A new form of online fraud is targeting shoppers through unsolicited cash-on-delivery parcels. The packages carry therecipient’s name, phone number and address, and often appear to come with familiar e-commerce labels. Victims usuallypay because the parcel looks genuine. But when they open it, they find scrap clothing, paper, low-value items or productsthey may have only browsed online but never ordered. Since there is no matching order in their shopping account, gettinga refund becomes difficult. TOI’s Lipi Joshi explains how the scam happens and what you can do to protect yourself.What is the scam?The scam involves sending fake cash-on-delivery (COD) parcels using people’s genuine personal details. Packages may carry the recipient’s full name, mobile number, address and an e-commerce-style shipping label. The COD amount typically ranges from Rs 500 to Rs 5,000.Since many households regularly shop online, family members may assume an unexpected parcel is genuine and pay the delivery agent. On opening it, they may find scrap clothing, paper or an unrelated item.How does the scam work?Fraudsters use leaked customer information to generate fake shipping labels and dispatch bogus COD parcels in bulk. They upload names, phone numbers and addresses to digital shipping platforms, print labels and send packages through regular delivery networks.The delivery agent collects the cash without necessarily verifying whether the recipient placed an order. Victims often discover the fraud only after opening the parcel and finding that no corresponding order exists in their shopping account.Why do people fall for it?The parcels appear genuine because they carry accurate personal details. In households where several people shop online or accept deliveries for one another, recipients may assume that someone in the family placed the order.How do scammers obtain personal details?Experts say personal information can leak through routine delivery and service systems, not just sophisticated cyberattacks.Software engineer Piyush Surolia, who has worked with third-party delivery services such as Shiprocket and Blue Dart, said shipping labels carry recipients’ names, phone numbers and addresses. Rogue workers at warehouses, shipping centres or local courier contractors could photograph or scan these labels to collect information in bulk.“You don’t need a high-tech bank hack to lose your personal information; it usually leaks right from everyday package shipping,” Surolia said.How are fake COD parcels sent in bulk?According to Surolia, fraudsters exploit the ease of creating bulk shipments through digital shipping services. They can upload spreadsheets containing stolen addresses and generate thousands of shipping labels.“The delivery worker showing up at your door has no way to check if you actually ordered the item on an app like Amazon or Meesho. They are simply paid to collect cash for the printed label,” he said.Are shopping apps the only source of leaked data?No. Personal information may also be exposed through food delivery apps, medical diagnostic laboratories, utility bills, online loan applications, shipping labels and discarded packaging.Private cybercrime investigator Dinesh Jain said data brokers compile such information into spreadsheets and sell it through encrypted messaging platforms such as Telegram or online black markets. While some buyers may use the information for advertising, scammers can also exploit it.Why are refunds difficult?Since the fake parcel does not appear in the victim’s shopping account, there may be no order record against which to raise a return request or refund claim. Victims can struggle to establish that the transaction was linked to an e-commerce platform, particularly after paying the delivery agent in cash.Who is most vulnerable?Frequent online shoppers, people who regularly use COD, families that accept parcels on one another’s behalf, and households where elderly parents or domestic staff receive deliveries may be particularly vulnerable.What should you do before paying?Check your shopping app to verify whether the order appears in your account. Contact the named recipient and confirm that the parcel was expected before handing over any money.Treat unexpected COD deliveries with caution. Instruct family members, elderly parents, domestic staff and neighbours not to pay for parcels without confirmation.The simplest precaution is to follow one rule: never pay for a COD parcel unless someone in the household confirms the order.How can you reduce your exposure to data leaks?Jain advised consumers to be cautious about the personal information they share online. Review saved addresses on shopping and delivery apps and remove those that are no longer needed. Avoid sharing unnecessary personal details and exercise caution when submitting phone numbers and addresses to online services.Consumers should also remove or destroy shipping labels containing personal information before discarding delivery boxes and packaging.
