A new WhatsApp scam is targeting users, particularly women, through fake parcel delivery calls, with fraudsters posing as courier company representatives to trick victims into sharing their WhatsApp verification code — allowing scammers to hijack the account and target the victim's friends and family for money.
How the Scam Works
According to reports, the scam follows a specific and deliberate sequence:
1. The fake call Fraudsters contact victims by phone, posing as representatives of a courier or delivery company, typically referencing a parcel that supposedly needs to be delivered or requires some form of verification.
2. The request for a verification code During the call, the scammer asks the victim to share a WhatsApp verification code or OTP (one-time password) — often framing this request as necessary to "confirm" or "verify" the delivery.
3. Account takeover Once the scammer obtains this code, they can use it to take control of the victim's WhatsApp account, effectively locking the real owner out and gaining access to their contacts, chat history, and account identity.
4. Exploiting trust with contacts With control of the account, scammers then contact the victim's friends and family, often posing as the account owner and requesting urgent money transfers — exploiting the inherent trust that comes from messages appearing to originate from someone the recipients actually know.
Why This Scam Is Particularly Effective
This scam relies on a combination of manipulation tactics that make it especially dangerous:
1. A plausible pretext Parcel delivery calls are a common, everyday occurrence for many people, making the initial pretext for contact seem entirely ordinary and non-suspicious at first.
2. Exploiting unfamiliarity with verification codes Many users may not fully understand what a WhatsApp verification code actually protects, or why sharing it with someone claiming to be a delivery representative would be dangerous — making them more susceptible to complying with the request.
3. Weaponizing personal trust networks Once an account is compromised, the scam's effectiveness shifts entirely to exploiting the victim's own social trust network — friends and family are far more likely to comply with an urgent money request that appears to come from someone they know personally, compared to a request from an unknown number.
PTA's Official Warning
In response to this scam, the Pakistan Telecommunication Authority (PTA) has issued a clear warning to citizens: never share WhatsApp verification codes with anyone. This guidance reflects a fundamental principle of digital account security — legitimate services, including WhatsApp itself and genuine courier companies, do not need a customer to read out or share their personal verification code for any legitimate purpose.
How to Protect Yourself
Based on the guidance provided, individuals can take several practical steps to protect themselves from this type of scam:
1. Never share your WhatsApp verification code This code is intended solely for verifying your own device when logging into WhatsApp — it should never be shared with anyone, regardless of who they claim to be or what reason they give for requesting it.
2. Independently verify parcel-related calls If you receive a call claiming to be about a parcel delivery, verify the caller independently through the courier company's official channels — such as calling the courier's official customer service number directly, rather than relying on any contact information or claims provided by the caller themselves.
3. Be cautious of urgency in unexpected requests Scams of this nature often rely on creating a sense of urgency to prevent victims from pausing to verify the legitimacy of a request — treating unexpected urgent requests, whether for codes or money transfers, with extra caution is an important protective habit.
4. Alert friends and family if your account is compromised If your WhatsApp account is ever compromised through this or a similar scam, promptly alerting your contacts through alternative means (a phone call, a different messaging platform) can help prevent them from falling victim to fraudulent money requests sent from your hijacked account.
Why This Scam Matters
1. Targeting a specific, potentially vulnerable demographic The reported focus on women as a particular target group for this scam suggests fraudsters may be tailoring their approach based on assumptions about who might be more likely to comply with such requests, making targeted public awareness particularly important.
2. Exploiting the trust inherent in personal messaging platforms This scam illustrates how fraudsters increasingly exploit the personal, trusted nature of messaging platforms like WhatsApp — a hijacked account can be a far more effective tool for fraud than an anonymous, unknown contact attempt.
3. A reminder of basic digital hygiene principles This case reinforces a broader, important digital security principle: verification codes and OTPs should never be shared with anyone, a rule that applies not just to WhatsApp but to virtually all services that use similar verification mechanisms.
4. The role of regulatory bodies in public awareness PTA's direct warning reflects the ongoing role regulatory and telecommunications authorities play in alerting the public to emerging scam tactics, helping to counter the spread of fraud schemes through public awareness efforts.
Conclusion
This WhatsApp parcel-delivery scam, which particularly appears to be targeting women, highlights how fraudsters continue to develop increasingly sophisticated tactics to exploit both technical vulnerabilities and personal trust networks. With PTA's clear warning to never share WhatsApp verification codes, and guidance to independently verify any parcel-related calls through official courier channels, staying informed and cautious remains the most effective defense against this and similar emerging cyber fraud schemes.
Disclaimer: This post is for informational purposes only and is based on publicly available reports. The image referenced in the original social media post is AI generated and is for reference only.
