Singapore police issued a fresh warning on Nov. 3, 2026, after identifying renewed iMessage phishing attempts in which scammers impersonate courier companies and direct recipients to fake parcel-delivery websites. The messages have been linked to courier names including TracX Logis, uParcel and Park N Parcel, with some arriving from overseas numbers carrying the Philippines’ +63 country code.
The courier phishing scam is not simply a fake delivery notification. It is a multi-step attempt to persuade recipients to interact with a suspicious message, visit a counterfeit website and surrender information that can be used to access financial accounts.
The warning has a regional dimension because Philippine-format numbers appear among the sender details identified by Singapore authorities. That does not prove the scammers are operating from the Philippines, but it gives consumers another reason to treat unexpected delivery messages with caution.
Courier phishing scam uses a fake delivery problem to gain trust
The latest police advisory describes a familiar situation: a message claims that a parcel could not be delivered because the recipient’s address is invalid.
The recipient is then urged to correct the address within a short deadline. The message may mention a deadline such as 6 p.m. or a period of 12 to 24 hours, creating pressure to act before the supposed delivery problem becomes worse.
The link may look similar to the courier’s legitimate website. In some cases, the message even includes the courier company’s genuine customer-support number, making the communication appear more credible.
The police identified TracX Logis, uParcel and Park N Parcel as names being impersonated in this particular campaign.
The key warning is that a familiar company name or customer-service number does not prove that the message itself is genuine. Scammers can copy branding and place legitimate contact information inside an otherwise fraudulent message.
Why replying “Y” can make the situation worse
One detail in the advisory deserves particular attention: some messages instruct recipients to reply with the letter “Y” to receive a clickable link.
This is not an ordinary delivery confirmation. It is an interaction that can help the sender get around a protection in Apple’s messaging system.
In an earlier Aug. 20 advisory, Singapore police explained that links from unknown iMessage senders may initially be unclickable until the recipient interacts with the sender. Scammers have used replies such as “Y” or “1” to make the embedded link clickable.
That creates a dangerous sequence. A person may believe that replying simply confirms receipt of a parcel notification, when it actually helps move the conversation towards the next stage of the scam.
The safest response is not to reply, even if the message appears to be connected to a delivery the recipient is expecting.
The fake delivery website is designed to collect financial details
After a recipient opens the link, the latest police advisory says the person may be redirected to a counterfeit website resembling the courier’s official page.
The site then requests a small re-delivery service fee. The amount may appear insignificant, which can make the payment request seem routine.
But the payment is not the real objective. The fake page can ask for banking information and a One-Time Password (OTP), giving scammers information they may use to carry out unauthorised transactions.
The danger is that victims may not recognise the deception immediately. Police said victims in this scam variant discovered what had happened after noticing unauthorised transactions on their cards or bank accounts.
A separate ScamShield alert published on Oct. 31 also warned Apple users about fake courier websites imitating TracX Logis and uParcel. It said victims’ personal details and payment information had been stolen after they entered the information to claim a delivery.
For consumers, this means a small payment request should never be treated as harmless simply because the amount is low.
The wider iMessage campaign has already produced significant losses
The Nov. 3 advisory did not provide a new financial-loss total or a fresh count of victims for the latest courier messages.
However, an earlier Singapore Police Force update dated Aug. 20 documented the scale of the wider iMessage campaign. Since June 2026, the Cyber Command had detected and disrupted more than 30,000 Apple iMessage accounts linked to the campaign.
Police also estimated that courier-impersonation messages had resulted in about S$2.2 million in losses at that time. These are figures from the August update, not a new November tally.
The same advisory described scammers impersonating courier companies, government agencies and financial institutions. It also explained that some victims were persuaded to provide credentials or OTPs, after which payment cards or banking security features could be linked to unfamiliar devices.
This shows why the latest courier warning should be understood as part of a broader impersonation problem. The identity used in a message can change, but the objective remains the same: persuade a person to trust an unsolicited communication and provide access to sensitive information.
WWC ONE MEDIA previously examined a separate iMessage phishing campaign impersonating DBS and Shopee. The courier warning reinforces the need to verify the sender rather than relying on the name displayed in a message.
What the +63 country code means for Philippine users
The latest police advisory lists several overseas country codes associated with the suspicious messages: +855 for Cambodia, +84 for Vietnam, +1 for North America and +63 for the Philippines.
The appearance of +63 is relevant to Philippine consumers because it means a suspicious message may display a familiar local country code while pretending to represent a courier operating elsewhere.
However, a phone number’s country code alone does not establish the sender’s physical location or identity. It should not be used to accuse a particular country, individual or telecommunications provider of operating the scam.
For people in the Philippines, the practical lesson is to check the actual delivery through the courier’s official application or independently accessed website. Do not use a link supplied in an unexpected message to correct an address or pay an additional fee.
This is particularly relevant in a region where online shopping, digital payments and messaging platforms are part of everyday transactions. WWC ONE MEDIA has also reported on fake travel offers targeting Singapore consumers and fraudulent WhatsApp messages impersonating students. Both illustrate how criminals can exploit familiar names and trusted communication channels.
How users can protect their devices and accounts
Singapore police recommend that iMessage users enable “Filter Unknown Senders” and “Filter Spam” and report suspicious messages through the app’s reporting function.
Apple’s support guidance also explains how users can filter messages from unknown senders and report spam. The exact menu options may vary by iOS version.
Consumers should take several precautions:
- Do not reply: Avoid responding to unexpected delivery messages, including requests to reply “Y” or “1”.
- Do not open the link: Check the delivery directly through the courier’s official website or application.
- Never provide an OTP: Do not disclose banking passwords, card information or verification codes through an unsolicited message or website.
- Use account protections: Enable two-factor authentication and appropriate transaction limits. Consider the Money Lock feature if offered by your bank.
- Report suspicious messages: Use the available reporting function and inform the relevant authorities.
- Contact your bank immediately: If you have entered banking details or suspect an unauthorised transaction, contact your financial institution through its official hotline and report the incident.
Singapore residents who are unsure about a suspicious message can contact the 24-hour ScamShield Helpline at 1799.
WWC ONE MEDIA has also covered the wider regional response through its report on ASEAN’s anti-scam education initiative.
What happens next
The Nov. 3 police advisory does not announce a new arrest, enforcement operation or updated loss figure. It is a public warning outlining the current impersonation method and the steps users should take to avoid becoming victims.
The practical challenge for consumers is to recognise that a delivery notification can be used as the opening move in a financial scam. A message can display a courier’s name, resemble a genuine website and even include a real customer-service number without being authentic.
For Philippine users, the appearance of +63 numbers in the warning is a reason to remain alert, not evidence that the operators are based locally.
The safest approach is straightforward: verify the parcel independently, avoid replying to unexpected messages and never hand over banking credentials or OTPs through a delivery link.
Frequently asked questions
What is the courier iMessage phishing scam?
It is a fraud scheme in which scammers impersonate delivery companies through iMessage, claim a parcel could not be delivered and direct recipients to fake websites to collect personal and banking information.
Why do scammers ask recipients to reply “Y”?
Singapore police said some messages use this instruction to make a link clickable after the recipient interacts with an unknown sender.
Are Philippine +63 numbers involved in the scam?
Singapore police listed +63 among the overseas country codes seen in suspicious messages. This does not establish that the scammers are physically located in the Philippines.
What should I do if I receive a fake parcel-delivery message?
Do not reply or open its link. Check the parcel directly through the courier’s official application or website and report the suspicious message.
What if I already entered my banking details or OTP?
Contact your bank immediately through its official channel, ask it to secure your account and block suspicious transactions, and file a police report where appropriate.
