what is in the package and what was declared?
Shutting this down ... sounds like a phishing scam of sorts.