The fake failed-delivery courier message
A message claiming your package could not be delivered, asking for a redelivery or customs fee through a link.
The scenario
This is an illustrative training example, not a real notice from Claro or any delivery company. In this scenario a short message claims a parcel could not be delivered and asks you to pay a small redelivery or customs fee through a link. It carries courier-style branding and a tracking number so it looks like a normal shipping update at a glance.
The pretext works because it is small and plausible. The fee is tiny, often just a few thousand rupiah, so paying feels lower risk than losing a package. The message implies the item is already on its way and only a quick payment stands between you and your delivery, which discourages careful checking.
It usually reaches you on your phone by SMS, WhatsApp, or email, exactly where genuine delivery alerts appear. Because so many people shop online, there is a good chance you really are waiting for something, and the timing can feel like a coincidence that makes the message even more believable.
It is convincing because mobile screens hide the warning signs. A shortened link looks harmless, the courier logo and tracking number add false credibility, and it is hard to inspect a web address on a small screen. Once you tap through, the page asks for card details or login information on a site built purely to collect them.
Red flags to spot
A small payment request for a 'redelivery' or 'customs' fee via a link
Legitimate couriers rarely require online micro-payments to complete a delivery you already paid for.
A tracking number that does not match any order you actually placed
The number is often fake or reused across many messages, only meant to look convincing.
A shortened or unfamiliar link instead of the courier's real website
Shortened links hide the true destination, which is usually a credential or payment-harvesting page.
A message that arrives by SMS or WhatsApp asking you to act within hours
The tight deadline is designed to stop you from checking the courier's official app or website first.
A sender number that is a personal mobile rather than an official service line
Real couriers send automated alerts from registered short codes or verified accounts, not private numbers.
Spelling or spacing mistakes in the courier name or the message body
Official notifications are generated by systems and rarely contain the small errors seen in scam texts.
The lesson
Check delivery status only through the courier's official app or website, which you open yourself rather than through any link in a text or chat. Compare the tracking number against orders you actually placed, and never enter card or login details on a page you reached from a message. If it looks like a scam, delete it and report it to the courier and, if it hit your work device, to your security team.
These are illustrative examples built for training purposes only, not real messages sent by Claro or any actual organization.
Frequently asked questions
Contact your bank immediately to freeze the card and dispute the charge, then watch your account for further activity. If you used a work device, tell your IT or security team. The sooner you act, the more likely the bank can stop or reverse fraudulent transactions.
Related pages
HR Payroll Update
An email posing as HR asks employees to update their bank or payroll details through a linked form.
Learn moreCloud Storage Alert
A fake cloud storage or M365 notification claims a document has been shared or your storage quota is full, leading to a fake login page.
Learn moreBank Account Verification
An email or SMS claiming to be from a bank warns of a suspicious transaction and asks you to verify your account through a fake login link.
Learn moreRun these patterns as real simulations
Claro turns each of these lures into a localized, trackable phishing simulation your team can learn from safely.
Request a demo