
- Track parcels only through the retailer's official website or app, not via unsolicited WhatsApp links
- Type the parcel locker provider's URL directly into your browser rather than tapping any link
- Never enter payment card details on a site reached through a messaging app link
- Use WhatsApp's link-preview feature to inspect URLs before tapping
- Report and block the sender immediately
- Contact the retailer you are expecting a delivery from to verify the status of your order
How to report it
- Use WhatsApp's 'Report' function on the message to flag it to WhatsApp
- Report the phishing website to your national cybercrime authority or internet abuse team
- Inform your bank if you have entered card details on the fraudulent page
Frequently asked questions
I paid the small delivery fee on the WhatsApp link — could that lead to bigger charges later?
Yes, entering your card details on a phishing page can result in the fraudster storing your card for further unauthorised charges, not just the small fee shown. Contact your bank immediately to flag the transaction, monitor your statement closely, and consider requesting a replacement card if you're concerned.
How can I check whether a parcel locker text or WhatsApp message is really from a courier I'm expecting?
Go directly to the retailer's app or website and check your order status there, rather than tapping any link in the message. If a delivery genuinely needs action, it will also show up when you track the order through the retailer directly, so you can compare the two before deciding.
How can I tell if a parcel locker WhatsApp notification is genuine?
Legitimate parcel locker operators will identify the sender number in their verified business profile, and links will go to their known official domain. When in doubt, ignore the WhatsApp message and check your order status directly through the retailer's app or website.