Delivery and cashback link scam

What it is

A delivery or cashback link scam arrives as a WhatsApp message, SMS, or email that appears to be from a known delivery service, e-commerce platform, or rewards programme. The message tells you that a parcel needs an address confirmation, a delivery fee is required, or a cashback reward is pending.

The link in the message leads to a page that visually replicates the legitimate service. You are asked to enter your address, your phone number, or a small payment. To "confirm" the action, the page requests an OTP. The OTP does not go to delivery logistics — it authorises a transaction on your bank account.

In most cases, the amount debited is not the small "delivery fee" shown on the page. UPI-based attacks often debit the full available balance. Card-based attacks initiate a recurring mandate or a larger single charge.

---

Why this scam is effective

Delivery scam messages are timed to reach plausible recipients — people who have recently ordered something online, or in patterns that follow high-volume e-commerce periods. The message does not need to reference your specific order. The expectation that a delivery is arriving is enough to make the message credible.

Cashback link scams exploit the same credibility mechanism. The offer references your actual bank or wallet — HDFC, Paytm, PhonePe — and the visual design of the linked page matches the real platform precisely.

The technical infrastructure behind the link — a fake domain, a phishing page, a UPI deep link — is assembled quickly and discarded after use. The page you visited may no longer exist if you try to return to it.

---

The signs you were targeted

• You received a WhatsApp or SMS about a delivery requiring address confirmation or a small fee, and clicked the link
• A page asked for your mobile number, debit card details, or UPI PIN in connection with a delivery or cashback claim
• An OTP arrived from your bank while you were on the linked page, and you entered it
• Money was debited immediately after entering the OTP — in an amount different from what was shown on the page
• The delivery never arrived, or the sender stopped responding

---

What to do in the first 12 hours

1. Call your bank's 24/7 fraud helpline and ask them to block your account or card immediately.
2. Call 1930 — the National Cybercrime Helpline.
3. Do not interact with the sender again. If they message you with "refund" instructions or a "recovery" link, do not respond.
4. Screenshot the original message including the phone number or contact name, the link text, and any additional messages in the thread.
5. Note the transaction details — the UTR number, the timestamp, and the amount — from your bank statement or UPI app.

---

What to do in the first 72 hours

File a written complaint with your bank within three working days. This is the step that creates the formal record the bank is required to respond to under the RBI framework.

In your complaint, describe the sequence accurately: you received a message that appeared to be from a delivery or cashback service, you clicked a link, you entered an OTP, and money was debited without your informed consent. This characterisation — phishing via social engineering — is distinct from voluntary authorisation and is addressed directly in the RBI customer-liability framework.

File a cybercrime portal complaint in parallel at cybercrime.gov.in.

---

When the bank denies you

The bank's initial denial will likely classify the transaction as authorised. Phishing via delivery and cashback links is specifically documented in RBI guidance, and a correctly drafted complaint cites this directly.

If the bank does not resolve within 30 days, the matter is escalatable to the RBI Ombudsman at no cost to you.

---

What First72 does for you

The triage takes five minutes. If your case is eligible, we draft the complete complaint set — bank dispute letter, cybercrime narrative, and ombudsman appeal if needed — within four hours.

Start the free triage

Or talk to us — +91 72000 72000 · help@first72.in