In this guide · 8 sections
- 01What the courier scam looks like in 2026
- 02Why online sellers should care about a scam on couriers
- 03What to tell customers in order and shipping emails
- 04Run tracking from your own site, not from message links
- 05Register your SMS Sender ID with the SSIR
- 06Protect your email domain with SPF, DKIM and DMARC
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
Tell buyers in every order email which channels you use, that you never ask for a redelivery fee or card details by message, and that tracking lives on your own site. Then register your SMS Sender ID with the SSIR and set up DMARC so fakes stand out.
What the courier scam looks like in 2026
On 5 August 2026 the Singapore Police Force issued an advisory on phishing scams impersonating courier companies via Apple iMessage. Since 24 June 2026, at least 251 cases had been reported, with losses of more than S$1.2 million.
The messages claim to be from DHL, Ninja Van, J&T Express or SingPost and say a parcel could not be delivered because of an 'invalid' address. They set a deadline (6pm, end of day, 24 hours) and ask the reader to reply 'Y' or '1'. Replying unlocks the link, which iMessage keeps unclickable for unknown senders.
A message arrives from a foreign number or odd email
The Police list numbers starting +212, +63 and +44, or email addresses made of random letters and digits.
The buyer replies and clicks the lookalike link
The site copies the courier's real website and asks for a small 're-delivery fee'.
Card details, banking logins and OTPs are captured
Victims enter card numbers or internet banking details and approve the transaction with their digital token.
The scammer takes over the card or bank token
In some cases the card was added to Apple Pay or Google Pay, or the bank token was moved to a new device using the OTP.
The ScamShield September 2026 bulletin adds the wider picture: e-commerce scams rose 19.3% in the first half of 2026 to 3,865 cases and S$8.3 million lost. Our summary of Singapore scam statistics for 1H 2026 covers the other trends.
Why online sellers should care about a scam on couriers
The scam works best on people who really are expecting a parcel. After someone buys from you, they are exactly that person for a few days. If they lose money to a fake 'delivery fee' message, many will blame the shop they ordered from, ask you for a refund or leave a bad review.
There is also a direct risk to your own brand. The same playbook can be pointed at your store: a fake SMS that says it is from your shop, or an email from a lookalike domain asking for 'payment verification'. If your real messages arrive with no clear pattern, a fake one is hard for a buyer to spot.
What to tell customers in order and shipping emails
Add a short, fixed block to your order confirmation and shipping notification emails. Keep it the same every time so buyers learn it. Something along these lines works:
- How we contact you: 'We only email you from @yourdomain.sg, and SMS from the sender name YourShop. Our courier for this order is Ninja Van (or the courier you actually use).'
- What we never do: 'We never ask for a redelivery fee, card details, banking login or OTP by SMS, WhatsApp, iMessage or email.'
- Where to track: 'Track your order at yourdomain.sg/track or in your account. Type the address yourself instead of tapping links in messages.'
- If in doubt: 'Forward anything suspicious to us through our website, or check it with the ScamShield Helpline on 1799.'
Put the same wording on your FAQ or shipping policy page so it is one search away. If you sell on your own site under the OCHA E-commerce Code of Practice or follow its spirit, clear contact and delivery information is part of the same good practice.
Run tracking from your own site, not from message links
The fewer links you send, the more suspicious a link becomes. Shopify, WooCommerce and most store platforms have an order status or tracking page that a buyer can reach by logging in or by typing your domain. Send the tracking number in the email and point buyers to that page.
Courier tracking links are not dangerous in themselves, but buyers cannot tell a real courier link from a lookalike on a small screen. If you include one, show the courier's full domain in plain text next to it. Our guide to e-commerce shipping costs in Singapore compares the main couriers if you are reviewing which one to use.
Know your courier's real channels too. The Police advisory lists them: couriers mainly use registered SMS Sender IDs; drivers may call, SMS or WhatsApp to confirm details; Ninja Van also uses verified Facebook Messenger and Telegram pages; J&T Express Singapore sends SMS from the registered Sender ID 'J&T Express' and does not charge redelivery fees.
Register your SMS Sender ID with the SSIR
If you send order SMS with a name instead of a number (for example 'YourShop'), that Sender ID must be registered with the Singapore SMS Sender ID Registry. Since 31 January 2023, unregistered Sender IDs are marked 'Likely-SCAM' on Singapore phones, according to SGNIC's SSIR overview. Buyers can also check who owns a Sender ID on the SSIR lookup page.
- SSIR account set-up (one time, per organisation)Including GSTS$545
- Listing per registered Sender IDIncluding GSTS$218 a year
First year, one Sender IDS$763
Fees from SGNIC's SSIR overview, as of October 2026. You need your UEN, Corppass and an IMDA-licensed SMS aggregator that is a participating aggregator.
Most small shops send order SMS through their store platform or an SMS provider. Ask the provider which Sender ID your messages use and whether it is registered under your UEN. If you do not send SMS at all, say so in your order email: 'We do not send SMS'. That alone helps buyers ignore fakes.
Protect your email domain with SPF, DKIM and DMARC
Email is the other channel scammers copy. Three DNS records decide whether other people can send mail that looks like it came from your domain. SPF lists the services allowed to send for you, DKIM signs your messages, and DMARC tells Gmail, Outlook and others what to do with mail that fails those checks.
With DMARC at 'quarantine' or 'reject', a fake email that uses your exact address is far more likely to land in spam or be blocked. It does not stop lookalike domains (yourshop-sg.com), so watch for those too. Our guides on SPF, DKIM and DMARC and lookalike domain takedowns cover both.
Do it yourself or get help?
Most of this is a writing job you can do this week. The technical part, the DNS records and the Sender ID, is where small shops usually get stuck.
Courier scam checklist for online sellers
If you would rather hand over the email side, our email deliverability fix (S$249) sets up SPF, DKIM and DMARC and checks your order emails reach inboxes. Building or tidying a store with a proper tracking page is part of our Shopify Store package (S$1,890).
Frequently asked questions
According to the Police advisory of 5 August 2026, delivery drivers will not ask for payment unless the parcel is cash-on-delivery or the shipment needs GST paid before delivery. J&T Express Singapore says it does not charge redelivery fees. A message asking for a small fee through a link should be treated as a scam.
Usually the loss comes from the scammer, not from your shop, but each case depends on the facts. Be helpful: tell the customer to call their bank immediately, report it to the Police and ScamShield, and confirm the real status of their order. Then check whether any of your own messages could be confused with the fake one.
If the SMS shows a name such as your shop name instead of a phone number, that Sender ID needs to be registered, or Singapore phones will mark it Likely-SCAM. Some platforms send from their own registered ID. Ask your provider which Sender ID is used and whose UEN it is registered under.
DMARC stops scammers using your exact email domain when it is set to quarantine or reject, because receiving mail servers can tell the message did not come from you. It does not stop lookalike domains or SMS and iMessage scams, so combine it with clear wording in your emails and a registered SMS Sender ID.
Tell them not to reply or tap the link, to check the order status by typing your website address themselves, and to forward the message to you through your site. They can also check it on the ScamShield website or call the 24/7 ScamShield Helpline on 1799.