Fake Courier Call Asking for a Code in Pakistan: Stop the Parcel OTP Scam
Fake TCS, Leopards or Pakistan Post callers ask for an OTP to steal WhatsApp and wallets. Spot the parcel scam, stop it, and what to do if you shared a code.
No courier in Pakistan needs a code from your phone to deliver a parcel. If a caller from "TCS", "Leopards", "Pakistan Post" or any courier asks you to read out a code you just received by SMS or WhatsApp, hang up. That code opens your WhatsApp, wallet or bank account, not a parcel.
The scam has two forms. In one, a caller says a parcel is on its way and asks for a "delivery code". In the other, an SMS says your address is wrong and sends you to a link. Both end with someone else inside your accounts.
Pakistan's National CERT, the government's cyber emergency team, has warned about fake delivery messages naming Pakistan Post, TCS, Leopards and FedEx. PTA was reported in early October 2026 to have warned again about courier callers asking for OTPs. Here is how the scam works, how to stop it, and what to do if you already shared a code.
A courier never needs your OTP to deliver a parcel
An OTP is a one-time password sent to your phone to prove it is you. Couriers confirm a delivery with your name, address, phone call or signature. They have no reason to ask for a code that arrived from WhatsApp, JazzCash, Easypaisa or your bank.
National CERT's advisory says it plainly. It states that Pakistan Post or any other reputable courier or postal service "never requests online payments or address changes through SMS". So a message that asks you to pay a small fee or fix your address through a link is fake.
The OTP request is the newer version. The caller sounds polite and busy. They may even know your name and city, because order details can pass through many hands. Then they say: "You will get a code now, please tell me so I can mark the parcel delivered."
Read the SMS before you say anything. It will usually say "WhatsApp code", "JazzCash" or your bank's name, and often "do not share this code". That line is the whole story.
What the scammer gets with each code
The code you read out decides what you lose. A WhatsApp code lets them take over your WhatsApp and message your contacts for money. A wallet or bank code can let them log in on a new phone or approve a transfer.
| Code you receive | What the scammer can do with it | Who to contact first |
|---|---|---|
| WhatsApp 6-digit code | Register your WhatsApp on their phone and ask your contacts for money | Re-register WhatsApp on your own phone |
| JazzCash or Easypaisa code | Log in to your wallet on a new device or reset your MPIN | Your wallet's helpline |
| Bank app OTP | Add a new device, add a beneficiary or approve a transfer | Your bank's helpline |
| Link to "update address" or "pay delivery fee" | Steal your card details or install a harmful app | Your bank, to block the card |
WhatsApp's own help page says you should never share your registration code "not even friends or family". It also says that a person who has taken over your account is logged out once you enter the 6-digit code on your own phone. That is why speed matters.
How to stop a fake courier call in 5 steps
Do not share any code, end the call, and check the parcel yourself through the courier's official website or app using your tracking number. Then report the number to PTA. Lock your accounts with extra security so the next attempt fails.
- Do not read out any code. Not to a courier, a bank, PTA, NCCIA or a relative's friend. No genuine company needs it.
- End the call. You do not need to argue or explain. Just hang up.
- Check the parcel yourself. Open the courier's official website or app by typing the address, not by tapping a link from the SMS. Enter your tracking number from the shop's order email.
- Report the number. File a complaint with PTA through its complaint portal, and use the PTA steps to report a fake call or SMS scam.
- Add a lock. Turn on two-step verification on WhatsApp so a stolen code alone is not enough.
If you are waiting for a real parcel and worry it is lost, the courier's own complaint line is the right place. Our page on claiming for a lost or damaged courier parcel covers that.
Already shared a code? Act within minutes
If you read out a WhatsApp code, re-register WhatsApp on your phone at once. If it was a wallet or bank code, call the helpline and ask them to block your account and app. Then file a complaint with NCCIA and warn your contacts.
Each case has its own first step.
- WhatsApp code: open WhatsApp, verify your number again and enter the new 6-digit code. Then tell family and friends not to send money to anyone using your account. Full steps are in how to recover a hacked WhatsApp account.
- Wallet code: call JazzCash, Easypaisa or your wallet's helpline and say "fraud". Ask them to block the account until you visit with your CNIC.
- Bank OTP: call your bank's helpline, block the app and card, and ask for a complaint number.
- Card details on a link: block the card and ask the bank to cancel it and issue a new one.
If money has gone, follow the steps for an unauthorised Easypaisa or JazzCash transfer. The first hour is when a transfer is most likely to be stopped.
Fake delivery SMS links are the same scam in writing
National CERT describes an SMS that claims to be from Pakistan Post or a courier, says your address is wrong, and gives a link. The link opens a fake website that copies the courier's look, or asks you to download a file. Both are traps.
Its advice is simple. Do not tap links in messages you did not expect. Type the courier's website yourself. Contact the courier through the numbers on its own official website. Be most careful when a message pushes you to act fast, because the rush is the trick.
A small "redelivery fee" is a typical bait. The fee is not the goal. The card number you type to pay it is.
Common questions
Do TCS or Leopards ask for an OTP to deliver a parcel?
No genuine courier needs a code from your phone to deliver. National CERT's advisory says reputable couriers do not ask for payments or address changes by SMS either.
What is the code the courier caller wants?
It is usually a WhatsApp registration code, a wallet login code or a bank OTP. Read the SMS: it names the app it came from.
I shared my WhatsApp code. What now?
Verify your number on WhatsApp again on your own phone and enter the new code. WhatsApp says this logs the other person out.
Where do I report a fake courier call in Pakistan?
Report the number to PTA through its complaint portal. If you lost money or an account, also file a complaint with NCCIA.
How do I check if a parcel is real?
Use the tracking number from the shop's order message and type the courier's official website yourself. Do not use a link sent by the caller.
How we verified this
What we checked, where we read it, and what we could not confirm.
Last checked on 9 October 2026. We read National CERT's advisory NCA-11.052424, "Smishing Alert: Fake Delivery Package Scam Threats", on pkcert.gov.pk, and WhatsApp's help page on recovering a compromised account. PTA's October 2026 warning about courier callers asking for OTPs was reported in the press; we could not find it on PTA's own website, whose press page had nothing newer than August when we checked.
About the author
Technology Journalist & Multimedia Producer
Ahmad Ali is a technology journalist and multimedia producer at Pakistan Era, joining the team in October 2026. He covers consumer technology and digital life for Pakistani readers, combining research with hands-on product testing.
