Is a text asking me to "update" my delivery info a scam?

Almost always, yes. J&T Express publicly confirmed in August 2026 that texts asking customers to click a link and update delivery or barangay information are scams. Legitimate couriers resolve real delivery issues inside their own app or official website, not through an unsolicited SMS link.

Where do I report a fake delivery text message in the Philippines?

Use the NTC's B.I.R.D. method: Block the sender, Ignore the message, Report it to the NTC online complaint portal (ntc.gov.ph) or hotline 1682, and to the PNP Anti-Cybercrime Group at acg@pnp.gov.ph if you lost money, then Delete the message.

What is "quishing" and how is it different from a fake delivery text?

Quishing is phishing done through a malicious QR code instead of a text link. The PNP Anti-Cybercrime Group warned about it in July 2026 after reports of scanned QR codes redirecting victims to fake sites that harvest personal and banking details. It works the same way as a delivery-text scam, just through a scanned code instead of a tapped link.

Fake Delivery Text Scams in the Philippines (2026 Guide)

Q: What should I do if I already clicked the link in a fake delivery text?

If you didn't enter any information, simply close the page. If you entered banking details, a card number, or an OTP, call your bank or e-wallet's fraud hotline immediately to freeze the account, then report the scam to the NTC and the PNP Anti-Cybercrime Group.

Sulit verdict: Delete it, don’t click it. No legitimate courier — J&T Express, LBC, PHLPost, Shopee Express, or Flash Express — will ever text you a link asking you to “update” your address or pay a “redelivery fee” to release your parcel. Real delivery problems get fixed inside the courier’s own app or official website, never through an SMS link with a countdown attached. If a text is pressuring you to act in the next few hours, that pressure is the scam.

If you’ve gotten a text in the last few months saying your package is “on hold,” your address is “incomplete,” or your delivery will be “returned to sender” unless you click a link — you’re not imagining a pattern. J&T Express Philippines had to publicly warn its own customers about this exact scam in August 2026, and couriers like PHLPost have been fighting a version of it for years. With so much of the country now buying through Shopee, Lazada, and TikTok Shop (we track the sale calendar here), almost everyone has a real parcel in transit at any given moment — which is exactly what makes a fake delivery text believable enough to work.

What the Scam Actually Looks Like

The messages are built to look routine, not alarming. According to J&T Express Philippines’ own August 2026 warning, reported by Interaksyon, the texts claim a customer’s delivery details are “missing” and ask them to update their barangay information through a link “to help ensure successful delivery.” One recipient who posted a screenshot noticed the sender used a non-Philippine country code, and the link didn’t lead to J&T’s actual website. J&T responded on Facebook with a blunt “Mag-ingat: SCAM ITO!” and told customers to verify any delivery concern only through its official app or website.

The Philippine Postal Corporation (PHLPost) has been dealing with the same playbook for even longer. Per its own advisory, cited by PhilSTAR Life, scammers send texts claiming a parcel couldn’t be delivered because of an “incomplete address,” then demand an immediate online “redelivery fee” by card. PHLPost is explicit: it states plainly that these messages “do not come from the postal service,” and that it never asks for banking details, passwords, or one-time PINs (OTPs) by text.

Sulit Tip: Same playbook, different courier logo. Whether the name on the text is J&T, LBC, PHLPost, Shopee Express, or Flash Express, the structure barely changes: a vague delivery problem, a sense of urgency, and a link that asks for information no courier actually needs by SMS.

Scam Text vs. a Real Courier Message: The Tells

Signal	Fake Delivery Text	What a Real Courier Does
What it asks for	Asks you to click a link and enter banking details, an OTP, or a card number to “release” or “redeliver” your parcel	Never asks for banking details, passwords, or OTPs by text — J&T and PHLPost both say this outright
The link	A shortened or unfamiliar link that doesn’t lead to the courier’s actual domain	Directs you to the official app or a verified courier domain (jtexpress.ph, lbcexpress.com, phlpost.gov.ph)
Sender	A foreign country code or a random mobile number, not a registered business sender ID	Comes from the courier’s own tracking notifications inside its app, or a recognized business sender ID
Urgency	A countdown, a threat the parcel will be “returned to sender,” or language pushing you to act immediately	States a tracking number and a status; no artificial deadline
Payment	Demands an online card payment or GCash transfer for a “redelivery” or “release” fee	Cash-on-delivery is collected by the rider in person — there’s no such thing as an online “release fee” for a parcel already in the courier’s hands

Before you trust any link tied to an online purchase — a delivery text, a seller DM, or a too-good listing — our guide on verifying FDA, PS/ICC, and DTI registration before you buy covers the same verify-first habit from the seller side.

The New Twist: “Quishing” With QR Codes

The delivery-text scam now has a QR-code cousin. In a July 2026 press briefing at Camp Crame, PNP Anti-Cybercrime Group (ACG) chief Maj. Gen. Wilson Asueta warned the public about “quishing” — phishing that uses a malicious QR code instead of a link, per the Daily Tribune’s coverage. Scanning the code redirects the victim to a fake site designed to harvest personal and banking details. Asueta’s warning was pointed: “Hindi lahat ng nakapost na QR code ay inilagay ng authorized owner” (not every posted QR code was placed by its authorized owner) — meaning a QR code taped to a package, a collection counter, or even a legitimate-looking poster isn’t automatically safe just because it’s there.

Heads Up: If a delivery text or a sticker on a package asks you to scan a QR code to “confirm” or “track” your parcel instead of just giving you a tracking number, treat it exactly like a suspicious link — because that’s what it is.

Why This Keeps Growing

This isn’t a fringe problem. A Social Weather Stations survey covering June 20–29, 2026 (1,200 adults nationwide) found that cybercrime victimization among Filipino families rose to 8% in June 2026, up from 5.8% in March — an increase large enough that PNP chief Gen. Jose Melencio C. Nartatez Jr. ordered an intensified anti-cybercrime campaign in September 2026, according to the Daily Tribune. Interestingly, the same period saw traditional crime (robbery, break-ins, carnapping) fall — the shift in criminal activity is moving online, not away entirely.

There’s a sliver of good news buried in the PNP-ACG’s own numbers: online scam cases recorded nationwide from January to June 2026 actually fell to 4,509, down from 5,526 in the same period of 2025 — a drop Asueta credited to public awareness campaigns. That’s the whole point of a guide like this one: the scam texts aren’t getting less common, but more people are learning to recognize them before they click.

Worked Scenario: The Text Arrives Right After You Order Something

Say you ordered a blender on Shopee three days ago during a payday sale. A text arrives: “Your parcel is on hold due to incomplete barangay details. Update now to avoid return: [link].” It’s believable timing — you genuinely have a parcel moving. Here’s how to work through it without guessing:

First, don’t tap the link. Open the Shopee app directly (not through the text) and check your order status there — if there’s a real delivery issue, it will show up in the app, with a real tracking number you can compare. Second, look at the sender: a foreign country code or a number that isn’t a registered business sender ID is an immediate red flag, matching exactly what J&T’s own customers reported in August 2026. Third, remember what legitimate couriers have said publicly: they will never ask for your card number, OTP, or banking password by text to “release” anything already in their possession — PHLPost states this explicitly, and J&T’s “SCAM ITO!” warning said the same in different words.

Good to Know: The SIM Registration Act doesn’t automatically block scam numbers. Per the NTC’s own explanation, it gives telecom companies and authorities a traceable database tied to a number’s registered owner — useful after the fact for investigation, not a shield that stops a scam text from reaching your phone in the first place.

What to Do If You Already Clicked

If you tapped the link but didn’t enter any information, close the page and don’t go back — no information was taken. If you did enter banking details, a card number, or an OTP, call your bank or e-wallet’s fraud hotline immediately to freeze the account or card before anything is withdrawn; speed matters more than anything else at this stage. After that, change the password on any account that shared that OTP, and follow the reporting steps below either way, since your report helps authorities trace the number and warn others.

How to Report a Fake Delivery Text in the Philippines

The National Telecommunications Commission (NTC) promotes a simple method for text scams generally, summarized by its Region 1 legal officer and reported by the Philippine Information Agency: B.I.R.D. — Block, Ignore, Report, Delete.

Block the sender’s number on your phone.
Ignore the message — don’t reply, don’t interact, and don’t click any link inside it.
Report it to the NTC through its online complaint portal at ntc.gov.ph, or by calling the NTC hotline at 1682. You can also report directly to the courier named in the scam text — J&T asks for reports through its official app or Facebook page, and PHLPost’s Inspectorate Department takes reports at isd@phlpost.gov.ph or by calling (02) 8288-7678. If you’ve lost money, report to the PNP Anti-Cybercrime Group at acg@pnp.gov.ph.
Delete the message after you’ve blocked and reported it.

If you’re specifically an actual PHLPost customer dealing with a scam text impersonating them, their 24/7 hotline is 1326, and suspicious links can also be submitted through the eGov PH app.

Also Worth Checking

Fake delivery texts are just one entry point scammers use around online shopping. If you want the fuller picture, our online shopping scams guide covers the other common traps beyond SMS, our Facebook Marketplace scams guide covers the seller side of the same problem, and if you’re past the scam and need to actually get your money back, our step-by-step guide on what to do if you’ve been scammed online walks through the recovery process. And if a scam text has you wondering which courier to actually trust with a real parcel, our Lalamove vs. GrabExpress vs. LBC/J&T comparison breaks down price, speed, and built-in insurance for each. For more of this kind of verify-before-you-click breakdown, head back to more sulit finds.

Verified Sources Used

Interaksyon (PhilSTAR): Confirmed J&T Express Philippines’ August 2026 public warning about scam texts asking customers to “update” delivery information, including the scam’s mechanics and J&T’s official Facebook response.

PhilSTAR Life: Confirmed PHLPost’s official advisory on fake delivery/redelivery-fee texts, including its explicit statement that it never asks for banking details by text, and its reporting channels and hotline.

Philippine Information Agency: Confirmed the NTC’s official B.I.R.D. (Block, Ignore, Report, Delete) method for text scams, its hotline number, and its explanation of what the SIM Registration Act does and doesn’t do against scammers.

Daily Tribune: Confirmed the PNP Anti-Cybercrime Group’s July 2026 warning about “quishing” (QR code phishing), including the official spokesperson quote and first-half-2026 online scam case statistics.

Daily Tribune: Confirmed the Social Weather Stations survey showing cybercrime victimization among Filipino families rising from 5.8% in March 2026 to 8% in June 2026, and the PNP’s resulting intensified anti-cybercrime campaign.