Fake Delivery & Postal Courier SMS Traps (SPL, Aramex, SMSA, DHL): Smishing Defense Guide
The explosive rise of e-commerce across Saudi Arabia and the Gulf Cooperation Council (GCC) has turned package tracking notifications into everyday habits. Millions of residents frequently await shipments from Amazon, Shein, Noon, and local merchants delivered by courier giants like Saudi Post (SPL / سبل), Aramex, SMSA Express, and DHL.
Unfortunately, cyber syndicates exploit this habit through "Smishing" (SMS Phishing). By sending deceptive text messages claiming an urgent delivery issue or missing customs fee, fraudsters lead victims to cloned payment portals that harvest credit card credentials. This guide exposes the mechanics of courier delivery scams and provides practical instructions to detect and stop them.
1. The Anatomy of a Courier Smishing Attack
A typical delivery phishing campaign unfolds in three synchronized steps:
- The SMS Notification: You receive an SMS from an unfamiliar mobile number or shortcode. The message states: "Saudi Post (SPL): Your shipment #SA849201 cannot be dispatched due to an incomplete delivery address. Please update your address and pay a nominal fee of 7.50 SAR within 24 hours to prevent package return."
- The Cloned Web Portal: Clicking the link inside the SMS opens a web page that looks virtually identical to the official courier portal, complete with copied logos, tracking status progress bars, and localized Arabic/English toggles. However, inspecting the URL bar reveals a fake domain (e.g.,
spl-sa-tracking-portal.comoraramex-parcel-support.netinstead of the legitimatesplonline.com.saoraramex.com). - The Address & Credit Card Capture: The victim fills out a simple form with their street name, followed by a payment gateway prompting for their debit/credit card number, expiration date, and CVV security code to pay the tiny fee (5 to 10 SAR/AED).
- The Account Drain: The moment card details are entered, the fraudsters siphon hundreds or thousands of riyals, or enroll the card in recurring unauthorized subscriptions.
2. How to Identify a Fake Delivery Message
| Feature | Genuine Courier Message | Fraudulent Smishing SMS |
|---|---|---|
| Sender ID | Verified official alphanumeric shortcode (e.g., SPL, Aramex, SMSA) |
Random 10-digit private mobile number or unfamiliar international code (+63, +92, +44) |
| Link URL | Direct link on official domain (e.g. splonline.com.sa, aramex.com) |
Suspicious domain, shortened bit.ly URL, or misspelled address (e.g., spl-sa.com, aramex-sa-delivery.org) |
| Payment Demands | COD upon delivery or settled directly through merchant website | Demands urgent online card payment for "customs clearance" or "rescheduling" |
3. Golden Rules to Protect Yourself from Delivery Phishing
- Never click links in delivery SMS messages: Always open your official courier mobile application (SPL, Aramex, SMSA) or merchant app (Amazon, Noon) independently to inspect tracking status.
- Check the Sender's Number: If an SMS claims to be Saudi Post but arrives from an ordinary mobile number (such as
050XXXXXXX), it is an outright scam. - Verify Unknown Phone Numbers on Number LookUp: Search the sending number on Number LookUp: community members regularly flag active smishing numbers.
- Report Fraudulent SMS: In Saudi Arabia, forward the phishing SMS directly to 330330 (free service on all networks). In the UAE, report via the Dubai Police eCrime portal.
For more advice on stopping nuisance callers, read our tutorial on blocking spam calls on iOS and Android, or remove your contact details via Remove My Number.