Royal Mail Phishing SMS — How to Identify & Stay Safe

INDIA — By BharatSecure Threat Intelligence Team · Updated May 27, 2026

Severity: HIGH | View Full Scam Details

Beware the Royal Mail Phishing SMS Scam in India 2026: How to Stay Safe

A new highly dangerous scam targeting Indian mobile users involves fake Royal Mail SMS messages tricking victims into losing money through fraudulent payments.

What Is the Royal Mail Phishing SMS?

The Royal Mail Phishing SMS scam is a deceptive fraud targeting people in India, especially those who frequently shop online during busy festival seasons. Scammers send SMS messages — sometimes spreading through WhatsApp forwards — pretending to be from Royal Mail, the British postal service, claiming that a parcel is awaiting delivery or being held due to payment issues. Many Indians order goods internationally, and this familiarity with foreign parcel services adds to the scam’s credibility.

In reality, these SMS messages are fake and part of a phishing attempt aimed at stealing money through fraudulent payment requests. The scheme has become more common in Indian cities with high digital adoption rates. According to recent alerts from India’s Indian Computer Emergency Response Team (CERT-In) and the Ministry of Home Affairs’ Indian Cyber Crime Coordination Centre (I4C), scammers are increasingly exploiting the trust around trusted courier brands to lure users into clicking harmful links.

The scam is widespread enough to warrant advisory notes for the public, warning users not to click on random parcel-related messages, especially from unknown numbers or unverified WhatsApp forwards. The RBI and CERT-In underline that such messages often lead to fake websites designed to steal UPI credentials or prompt payments via BharatQR codes, direct bank transfers, or UPI apps like PhonePe, Google Pay, and Paytm.

How This Scam Works — Step by Step

1. Receiving the SMS or WhatsApp Message: You get a message from an unknown number or via WhatsApp claiming that your Royal Mail parcel is awaiting delivery or has been held because of a payment problem.

2. Message Content: The text urges you to act fast, sometimes warning the parcel will be returned or cancelled if payment is not made immediately. It includes a link that looks like the official Royal Mail site but is fake.

3. Clicking the Malicious Link: When you click on the link, you are taken to a counterfeit website resembling Royal Mail’s official portal, asking for details like your name, address, and sometimes Aadhaar or PAN information to “verify your identity.”

4. Payment Request: The fake site asks you to pay extra charges or customs fees using UPI apps, scanning a BharatQR code, or direct bank transfer to untraceable accounts controlled by the scammers.

5. Loss of Money: Once the payment is made, the fraudsters disappear. No parcel arrives, and your payment cannot be reversed easily because it was done through UPI or immediate bank transfers.

6. Possible Secondary Attacks: Sometimes, victims who enter sensitive details (Aadhaar, PAN) face identity theft or SIM swap fraud, worsening the financial damage.

Real Warning Signs to Watch For

• The SMS or message is from an unknown or international number—not an official Indian courier contact.
• Urgent language threatening that your parcel will be returned or cancelled immediately.
• Links that do NOT begin with “https://www.royalmail.com” or official tracking domains.
• Requests for payment via UPI apps or scanning BharatQR codes on a website you haven’t verified.
• Unexpected messages for parcels you did not order or outside your normal courier services.
• Grammatical or spelling errors that are unusual for official Royal Mail communications.
• Asking for sensitive personal details like Aadhaar, PAN, or bank PIN on the linked site.

What Happens to Victims

The financial loss is immediate since UPI and bank transfers happen instantly and usually cannot be reversed once authorized. Many Indian victims report losing thousands of rupees after these fake payment demands. The scam also causes emotional distress—as people panic about fake “pending parcels” and the threat of losing ordered goods.

Further complications arise when personal data like Aadhaar or PAN is leaked. This information may be misused for identity theft, fraudulent loans, or SIM swap attacks, which can lead to further losses and privacy breaches. Victims often find it difficult to get their lost funds back quickly since the scammers use multiple fake accounts and payment channels.

What RBI and CERT-In Say

The Reserve Bank of India (RBI) has reiterated the importance of vigilance when authorizing UPI transactions, warning users never to share UPI PINs or scan suspicious QR codes. RBI’s customer helpline and grievance redressal portals help consumers report unauthorized digital payments.

CERT-In has issued advisories on phishing scams and urges users to verify the source of any SMS or WhatsApp message before clicking links. The Indian Cyber Crime Coordination Centre (I4C) has set up the 1930 helpline to report instances of cyber fraud including scams involving payment apps.

The authorities emphasize that no official courier service, including Royal Mail, will ask for additional payments via direct UPI transfers or BharatQR payments outside their verified platforms.

How to Protect Yourself

1. Do Not Click on Suspicious Links: Never click on SMS or WhatsApp messages about unexpected parcels, especially with unknown numbers.
2. Verify with Official Sources: Track your parcels using official courier apps or websites by entering the tracking ID directly—not through links received via messages.
3. Avoid Immediate Payments via UPI: If asked for payment, confirm with the courier service through official contact channels.
4. Don’t Share Personal Information: Never enter Aadhaar, PAN, UPI PIN, or bank details on any website linked from unfamiliar SMS.
5. Check the URL Carefully: Look for “https” and official domain names. Even similar-looking fake URLs can be a trap.
6. Use UPI App Alerts: Enable transaction notifications to immediately spot unauthorized payments.
7. Educate Family and Friends: Warn your circle, especially older people, as they are often targeted in phishing scams.

What to Do If You've Been Targeted

• Immediately report the unauthorized payment to your bank or UPI app and request a block or reversal of the transaction.
• Change your UPI PIN and linked banking passwords without delay.
• File a complaint at cybercrime.gov.in with all transaction details.
• Call the 1930 cybercrime helpline for guidance on filing FIRs and further action.
• Inform your mobile operator to secure your SIM if you suspect identity theft or SIM swap attempts.
• Keep all SMS, messages, and transaction receipts handy as proof for investigations.

Frequently Asked Questions

Q: Can I get my money back if I pay through UPI to scammers?
A: UPI payments are instant and generally cannot be reversed unless your bank proves fraud and files a chargeback. Acting quickly to report is crucial but full recovery is not guaranteed.

Q: How do I know if a Royal Mail message is genuine?
A: Genuine messages come from official channels, with correct URLs and usually do not ask for payments outside the standard courier’s website or app. Always cross-check tracking details on Royal Mail’s official site.

Q: What should I do if I accidentally entered my Aadhaar or PAN on a fake site?
A: Immediately monitor your credit reports for suspicious loans or activity, report identity theft to UIDAI and police, and consider placing a fraud alert on your accounts.

Stay safe from parcel scams like the Royal Mail Phishing SMS. When in doubt, verify suspicious messages at BharatSecure.app before clicking or paying. Your money and identity are worth the extra caution!