A package delivery scam is an impersonation scheme in which a message, call, or fake tracking page claims that a parcel needs urgent action. The supposed carrier may ask you to pay a small fee, correct an address, schedule delivery, or sign in, but the real goal is to steal payment details, credentials, personal information, or access to your device.

Key Takeaways

Verify a parcel through the retailer account or a carrier address you obtained independently.

A real-looking logo, tracking number, sender name, or HTTPS padlock does not prove who sent a message.

Do not pay, sign in, call, or install anything through an unexpected delivery notice.

Your response should match the exposure: receiving, clicking, entering data, or downloading a file are different events.

This is one specific form of social engineering. The broader online security guide explains how account, device, network, data, and behavior controls work together.

How does a package delivery scam work?

The scam begins with a believable delivery problem: unpaid postage, an incomplete address, a missed attempt, a customs charge, or a parcel held at a depot. The message creates a short deadline and supplies a convenient link or phone number. That combination encourages you to react before checking whether the parcel exists.

The link often leads to a look-alike carrier page. It may ask for your name and address first, then request a modest redelivery fee. The FTC warns that information entered on such a page, including a card number, goes to the scammer rather than the carrier.［1］

Package themes are effective because many people are genuinely waiting for something, while the sender does not need to know what was ordered. A vague message can coincide with a real purchase by chance. Treat that coincidence as a reason to verify the order, not as evidence that the message is authentic.

Which package delivery text scam lures should you recognize?

Common lures include:

Address correction: the parcel supposedly cannot be delivered until you confirm a street address.
Small fee: a tiny postage, customs, storage, or redelivery charge is required.
Missed delivery: a link claims to reschedule an attempt that never happened.
Tracking update: the message says a parcel is delayed, returned, or waiting for instructions.
Account warning: you are asked to sign in to a retailer or carrier account to prevent cancellation.
Malicious attachment or app: a file, browser extension, or mobile app is presented as a tracking tool.

Text-message versions are often called parcel smishing. The U.S. Postal Inspection Service describes smishing as deceptive text messaging intended to collect personal or financial information and advises recipients not to use an unfamiliar link in an unsolicited tracking message.［2］ A similar pattern can arrive by email, social media, automated call, or messaging app.

How can you verify whether a parcel is real?

Use an independent order trail, not details supplied by the message.

Open the retailer's app or type its known website address yourself.
Find the specific order in your purchase history.
Copy the tracking number from that order, if one exists.
Open the carrier's official site or app independently and enter the number there.
If the order page and carrier disagree, contact the retailer or carrier through a number you already trust.

The FTC specifically recommends checking shipping information through the retail account where you placed the order instead of clicking the delivery text. This test also handles a message that copies a real carrier name: the decisive evidence is a matching order and tracking record reached through a separate route.

Do not use the phone number, QR code, support chat, or search advertisement included in the suspicious notice. A scammer controls those routes. If you search for a carrier, avoid sponsored results and compare the domain with a known statement, app listing, or previous legitimate order email.

What are the red flags of a fake tracking text?

Signal	Why it matters	Safer check
You did not request that tracking update	Unsolicited contact removes an important link to a real order	Check the retailer account directly
The message demands action within hours	Urgency discourages independent verification	Pause and inspect the actual order status
A small fee is required before delivery	The fee can be bait for card and identity data	Ask the carrier through its official channel
The domain is misspelled, shortened, or unfamiliar	Display names and page design are easy to copy	Type the carrier's known address yourself
The page requests an account password or one-time code	A delivery update rarely needs access to unrelated accounts	Close the page and review the relevant account separately
You must install an app, profile, or file	Tracking normally works in a browser or established app	Do not install it; inspect the device if you already did

No single cosmetic detail proves safety. A polished page can still be fraudulent, and an HTTPS padlock only says the connection to that domain is encrypted. It does not establish that the domain belongs to the carrier.

What should you do at each exposure level?

Classifying the event prevents both panic and delay.

You received the message but did not interact

Do not reply or use its link. Save the sender, time, and message if you may report it, then mark it as junk and block it. Verify any real parcel independently. Where supported, forward suspicious texts to your mobile carrier's reporting channel; USPS-related smishing can also be reported through the postal inspection process.

You opened the link but entered nothing

Close the page. Do not download anything or grant notification, profile, extension, or app permissions. Update the browser and operating system, check recent downloads, and remove any permission you accidentally granted. A click alone is not proof that every account is compromised, but it is a reason to watch for follow-up prompts and unusual device behavior.

You entered a password or one-time code

Use the real service from a trusted device. Change the exposed password, sign out other sessions, remove unfamiliar recovery methods and connected apps, and enable MFA. If that password was reused, change it everywhere it was reused, starting with primary email and financial accounts. The response in what to do after clicking a phishing link covers account and device checks in more detail.

You entered card or bank details

Contact the card issuer or bank immediately using the number on the card, statement, or official app. Explain that the details were entered on a fraudulent delivery page, ask whether the payment can be stopped or reversed, and follow its instructions on replacing or locking the card. FTC recovery guidance varies by payment method and emphasizes contacting the provider used to send the money.［3］

You downloaded or installed something

Disconnect the affected device from the network if it is behaving unexpectedly or if you granted broad access. Remove the untrusted app, profile, extension, or file; update security software and run a full scan. Change important passwords from a different trusted device. If the software had administrator or remote-control access, consider qualified technical help or a full reset after preserving irreplaceable personal files.

How should you report a package delivery scam?

Report the message in the app or email service, tell the impersonated carrier through its official fraud channel, and notify the relevant consumer-protection or cybercrime authority in your country. Include the sender, time, message text, destination domain, payment receipt, and what information you disclosed. Do not keep interacting just to gather more evidence.

If money moved, the bank or payment provider is the first operational call; a fraud report does not automatically stop a transaction. Keep case numbers and copies of communications. Be alert for a later caller who claims to be an investigator or recovery agent and asks for another payment.

Summary

A package delivery scam uses a believable parcel problem to obtain money, credentials, personal data, or device access.
Confirm a real order through the retailer and carrier using independently obtained routes.
Urgency, small fees, unfamiliar domains, credential requests, and required downloads are strong warning signs.
Respond according to what happened: no interaction, click, credential disclosure, payment disclosure, or installation.
Contact financial providers quickly, preserve evidence, and report through official channels.

If an actual package arrived without a matching order, use the brushing scam checks for unsolicited goods, which distinguish gifts, mistaken delivery and account orders.

FAQ

Can a scam text know that I am expecting a package?

Sometimes criminals use leaked or purchased data, but often the message is sent broadly and happens to coincide with a real order. A matching delivery window is not authentication. Check the specific order in your retailer account.

Is every unexpected delivery text a scam?

No, but an unexpected message should be treated as unverified. Do not decide from the logo or sender name. Reach the order and tracking record through the retailer or carrier independently.

Is it safe to pay a very small redelivery fee?

Not through a link in an unsolicited message. A small amount may be used to make the request feel harmless while collecting complete card, address, and identity information.

What if the tracking number looks genuine?

A scammer can copy, invent, or reuse a tracking number. Enter the number only on the carrier's official site reached independently, and confirm that its route and recipient context match your real order.

Does an HTTPS padlock prove the carrier page is real?

No. HTTPS protects the connection to the site you opened; it does not prove the operator is the carrier. Verify the exact domain and use a known route to reach it.

Should I reply STOP to a suspicious delivery text?

Do not reply unless you are certain it is a legitimate sender whose messages you requested. Replying to a scam can confirm that your number is active. Use the messaging app's junk-reporting and blocking tools instead.

Can a delivery scam install malware just from a click?

A click does not automatically mean malware was installed, but the page may attempt downloads or request dangerous permissions. Close it, inspect downloads and permissions, update the device, and investigate any unusual behavior.

Can a VPN stop package delivery scams?

No. This scam relies mainly on impersonation and your response to a message. A VPN cannot verify a carrier, prevent you from entering data on a convincing fake page, reverse a payment, or recover stolen credentials.

Disclaimer: This article provides general cybersecurity and consumer information. It is not legal, financial, identity-theft, or professional incident-response advice; contact the relevant provider or authority for your situation.

Sources

Federal Trade Commission — Think that text message is from USPS? It could be a scam — https://consumer.ftc.gov/consumer-alerts/2025/04/think-text-message-usps-it-could-be-scam
United States Postal Inspection Service — Smishing: Package Tracking Text Scams — https://www.uspis.gov/news/scam-article/smishing-package-tracking-text-scams
Federal Trade Commission — What To Do if You Were Scammed — https://consumer.ftc.gov/articles/what-do-if-you-were-scammed

Sources checked 28 August 2026.

Related articles:

What Is a Package Delivery Scam?