Parcel Text Scams and Unordered COD Packages: How to Verify and Refuse

A parcel message can feel convincing when you are already waiting for a delivery. Phrases such as “address error,” “delivery on hold,” or “small additional fee” exploit that expectation. A different version arrives at the door: a cash-on-delivery package that nobody remembers ordering. Both use the familiarity of parcel services, but the correct response depends on whether the pressure is coming from a message link or from a physical package.

Romania’s national communications regulator, ANCOM, issued a warning on August 20, 2026 about scams impersonating postal service providers. It covered texts and emails that request an address update, an extra payment, or a collection-point selection, as well as unsolicited cash-on-delivery packages. The warning provides a useful two-track response: verify digital delivery claims through official channels, and verify the underlying order before accepting a physical COD parcel.

Two Parcel Scam Paths

Message-based scams borrow a carrier’s name, delivery language, and visual identity to push the recipient toward a link. The linked page may request personal details, card data, a payment, or a verification code. ANCOM advises users to avoid the link in the received message and open the carrier’s official application or website directly. A verification code should not be disclosed to the sender of an unexpected delivery message.

The COD version uses the physical delivery itself. If the sender is unfamiliar or nobody at the address placed the order, do not pay first and investigate later. Check the household’s order history, the named sender, and the tracking information. An unknown package can be refused without making the courier part of the dispute; the point is simply that the recipient has not verified a valid order.

Parcel Text Verification

Start by leaving the message link unopened. Do not use a familiar-looking sender name as proof; modern messaging systems can display convincing labels. Instead, use your own purchase record. Find the tracking number in the retailer’s order page or a previously trusted confirmation, then open an already installed carrier app or type the carrier’s official address yourself.

Even when a real parcel exists, that does not validate the link in the text. Compare the delivery status, sender, recipient, and tracking number with your order. Make any address or collection changes inside the official app, through the retailer’s account page, or through a verified customer-service channel. Do not use the phone number or chat window supplied by the suspicious message as your verification route.

If the Link Was Not Opened

Preserve a screenshot showing the sender, time, and full wording, then use the reporting feature provided by your carrier or telecom provider. Avoid long-pressing the link to copy it if that creates a risk of opening it. Close the message and launch the official carrier service separately. If you need to ask family members about the delivery, share the tracking reference or sender name rather than forwarding the active link.

After Entering Card Data or a Code

If you entered card details, a partial password, or a verification code on the linked page, payment protection comes before parcel tracking. ANCOM advises contacting the card-issuing bank immediately, blocking the card, and following the bank’s instructions. Use the number printed on the card or the support channel inside the bank’s official app—not a cancellation number shown in the suspicious message.

If a transaction was authorized, prepare the time, amount, displayed merchant name, and screenshots for the bank. The issuer can then explain card replacement and any dispute process that applies to the transaction. If the same password was reused for a retailer or email account, change it from each service’s official page and enable the multi-factor authentication option provided by that service.

Unordered COD Package Decision

At the door, reverse the instinct to accept the parcel first and ask questions later. Check your own orders and ask other people at the address whether they recognize the sender and COD amount. If someone claims it is a gift or work item, ask for the seller and tracking number. A matching recipient name or a vaguely familiar product category is not enough to confirm the order.

If no buyer can be identified, the sender is unfamiliar, or the tracking cannot be matched, refuse the package and do not pay the COD amount. Tell the courier that the household cannot verify the order and is declining delivery. Do not call an unknown number on the label to provide personal information or transfer a separate return fee.

Shared Homes and Workplaces

In a shared home, pass only the recipient name, sender, tracking number, and COD status to the household. Do not post identity documents, card details, or entry codes in a group chat. Ask building staff not to pay COD charges on behalf of residents before the buyer is identified.

At work, route COD deliveries through the person who can match a purchase order and approved vendor. A parcel addressed to an employee should not be paid from company funds while the order remains unverified. A supposed supplier gift should be checked through the supplier’s existing contact details rather than the phone number printed on the parcel.

If the Parcel Was Accepted or Paid For

Keep the outer packaging, shipping label, and payment receipt. Contact the carrier through its official customer-service channel and create a case linked to the tracking number. ANCOM advises notifying the postal or parcel provider and the police when a loss has occurred. Avoid sending the item or another fee to instructions supplied by the unknown sender; use the process provided by the carrier and authorities.

A payment through a message link and a COD payment at the door leave different records. For the first, contact the card issuer and identify the transaction. For the second, ask the carrier to preserve the shipment and recipient records. If both happened in the same incident, organize the message screenshots, parcel label, receipt, and bank transaction together so each organization can understand the full sequence.

Korean Reporting Channels

In South Korea, users can call the Korea Internet & Security Agency’s 118 service for smishing and phishing guidance. Financial transactions should also be reported promptly to the issuing bank, while fraud losses can be reported through police channels, including 112 and the Cybercrime Reporting System. Open each institution’s official site or app directly rather than following an advertisement or a link in the suspicious message.

For messages, leave the link unopened and verify the parcel in the official app. At the door, do not pay for a COD package until the order is matched to a real buyer.

Action Order

1. Do not open a parcel-message link; compare the tracking number with your purchase history in the official app.
2. Treat requests for address updates, extra fees, or verification codes as a reason to switch to a verified support channel.
3. If card data was entered, lock the card and call the issuer immediately.
4. Do not accept or pay for an unordered COD package until the buyer, sender, and tracking number are matched.
5. Preserve messages, labels, and receipts, then report the incident to the bank, carrier, police, or KISA 118 as appropriate.