My name is Clara Teo. I am 64, a retired civil servant living in a maisonette near Sixth Avenue in Bukit Timah, and on the morning of 19 February 2026 I lost SGD 2,340 because I tried to pay a SGD 3.20 customs charge on a parcel that did not exist.
My daughter laughs about the maths of it now, in the gentle way she laughs about a lot of things I do, but at the time I was furious, with the scammer, with myself, with the bank, with the small voice in my head that had asked whether the SMS looked right and that I had ignored. I want to tell my story properly because in the past two months I have spoken to four other women in my circle, all between fifty-five and seventy, who have been targeted by exactly the same SMS, and two of them clicked.
The SMS arrived at 8:14 am on a Thursday, just after I had finished my morning walk along the rail corridor. I was at home making coffee. The sender ID showed as "DHL-SG" and the message read: "DHL: Your parcel TRK749812SG could not be delivered due to incomplete address and unpaid customs fee S$3.20. Please update by 20 Feb to avoid return: https://dhl-sg-customs.com/track". I was expecting two parcels at the time. One was a birthday gift I had ordered for my granddaughter from a UK retailer. The other was a set of replacement filters for my home water purifier. The UK gift had been ordered using DHL Express; I had a tracking email from the seller a week earlier.
The SGD 3.20 felt right. GST on a small imported gift would be a few dollars. The deadline of the next day felt right. The sender ID felt right. I tapped the link.
The page that loaded had the DHL yellow and red colours, the DHL logo, the same fonts I remembered from the genuine DHL tracking pages I had used for previous orders. It showed a pre-filled tracking number that matched the one in the SMS. It showed a parcel "held at customs" with a small picture of a generic brown box. It asked me to confirm my address and to pay the SGD 3.20 customs fee with a credit or debit card.
I confirmed the address. I entered my Visa debit card number, expiry, CVV. The page asked for the OTP that would be sent to my phone. The OTP arrived. I entered it.
The page returned a small error: "Payment failed. Please try again." I tried again. The same fields. The OTP arrived again. I entered it. Same error. I tried a third time, and this time I used my credit card instead. Three failed payment attempts in total. I closed the browser tab, frustrated, and decided I would call DHL during their office hours later that morning.
I never did call DHL. At 8:51 am, my phone vibrated with a notification from my bank. "Card transaction S$780.00 at LAZADA SG." Then another. "Card transaction S$780.00 at SHOPEE SG." Then another. "Card transaction S$780.00 declined - daily limit reached." Three transactions of SGD 780 each, two successful, one declined for hitting the daily limit on my debit card. They had used my card details and the OTPs I had entered to make e-commerce purchases on Lazada and Shopee, almost certainly resold immediately for cash through reseller networks.
WARNING SIGN 1: DHL does not collect customs payments through SMS links. According to the Singapore Police Force Anti-Scam Centre at https://www.police.gov.sg/Advisories/Crime/Scams, all genuine courier and parcel delivery services either collect duties at the point of delivery from the recipient in person or send a formal invoice through email or postal mail with an official reference and multiple verification options. A standalone SMS demanding immediate online payment to a non-DHL domain is a scam pattern that has been documented in Singapore since at least 2022.
WARNING SIGN 2: The URL in the SMS was dhl-sg-customs.com, not dhl.com or dhl.com.sg. According to the Singapore Police Force, scammers register domains that combine the legitimate brand name with country codes and topical words like "customs", "tracking" or "verify" to look authoritative on a small mobile screen. Any time a courier link does not lead to the company's primary domain, the link is fraudulent.
WARNING SIGN 3: A genuine payment for a SGD 3.20 fee never requires three OTP entries. The repeated OTP requests on the fake site were each authorising one of the three SGD 780 transactions on Lazada and Shopee, not the trivial customs charge displayed on screen. According to consumer guidance issued by the Singapore Police Force in 2025, repeated or unexplained OTP prompts are one of the strongest indicators of a payment hijack in progress, and the correct response is to stop, close the browser, and call the bank's fraud line immediately.
I called my bank's hotline at 8:55 am. I was on hold for nineteen minutes because thousands of other people were also calling that morning. When I finally got through, the agent froze the card immediately, but the two SGD 780 transactions had already been authorised. I called 1800-722-6688 next. The Anti-Scam Centre filed a report and contacted Lazada and Shopee's anti-fraud teams. The Lazada order was for a high-end smartphone, ready for collection at a locker; police intercepted it and recovered the device. The Shopee order was for vouchers, which had already been redeemed within minutes.
My net loss was SGD 2,340 minus SGD 780 recovered through the intercepted Lazada parcel, leaving SGD 1,560 unrecovered. The bank, after a six-week chargeback investigation, refunded a further SGD 780 because they accepted that the OTP had been intercepted through a phishing site they considered to be a known fraud pattern. My final loss was SGD 780, which is small compared to many other victims I have spoken to, but the experience of being deceived was not small at all.
What shook me most was the speed and the design. The page looked correct. The amount was small. The deadline was urgent but not aggressive. Everything was calibrated to be ignored. The Anti-Scam Centre officer told me that the parcel-delivery SMS scam category had received over 4,800 reports in Singapore in 2025, with total losses exceeding SGD 7 million, and that older recipients were disproportionately targeted because we tend to order more from overseas family and to be less practiced at examining URLs on phones.
I have changed my behaviour. I no longer click any link in any SMS, ever. If I am expecting a parcel, I look up the tracking number on the courier's official website that I navigate to manually through my browser. I have set my debit card daily limit to SGD 200, which is enough for groceries but not enough for someone to make off with my savings. I have asked my bank to send me a printed statement quarterly so I can spot anything strange. And I have told this story to every friend in my mahjong group and at my church, because every aunty who hears it is one more person who might pause before tapping.
According to the Singapore Police Force, anyone who receives a suspicious parcel delivery SMS should not click the link and should report it through the ScamShield app or by forwarding to 9-SPF-SCAM (97726722). According to SPF advisories, the most common parcel scam impersonations in Singapore are DHL, FedEx, SingPost and Ninja Van, and all four companies have publicly stated they do not collect fees through SMS links.
Frequently Asked Questions
How do I check if a DHL or SingPost SMS is real in Singapore?
Do not click the link in the SMS. Open your browser and go to dhl.com.sg or singpost.com directly, then enter the tracking number from your original order confirmation email. According to the Singapore Police Force at https://www.police.gov.sg/Advisories/Crime/Scams, all genuine couriers allow tracking through their primary website without requiring payment of fees through SMS-linked pages.
What is the Singapore Anti-Scam hotline for parcel scams?
The Anti-Scam Helpline 1800-722-6688 handles all scam types, including parcel delivery and customs fee scams. It is operated by the Singapore Police Force Anti-Scam Centre and is the fastest channel to begin a card or transaction recall. For ongoing fraud where money is being moved in real time, call 999.
Can my bank reverse fraudulent OTP-authorised transactions?
Reversal is possible through chargeback if the bank accepts that the OTP was captured through a phishing scheme, but the process can take several weeks and recovery is not guaranteed. According to the Singapore Police Force, victims who reported within the first hour and who could demonstrate the phishing site to investigators had higher recovery rates. Set low daily card limits as a preventive measure.
Top 3 Do's and Don'ts
DO check tracking numbers by typing the courier's website into your browser yourself, never via SMS links. DO set low daily limits on debit and credit cards used for online purchases. DO call your bank's fraud line and 1800-722-6688 the moment you see an unexpected card transaction.
DON'T click links in SMS messages claiming a parcel is held for customs payment, even for tiny amounts. DON'T enter OTPs on any page you reached through an SMS link. DON'T assume a small fee request is too trivial to be a scam; the small fee is the lure, not the actual extraction.
Last verified: 23 April 2026.
If you've gone through something similar, I deeply understand the pain. While trying to recover my losses, I found some professional legal aid and recovery channels that helped me a lot. If you're also looking to recover what you've lost or need professional legal advice, you can try reaching out to them:
📱 LINE: [Message me at acfc100](https://line.me/ti/p/~acfc100)
💬 WhatsApp: [Message me](https://wa.me/85254898565)
I hope we can both come through this. Don't give up, and don't feel ashamed — the wrongdoer is the scammer, not us.
