Fan Courier and Sameday Fake SMS: How to Spot Delivery Phishing in Romania

Romania's booming e-commerce market relies heavily on delivery services like Fan Courier, Sameday, Cargus, and DPD. Scammers have taken notice. Fake delivery SMS messages claiming packages cannot be delivered, require additional fees, or need address confirmation have become one of the most common phishing attacks in Romania.

These messages are effective because most Romanians regularly order from eMAG, Altex, and other online retailers. If you are expecting a package, a message about a "delivery issue" seems perfectly plausible.

How Fake Delivery SMS Attacks Work

The Basic Scam

1. You receive an SMS: "Fan Courier: Your package could not be delivered. Reschedule here: [link]" or "Sameday: A shipping fee of 4.99 RON is required. Pay here: [link]"
2. The link takes you to a fake website that looks like the courier's official site.
3. You enter your card details to "pay the fee" or "confirm delivery."
4. Scammers capture your card information and make unauthorized transactions.

Common Fake SMS Templates

The OLX Connection

Many fake courier SMS messages are connected to OLX scams. After agreeing to a transaction on OLX, the scammer sends a fake Fan Courier or Sameday link for "payment confirmation." This is the same phishing technique described in OLX scam guides, but specifically using courier branding.

How to Tell Real from Fake

Legitimate Courier Communications

• Fan Courier sends tracking updates via SMS with tracking numbers (AWB). They never request payment through SMS links.
• Sameday communicates through the Sameday app and SMS with easybox codes. Payment is handled at ordering time.
• Cargus sends SMS delivery notifications with tracking details. Additional fees are collected on delivery (ramburs).
• DPD sends tracking SMS with reference numbers.

Red Flags in Fake SMS

1. Shortened URLs (bit.ly, tinyurl) instead of official domains
2. Requests for payment through SMS links — legitimate couriers handle payments through the original retailer
3. Vague references to "your package" without a tracking number or order reference
4. Grammar and spelling errors in Romanian
5. Urgency language — "Package will be returned in 24 hours"
6. Unknown sender numbers rather than branded sender IDs

What to Do If You Receive a Suspicious Delivery SMS

1. Do not click the link. If you are expecting a package, check its status through the official courier website or app.
2. Verify your tracking number. If you ordered from eMAG, check your order status directly on emag.ro.
3. Check the sender. Legitimate Fan Courier messages come from branded sender IDs, not random phone numbers.
4. Report the message. Forward it to your carrier's spam reporting service and report it to CERT-RO.
5. Delete the SMS.

What to Do If You Already Entered Your Card Details

1. Call your bank immediately to block your card.
2. Request a chargeback for any unauthorized transactions.
3. Change your online banking password from a secure device.
4. Monitor your account for several weeks for delayed fraudulent transactions.
5. File a report with Poliția Română (cybercrime division).
6. Order a new card with a new number.

Protecting Your Delivery Information

When sharing delivery addresses, easybox codes, or package tracking details with family members, avoid posting them in group chats where they remain permanently visible. Use LOCK.PUB to create a password-protected note with the delivery details. The recipient views it once, and the information disappears — no permanent record in anyone's chat history.

The Bottom Line

Fake Fan Courier and Sameday SMS messages exploit Romania's love of online shopping. The scammers know you are probably expecting a package, and they use that expectation to trick you into entering card details on fake websites. Remember: legitimate couriers never ask for payment through SMS links. Always verify through official channels, and use LOCK.PUB to share sensitive delivery and payment information securely.