Paying for nothing: How Malaysians are scammed using parcels they never ordered

Malay Mail

16-06-2025

KUALA LUMPUR, June 17 — As online shopping becomes an increasingly popular way for Malaysians to buy everyday goods, scammers are finding more creative ways to exploit consumer habits and vulnerabilities.
Among the methods now drawing concern are cash-on-delivery (COD) fraud and phishing attempts linked to fake parcel notifications.
During a recent seminar hosted by Ninja Van Malaysia, its chief sales officer Fariz Maswan said COD scams increased by five per cent in the first quarter of this year, driven in part by Malaysia's high internet penetration and growing reliance on e-commerce.
Citing data from the Bukit Aman Commercial Crime Investigation Department (JSJK), he added that scam-related financial losses in Malaysia have reached approximately RM9 billion over the past decade.
He said that on average, around 1,000 scam cases are reported weekly, with perpetrators constantly evolving their tactics to deceive victims.
COD scams
A cash-on-delivery (COD) scam is a type of fraud involving parcels that appear legitimate — but are actually part of a scheme to trick recipients into paying for something they didn't intend to buy.
These scams generally happen in one of two ways:
Unsolicited parcels — Victims receive a parcel they never ordered, but may assume it was purchased by someone else in the household. Caught off guard, they pay the courier without questioning it.
Deceptive deliveries — Victims do place an order online, but what arrives is a completely different or low-value item. For example, instead of the advertised product, the box might contain something like a packet of instant soup.
Fariz said many people only realise they've been scammed after payment is made and the courier has left.
He said that delivery personnel are not involved in these scams, as their role is simply to deliver parcels and collect payment — they do not open or inspect the contents, nor are they responsible for verifying the sender.
The scammers behind these schemes are often based overseas. They pose as sellers on platforms like Lazada or Shopee, using fake listings to collect personal details and send out fraudulent parcels.
Additionally, in many cases, the transactions do not actually take place on these official platforms.
Instead, victims are lured through ads on social media to place orders via external websites or messaging apps like WhatsApp — meaning victims will not be protected by any return or refund policies.
'Ghost' deliveries and SMS phishing
Fariz also highlighted the rise of so-called 'ghost scams' — cases where victims are tricked into paying for products or services that either do not exist or are never delivered.
He added that phishing scams, where victims are tricked into revealing sensitive information through fake SMS messages, are also becoming more common.
He said that in a recent case, scammers impersonated Ninja Van by sending fake parcel notifications via SMS.
The messages included a payment link that led to a counterfeit website designed to steal banking information.
'Our information security team investigated and traced the origin of the attack to a foreign IP address. The scammers were impersonating our brand and targeting the public,' he said.
'We were not alone — several other courier services were also affected during the same period,' he added.
Other courier services have issued similar warnings.
According to information posted on Pos Malaysia's website, scam messages often include shortened links that redirect to phishing sites or prompt users to install malicious APK files.
It said that common red flags include:
Receiving calls about prohibited items.
Claims of special hotlines connecting to police or Customs.
Requests for payment to personal or intermediary bank accounts.
SMS messages asking for personal updates via unfamiliar delivery-related links.
Members of the public can reach the NSRC by dialling 997, which serves as the national emergency hotline for reporting scam-related incidents. — Picture by Firdaus Latif
How to stay protected
Speaking during the Ninja Van seminar, founder and principal of Graymatter Forensic Advisory, Raymon Ram, said that modern scams have become significantly more sophisticated.
He said that unlike earlier scams, which were often riddled with spelling mistakes and poor grammar, today's scams feature professional designs, authentic-looking logos, and polished language — making them far harder to detect.
Due to this increased complexity, he said the public should pause and verify before responding to any investment opportunity or request for fund transfers.
'Check whether the company is licensed or legitimate. Ask basic questions like 'why are they promising such unusually high returns?'' he said.
'Scammers are no longer limited to email. Many now approach victims through WhatsApp and other messaging platforms. So, stay alert,' he added.
Superintendent Yap Huat Tian, deputy chief of the Selangor police's Commercial Crime Investigation Department (Intelligence/Operations), shared a similar concern on dealing with unsolicited contact from individuals claiming to represent official entities.
He urged the public not to accept such claims at face value, but to independently verify the information by contacting the organisation directly.
'Always verify by contacting the institution directly. Don't rely solely on phone calls, emails, or text messages. It's better to be cautious than fall victim to a scam,' he said.
'What seems harmless at first often leads to criminal consequences.'
Steps to take after falling victim to a scam
Yap said that those who fall victim to scams should immediately report the incident to the National Scam Response Centre (NSRC), which plays a crucial role in coordinating efforts to halt fraudulent transactions and minimise financial losses.
He explained that once a scam is reported, the NSRC works with relevant financial institutions to block suspicious transactions and prevent further unauthorised activity.
However, he added that the NSRC operates only from 8am to 8pm.
'So, if possible, avoid making transactions at night, especially those involving large sums,' he said.
'Once you report it, the NSRC can coordinate with Bank Negara to block the transaction and prevent further losses.
'The faster you act, the better your chances of recovering your money. As soon as you realise something's wrong, act immediately,' he added.
Members of the public can reach the NSRC by dialling 997, which serves as the national emergency hotline for reporting scam-related incidents.