₹2 Courier Scam in India: How a Tiny Payment Led to ₹4 Lakh Loss

### How It Works

1. A plausible, low-stakes trigger — "your address needs updating," "your parcel couldn't be delivered" — arrives by message, playing on the fact that almost everyone is waiting on some delivery. 2. A near-zero payment request (₹2) makes the ask feel administrative rather than financial — nobody pauses to scrutinize ₹2 the way they would ₹2,000. 3. The "update" requires installing an APK instead of using the courier's official app or website — the point where device access, not money, becomes the real target. 4. Banking credentials are entered while completing the tiny payment — the APK or linked page captures far more than ₹2 worth of access. 5. Large withdrawals follow within minutes, often before the victim realizes anything is wrong. 6. The stolen money moves through additional layers (in this case, a fuel-card recharge) before reaching its final destination — making it harder to trace and recover.

### Why It Works

• The amount is designed to feel too small to matter. ₹50,000 looks suspicious; ₹2 looks like nothing.
• The real question isn't the amount — it's the access being requested. A ₹2 payment that requires installing an unknown app and entering banking credentials is a much bigger ask than its price tag suggests.
• Courier anxiety is universal and easy to trigger, since almost everyone has a parcel in transit at any given time.
• Layered money movement (through fuel cards, mule accounts, etc.) means your individual loss can quietly become a small piece of a much larger criminal operation — you don't need to know anything about fuel cards for your money to end up there.

### Warning Signs

• An unsolicited message about a delayed or problematic delivery
• A request to pay any amount — however small — to "release" or "update" a parcel
• A link or file asking you to install an APK instead of directing you to an official app/website
• Any request for banking passwords, card PINs, UPI PINs, or OTPs tied to a "delivery" issue
• Pressure ("pay now or the parcel will be returned")

### Reality Check

• Myth: "It's only ₹2, so there's almost no risk." Reality: in this case, ₹2 preceded nearly ₹4 lakh in unauthorized withdrawals. The amount of the request doesn't reflect the actual risk.
• Myth: "A courier app sent as a direct APK file is normal." Reality: it's a major warning sign. Legitimate courier tracking should come through an official app store listing or the courier's own website.
• Myth: "If I didn't share an OTP, I'm safe." Reality: this case involved no OTP — the victim reportedly entered banking credentials directly while using the malicious app.

### What To Do

1. Never install an APK sent through an unsolicited courier message. Use the courier's official app (from the Play Store/App Store) or website to track or resolve delivery issues. 2. Verify independently — check the order directly in the shopping app/website where you placed it, and find the courier info there rather than trusting the message. 3. Treat any request for banking credentials tied to a "delivery fee" as a hard stop, regardless of how small the amount is. 4. If you've already lost money, contact your bank immediately and call 1930 (National Cyber Crime Helpline) or file at cybercrime.gov.in without delay. 5. Preserve evidence before deleting anything — the message, sender number, APK file name, screenshots, and transaction IDs/UTRs.

### Frequently Asked Questions

Can a ₹2 payment really lead to a ₹4 lakh loss? In this reported case, yes — the ₹2 payment wasn't the risk itself; installing the APK and entering banking credentials alongside it was. The small amount was bait to lower suspicion, not the actual transaction that caused the loss.

Why would scammers ask for such a tiny amount? A near-zero amount reduces suspicion and gets the victim to install the app or enter credentials — the actual theft happens through that access, not the ₹2 transaction itself.

Should I ever install an APK sent by a "courier company"? No. Get courier apps only from official app stores or the courier's own website. An APK file arriving through an unsolicited message is a red flag regardless of how convincing the message looks.

Where do I report this kind of fraud? Call 1930 or file at cybercrime.gov.in as soon as possible, and contact your bank immediately to flag any unauthorized transactions.

---

*Sources: The420.in — ₹2 Courier Scam Uncovers Suspected ₹10 Crore Fraud Network, additional coverage via The Times of India. Details of the wider suspected network remain under investigation and are presented as reported.*

AsliReview Tip: Judge a payment request by the access it asks for, not the amount on the screen. A ₹2 charge that wants an APK install and your banking password is asking for far more than ₹2.