Amazon Delivery OTP Scam in India 2026: Why You Never Read an OTP Over the Phone

You ordered a phone case on Amazon three days ago. This morning your phone rings: a polite voice says he’s calling from the Amazon delivery team, your parcel is out for delivery, but there’s a problem with the address. To fix it — or cancel the order, or reschedule, the story varies — he just needs the OTP that has been sent to your phone. And right on cue, an SMS arrives with a six-digit code. It all lines up: you really do have an order, the SMS really is from Amazon, the caller knew before the message landed. You read out the code.

Here’s what actually happened. The caller was on the Amazon sign-in page with your phone number typed in. The SMS was a login OTP for your own account. By reading it out, you walked him through your front door — saved cards, delivery addresses, order history, and the ability to buy whatever he wants before you can react.

The delivery OTP scam is one of the fastest-growing phone frauds in India because it borrows credibility from a real Amazon security feature that most shoppers have used but few fully understand. This guide explains how the genuine delivery OTP works, walks through the three scam variants built on top of it, and gives you the three signals that catch every one of them.

How the real delivery OTP works

For certain shipments — typically higher-value items — Amazon India adds a one-time password step to delivery. Before the parcel arrives, the OTP appears in your Amazon app (under Your Orders → Track package) and by SMS. When the delivery agent reaches your door, you tell them the code in person, they enter it in their device, and the delivery is marked complete. It protects both sides: parcels can’t be marked “delivered” without reaching you, and agents can’t be blamed for parcels they genuinely handed over.

That is the entire legitimate use of a delivery OTP. Note what’s absent from it:

• No phone call is ever part of the flow. The OTP is spoken face-to-face at your door, to a person holding your parcel.
• The OTP is never needed to cancel, reschedule, or verify anything. Cancellations happen in the app with no code at all.
• Amazon customer service never asks for it. They can see your order status without it.

Every scam variant below works by inventing a reason for the OTP to travel over a phone call. The moment a code leaves your mouth on a call, it’s doing something other than confirming a delivery.

The three variants of the scam in 2026

Variant 1 — the order-problem call. The most common, and the one in the opening. The caller knows you have an order in transit (sometimes from a leaked courier datasheet, sometimes by guessing — tens of millions of parcels move daily, so “your Amazon order has an address problem” lands on someone with a live order more often than you’d think). The “fix” requires the OTP just sent to your phone. That OTP is a login or password-reset code for your own account, triggered by the scammer in real time. Read it out and the account is theirs.

Read the SMS the scammer is racing past. It says login. It says do not share. The scam depends entirely on you hearing the caller’s story instead of reading the message in your own hand.

Variant 2 — the COD parcel you never ordered. A courier arrives with a cash-on-delivery parcel addressed to you — usually a cheap item, billed at ₹299–₹999. Many people pay, assuming someone in the family ordered it. The real play comes the next day: a call apologising for the “wrongly dispatched” parcel and offering a refund. The refund is processed through a UPI collect request (you approve it and money leaves your account — the same mechanics as the PhonePe collect-request scam) or through an OTP that opens an account somewhere. The parcel was the bait; the refund call is the scam.

Variant 3 — the failed-delivery SMS with a link. No call at all this time: an SMS claims your delivery failed and asks you to “reschedule” through a link, usually with a token fee of ₹5–₹50. The link leads to a card-harvesting page dressed up in Amazon’s colours. The fee is irrelevant — the page exists to capture your full card details, and the small amount keeps your guard down. Amazon redelivery is free and arranged inside the app; no legitimate courier charges a rescheduling fee by SMS link.

The three signals that catch every variant

If you’ve already shared an OTP

1. Change your Amazon password immediately — app → Your Account → Login & Security. Then use “Sign out everywhere” (or sign out all devices listed) so any session the scammer opened is killed.
2. Check Your Orders and Your Payments. Look for orders you didn’t place, gift card purchases, and new addresses. Report anything foreign through the app’s own “Report something suspicious” flow.
3. If money moved, call 1930 within the hour. The national cyber-financial-fraud helpline can in some cases freeze the receiving account if you report the same day. Follow up with a written complaint at cybercrime.gov.in.
4. If card details were entered on a link, block the card through your bank’s app or 24x7 hotline before anything else. A blocked card beats a disputed transaction.
5. Report the caller’s number through the Chakshu facility on sancharsaathi.gov.in — the Department of Telecommunications’ portal for reporting fraud calls and SMS. It feeds the SIM-blocking pipeline.
6. Preserve everything — the SMS, the call log, screenshots of any transactions. The complaint process will ask for them.

The respectful reality about Amazon and its delivery network

None of this is a failure of Amazon’s systems. The delivery OTP is a genuinely good security feature — it exists precisely because marking parcels “delivered” without proof created disputes for both customers and delivery agents. Amazon’s own guidance is consistent and clear: OTPs are for the doorstep, customer service never asks for them, and order issues are handled in the app.

What scammers exploit is the gap between using a feature and understanding it. Millions of people have read an OTP to a delivery agent at their door; the scam call simply moves that familiar ritual onto the phone, where it means something completely different. The same playbook targets Flipkart, Myntra, and every courier brand in India — the brand name changes, the OTP mechanics don’t.

Three rules cover all of it: the delivery OTP is for the doorstep only, read the OTP message before the caller’s story, and verify every “order problem” in the app. None of them require you to out-argue a professional script-reader — they just require you to hang up first and check second.