PETALING JAYA: Scammers are exploiting the popularity of the cash-on-delivery service by posing as delivery agents on WhatsApp, sending QR codes to victims to collect payments for non-existent packages.
One victim, who wanted to be known only as Adli, 33, said he received a message from an unknown number informing him that he had two unpaid packages worth RM60.
At first, he assumed he had placed an online order and forgotten to pay for it.
“The message came with a template very similar to the one used by a delivery company I often use.
“However, it included a QR code and asked me to make the payment immediately,” he said when contacted yesterday.
Adli made the payment without checking his previous orders.
“Right after I sent the payment receipt, the number blocked me,” he said.
Another victim, Syarifah Saliha Idris, 22, said she had made several purchases on TikTok and other online platforms recently.
“After a few days, I received a notification from a delivery company saying my orders had arrived, but I needed to pay RM28 for additional delivery charges.
“The WhatsApp message said I needed to make the payment immediately because the rider still had other deliveries to complete.
“He even said I should pay quickly or he would not have time to break his fast,” she said.
After checking her orders, she realised the delivery details did not match and decided to block the number.
Less than 15 minutes later, another person claiming to be the same delivery rider contacted her using a different number.
“I knew it was a scam. I’m not sure how they got my number, but I hope the authorities can do something about this.
“They know my personal details, even my exact address. It’s really scary,” she added.
Zul Ariffin Mohd Sani shared a similar experience when he received a message on WhatsApp claiming to be from a popular courier company.
“When I checked, it was my address, and my full name was stated there, but I told the person I did not make any such orders. I think this is a new tactic by scammers,” he said.
Financial crime and fraud risk specialist Raymond Ram said the scam is a social-engineering attack that exploits everyday digital habits.
“Malaysians today are accustomed to frequent online deliveries, instant messaging notifications and frictionless QR payments.
“Criminal networks take advantage of this by encouraging urgency and confusion.”
In Malaysia, he added that authorities and courier companies have repeatedly warned that parcel scams now commonly arrive via SMS, WhatsApp or Telegram.
It may include QR codes directing victims to fraudulent payment accounts, fake courier websites designed to steal banking credentials and malicious APK files that compromise victims’ phones, he said.
The safest response when unsure or receiving such a notification is to reject the parcel or refuse payment, added Ram.
“If a victim has already made the payment, they should immediately contact their bank’s fraud hotline or call the National Scam Response Centre (NSRC) at 997 or lodge a police report.
Datuk Muhammad Fuad Talib, who is an Malaysia Crime Prevention Foundation exco member, advised Malaysians to ignore parcels if they do not know the sender, more so if they are from abroad.
“Do not make any payments, and if the sender is unknown, then ignore it.
“Sometimes, the fraudster will even work under the guise of a government agency and claim from the victim a certain amount of money to release the funds.
“Even my former subordinate was scammed recently. In the last few days, he paid a certain amount of money to the scammer, and then later he was told to bank in more money,” he said.
