How to spot a delivery scam text or email

Fake delivery messages work because they’re believable: most of us are expecting a parcel at some point. They’re designed to get your card details or personal information, or to get you to install something harmful.

Warning signs

• A small fee to release or redeliver your parcel. A low amount feels harmless, but the real target is your card details.
• Urgency. “Your parcel will be returned today” is meant to stop you from thinking.
• An odd web address. Look closely. Courier names followed by unfamiliar words, or unusual endings, are a warning sign. So are shortened links.
• No tracking number, or a number you don’t recognise.
• A request to install an app or update settings on your phone. Install apps only through your device’s official store.
• A phone number to call about a “held” parcel, especially a number from an ad or search result. Scammers can buy ads that look like helplines.
• You weren’t expecting anything. Though scammers also get lucky with timing, so a message arriving when you do expect a parcel isn’t proof it’s real.

How to check safely

1. Don’t use any link, number or attachment from the message.
2. Find your tracking number in your original order email or receipt.
3. Go to the courier’s website yourself. Type the address, or use our courier directory.
4. Enter the number there. If a payment is genuinely required, it should appear in the official account of the parcel.

If you clicked or paid

Act quickly. It isn’t your fault: these scams are designed to be convincing.

• If you entered card or bank details, contact your bank right away, using the number on your card.
• If you entered a password, change it, and change it anywhere else you used it. Turn on two-step verification.
• If you installed an app, disconnect from the internet, remove the app, and consider getting your device checked. Tell your bank if banking apps are on the device.
• Watch your statements closely, and be alert to follow-up calls that claim to be from your bank’s fraud team.

Scams that start with a phone call

Not every delivery scam arrives as a text or email. Be especially careful if a caller:

• says a parcel in your name contains illegal goods, and threatens you with arrest
• asks you to “press 1” to speak to an agent about a blocked parcel
• asks you to dial a code on your phone to confirm a delivery, because these codes can forward your calls
• asks for an OTP, your bank details or remote access to your phone

Hang up, and check by yourself through the courier’s official website. Our guide to courier scams in India covers these tricks in more detail.

Where to report it

• United Kingdom: forward scam texts to 7726, and scam emails to report@phishing.gov.uk.
• United States: report to the Federal Trade Commission at reportfraud.ftc.gov. USPS-themed messages can also be sent to spam@uspis.gov.
• India: call the 1930 cybercrime helpline, or use cybercrime.gov.in. Read our guide to courier scams in India.
• Elsewhere: look for your national cybercrime or consumer protection agency. Your courier may have its own fraud reporting page too.