Courier Parcel Scam Call: Legal Steps Before Paying

The phone rings at 11:14 in the morning. A polite, professional voice introduces itself as "FedEx customer service" or "Mumbai Customs". A parcel booked from your name to Taiwan, the voice says, has been intercepted at the airport. Inside it: five passports, two laptops, MDMA tablets, and a small quantity of synthetic narcotics. The voice reads back your full name, your home address, and the last four digits of your Aadhaar — to "confirm we are speaking to the right person".

Your stomach drops. You did not book any parcel to Taiwan. You have never been to Taiwan. But the caller knew your address. Within five minutes the call is "transferred" to a man in a uniform sitting in a video call, with a "CBI" or "Mumbai Police" logo behind him. He tells you that the matter is now a federal case, and that you are formally under "digital arrest" — not allowed to disconnect, not allowed to talk to anyone, until your name is cleared by transferring funds for "verification".

None of this is real. None of it. This article exists so that you have, in writing, the answer you need at the exact moment the call lands. Read it slowly. Save the link. Send it to your parents.

How the Call Plays Out

The script is repetitive and trained. The opening voice is calm and corporate. It tells you a parcel in your name contains contraband — narcotics, fake passports, child pornography, sanctions-busting goods. The list rotates because different items provoke different fears. A businessman fears MDMA charges; a student fears child-pornography charges; an elderly retiree fears narcotics charges; the script picks one and runs.

The caller then "transfers" you to a second number, sometimes a video call on Skype, Zoom or WhatsApp. The "officer" wears a dark shirt, sits in front of a printed flag and crest, and demands you keep the camera on. He claims you are under "digital arrest" or "house arrest" and threatens that any attempt to disconnect, talk to family, or step out will be treated as obstruction.

The pressure mounts. A WhatsApp arrival of a forged "arrest warrant" or "RBI notice" with your name on it. The "officer" says only one option remains — transfer your savings to a "Reserve Bank of India holding account" so the source can be verified, and the funds will return within four hours after a "court order". The account number he sends is, of course, a private mule account.

The script can run for six, eight, sometimes twelve hours. Some victims have been kept on a video call overnight. The point of the duration is exhaustion — a tired person makes worse decisions than a fresh one.

Why It Is a Hundred-Percent Fake

India has no legal concept called "digital arrest". The Code of Criminal Procedure 1973, and now the BNSS 2023 that replaced it from 1 July 2024, define how arrest, search and seizure work — they involve physical presence, written warrants signed by a Magistrate where required, and proper documentation. No section anywhere allows a police officer to detain a citizen on a video call.

No courier company, customs office, narcotics agency, CBI or police force calls citizens to demand bank transfers. Real intercepts of real parcels do not generate phone calls — they generate written notices delivered by post or in person, with the case number, the seizing officer's name, and the section of law applied. Real summons under BNSS Section 63 (corresponding to the old CrPC Section 61) come on paper, served at your address, with an opportunity to be physically present.

RBI does not have a "holding account" for verification of citizens' funds. RBI does not interact with the public on individual transactions of this kind. The phrase "RBI verification account" is a tell — only the scam uses it.

The caller knows your address because address-and-mobile data is available on dark-web markets after past data breaches. Knowing your name does not validate the call. Knowing your Aadhaar last digits does not validate the call. The legal answer never changes: disconnect.

The Crimes the Caller Is Committing

The IPC and the IT Act, 2000 stack against the scammer.

Section 415 of the IPC defines cheating — fraudulent or dishonest inducement of a person to deliver property or to do or omit something he would not otherwise do, causing him damage in body, mind, reputation or property. Section 420 of the IPC punishes cheating with delivery of property up to seven years' imprisonment.

Section 416 of the IPC defines cheating by personation — pretending to be some other person, real or imaginary. The fake "FedEx agent" pretends to be from the courier company; the fake "officer" pretends to be from CBI, Customs or Mumbai Police. Section 419 of the IPC punishes cheating by personation up to three years' imprisonment.

Section 66D of the Information Technology Act, 2000 — punishment for cheating by personation by using computer resource — fits squarely. The IT Act commentary notes that Section 66D "incorporates all instances of cheating by personation, by using computers and communication devices". A WhatsApp call, a Skype interrogation, a Zoom video are all communication devices and computer resources.

Section 383 of the IPC defines extortion: "Whoever intentionally puts any person in fear of any injury to that person, or to any other, and thereby dishonestly induces the person so put in fear to deliver to any person any property or valuable security…" — and Section 384 punishes it. The Supreme Court in Romesh Chandra Arora (1960) 1 SCR 924 confirmed that the threat-money pattern is the textbook of extortion. A demand to transfer money to "clear your name" is exactly that.

Section 506 of the IPC for criminal intimidation is also attracted — the threat of arrest, jail and family humiliation is a clear threat of injury to person and reputation. Where the message says "your name will appear in the news tomorrow if you do not pay", Section 506 is a perfect fit; the parallel online-harassment and threat framework walks through that section in detail.

Section 66C of the IT Act for identity theft applies whenever the scammer makes use of "the electronic signature, password or any other unique identification feature" — which is precisely what happens when he extracts your Aadhaar, PAN, or banking credentials.

Five Things You Must Not Do on the Call

1. Do not pay. No genuine police, customs, RBI, narcotics or CBI officer ever asks for a bank transfer. Treat any such demand as proof the call is fake.
2. Do not download apps. If the caller asks you to install Skype, AnyDesk, TeamViewer, QuickSupport, RustDesk or "a verification tool", refuse. The moment you install, your phone is theirs.
3. Do not share OTP, UPI PIN, CVV, password or net-banking login. Not even a single OTP. Not even one digit of one PIN.
4. Do not stay on the call. The whole script depends on keeping you isolated. Disconnect. The "digital arrest" has no legal existence. Disconnecting is not a crime.
5. Do not log into your bank app while the call is active. If the scammer can see your screen, he can move money in seconds. If you must check anything, do it after the call ends and from a different device.

What to Do Instead — Step by Step

Disconnect first. Take three breaths. Then:

Note the caller's number. Take a screenshot of the call log. Note the time, the duration, the platform (regular call, WhatsApp call, Skype). If the caller sent any "warrant", "notice" or "verification document" by WhatsApp, do not delete the chat. Screenshot every message.

Call 1930. Even if no money was lost. The Citizen Financial Cyber Fraud Reporting and Management System logs the attempt and adds your data point to the cluster. Many gangs are caught through aggregation of multiple complaints from different victims about the same number.

File on cybercrime.gov.in. Lodge a complaint with details of the call, screenshots of any messages, the caller's number, and a typed timeline. Save the acknowledgement number.

Walk into a police station. File an FIR under IPC Sections 419, 420, 384, 506 and IT Act Sections 66, 66C, 66D — even if you did not transfer any money. The threats themselves are cognizable offences. Insist on registration; you have already armed yourself with the legal authority above.

If you did transfer money, do all of the above plus call the bank's verified helpline (printed on the back of the card or inside the official app — never from Google), block all cards, freeze net banking and UPI, and write a same-day dispute to the bank's nodal officer. The Reserve Bank of India's circular on customer protection limits customer liability where prompt reporting is shown.

FIR, 1930 and Cyber Cell

The FIR is the formal step that starts a criminal investigation. Under BNSS Section 173 — the new procedural law that replaced CrPC Section 154 — every information relating to the commission of a cognizable offence must be reduced to writing by the Station House Officer. The cyber-portal acknowledgement is not the FIR; the police record is.

If the SHO says "the caller is not in our jurisdiction, go elsewhere", insist on a zero-FIR. The BNSS expressly recognises FIR registration "irrespective of the area where the offence is committed". The classical authority on what constitutes an FIR — Soma v State of Gujarat AIR 1975 SC 1453 — held that the earliest information given to the police, which sets the investigation in motion, becomes the FIR. The zero-FIR is exactly that.

If the SHO refuses, escalate. BNSS Section 173(4) — corresponding to the old CrPC Section 154(3) — entitles you to send the substance of the information by post to the Superintendent of Police. If the SP also fails, file a private complaint before the jurisdictional Magistrate under BNSS Section 223 (old CrPC Section 200) and request investigation under BNSS Section 175(3) (old CrPC Section 156(3)). Indian courts have repeatedly upheld this fall-back route.

If the case has cross-state or international elements — money moved out via mule accounts to a foreign exchange — the investigation typically routes through the cyber cell and the Indian Cyber Crime Coordination Centre. Your local FIR remains the foundation document.

Privacy Hygiene to Stop the Next Call

The reason the scammer reached you is that your phone number, name and address are sitting in a leaked database somewhere. You cannot delete what has already leaked. You can stop adding to it.

• Stop putting your phone number on public business directories, classified ad portals, comment sections and WhatsApp groups of strangers.
• Maintain two SIMs — one for banking and government KYC, one for sign-ups and casual use. Give the casual one to delivery agents, OTPs of one-off services, and wifi sign-ups in malls.
• On WhatsApp, restrict "Last Seen", "Profile Photo" and "About" to "My Contacts" only. Disable "Read Receipts" if you prefer.
• Use the Department of Telecommunications' Sanchar Saathi portal to check connections issued in your name and to disconnect any you did not take.
• Lock your Aadhaar biometrics on the UIDAI portal. Unlock only when you actually need an Aadhaar-authenticated service.
• Freeze your CIBIL through the official credit-bureau portal so no one can take a loan against your KYC. Unfreeze only when you yourself want a loan.

None of this guarantees zero scam calls. All of it shrinks your exposure, and shifts the odds.

When to Bring in a Lawyer

Most people who receive this call do not need to hire a lawyer. They need to disconnect, file 1930 and the FIR, and sleep. The legal team at Pinaka Legal handles the cases where it does become messy — where money was actually transferred and the bank is stalling, where a police station is reluctant to register the FIR, where a Magistrate complaint is needed, or where Aadhaar and PAN were extracted and a fraudulent loan has been taken in the victim's name. One folder, one timeline, one lawyer reading every paper.

What Should I Actually Do Now?

It Is Not Your Fault — and You Are Not Alone

The courier-parcel scam is engineered by full-time professional gangs running scripts trained on thousands of victims. People with PhDs have fallen for it. People with decades of corporate experience have fallen for it. People who would never give their bank details to a stranger have transferred lakhs because the script targeted exactly the fear that paralyses a careful adult — being publicly named in a criminal case.

If a call like this lands on your phone, recognise it for what it is, disconnect, and reach for the steps above. If you have already paid, do not let shame stop you from filing 1930 and the FIR — silence helps the gang, not you. Reporting protects the next victim too, because cyber cells genuinely use the data to build cases against the call-centre operations.

Frequently Asked Questions

A caller said my parcel has narcotics and the CBI will arrest me — is this real?

No. This is a well-documented courier parcel scam call legal steps situation. No genuine courier company calls a customer to say a parcel was intercepted with drugs. No real CBI, Customs, Mumbai Police or Narcotics Control Bureau officer will ever speak to you on a video call from a hotel-room background, ask for bank transfers, or demand that you stay on a Skype interrogation. Disconnect the call. The threat is illegal extortion under Section 384 of the IPC and cheating by personation under Section 66D of the IT Act, 2000.

They asked me to transfer money for verification — should I?

No. Under no Indian law does any police agency ask you to transfer money for verification, refund, or to clear your name. The Code of Criminal Procedure 1973 and now the BNSS 2023 lay down clear procedures for arrest, search and seizure — none involve a phone-banking transfer to a private account. Treat any such demand as the textbook ingredient of extortion under Section 383 of the IPC, punishable under Section 384. Cut the call, do not pay, do not move money to any new account, and do not log into your bank app while the caller is watching your screen.

The caller knew my full name, Aadhaar last digits, and address — how?

From leaked databases. Personal data — name, address, mobile, partial Aadhaar or PAN, even bank-card-last-four — is available on dark-web markets after data breaches. The scammers buy a list of a few thousand contacts, run a script, and the caller reads back two or three real-looking details to create a feeling of authenticity. The fact that the caller knows your details does not mean the call is real. It only means somebody, somewhere, has had a bad week with their data security. The legal answer remains the same — disconnect, file a 1930 complaint, file an FIR.

What is a Skype interrogation in this scam?

It is a fake video call set up to make the victim believe she is being formally interrogated. The scammer wears a dark uniform-looking shirt, sits in front of a printed background of a 'police' or 'CBI' logo, and demands that you stay on the call without speaking to anyone, with the camera on, for hours. The intent is to isolate you from family or friends who would tell you it is a scam. No Indian investigation agency conducts interrogations over Skype, Zoom or any video app. Hang up. Walk into a real police station instead.

What sections will the police register for a courier parcel scam call legal steps FIR?

A typical FIR will cite cheating under Section 420 of the IPC; cheating by personation under Section 419; criminal intimidation under Section 506; extortion under Section 384 if money was actually transferred under threat; and from the IT Act 2000, Section 66D for cheating by personation by computer resource and Section 66C for identity theft if Aadhaar, PAN or password details were misused. Where digital records were forged — fake arrest warrant images, fake notices — Sections 468 and 471 of the IPC for forgery and use of forged document also fit.

I already paid — can I get my money back?

Possibly, depending on speed. Call 1930 immediately — the Citizen Financial Cyber Fraud Reporting and Management System pushes a freeze request to the receiving bank. If the money is still in the receiving account when the freeze lands, it is held; a Magistrate can later release it back to you under BNSS Section 503. Reporting within the first hour gives the highest recovery rate. Beyond a day, mule accounts are usually empty. Even then, the FIR keeps the criminal case alive and protects you from later allegations that you participated in a transaction voluntarily.

I gave my Aadhaar and PAN on the call — what should I do?

Lock your Aadhaar biometrics on the UIDAI portal and freeze your CIBIL through the official credit-bureau portal so no one can take a loan in your name. File the 1930 complaint and the FIR specifying that Aadhaar and PAN were extracted under fraud — this becomes Section 66C of the IT Act for identity theft. Watch your bank, mutual fund and credit-card statements daily for two months. If a loan or credit appears in your name that you did not take, dispute it in writing with the lender quoting the FIR copy.

What evidence should I save?

Save everything. The call log entry showing the caller's number, the duration and time. WhatsApp screenshots of any 'arrest warrant' or 'notice' the caller sent. The Skype or video chat history. Any voice recordings — Indian law allows recording your own calls. Bank statement showing transfers, with reference numbers. SMS alerts. Email these to yourself the same day so an independent server timestamp exists. Indian courts admit electronic records under Section 65B of the Evidence Act with a certificate identifying the device and asserting it was working properly when the records were captured.

Will the police actually catch the scammers?

Eventually, often. Many of these calls originate from organised gangs operating out of identifiable cities or even from across the border. Cyber cells and the Indian Cyber Crime Coordination Centre regularly bust such call-centres after pattern aggregation. Identification of the controlling fraudster takes weeks to months, but does happen. Your individual complaint adds one data point to the cluster. Even when the controlling gang sits abroad, the mule accounts and SIM cards used inside India are traceable, and several arrests are made downstream.

How do I avoid this kind of call?

Limit your phone-number exposure online. Stop putting your number on public business directories, comment sections, classified ad portals and unsealed forms at receptions. Use your alternate or spam number for one-off sign-ups. On WhatsApp, set 'who can see my profile photo and last seen' to contacts only. Register on the Department of Telecommunications' 'Sanchar Saathi' portal — it lets you check and de-link mobile connections issued in your name without consent. None of this guarantees zero scam calls, but it shrinks the surface.

What if the police refuse to register the FIR because I did not lose money?

They are still bound to register it. The threats themselves — telling you a parcel has narcotics, that the CBI will arrest you, demanding bank transfer — are a cognizable offence even before any money moves. Section 506 of the IPC for criminal intimidation, Section 419 for cheating by personation, and Section 66D of the IT Act for cheating by personation using a computer resource are all triggered by the call itself. Insist on FIR under BNSS Section 173. If they refuse, escalate to the Superintendent of Police under BNSS Section 173(4), then to the Magistrate under BNSS Section 223 and 175(3).

Should I tell my family or keep it private?

Tell your family. The whole script of this scam depends on isolating the victim — 'do not tell anyone, your name will be cleared by tomorrow morning'. Breaking that isolation breaks the scam. Many victims who realise mid-call walk into the next room, tell a spouse or a child, and the second pair of eyes immediately recognises the pattern. There is no shame in being targeted by a professional fraud script. Reporting it openly also helps relatives, neighbours and elderly parents avoid the same call when it lands on their phones.

For more articles on Indian law, visit the Pinaka Legal Blog. For queries, call +91 8595704798 or email info@pinakalegal.com.