You weren’t expecting a package, but the text looks routine enough: a delivery attempt failed, a small fee is due, click here to reschedule. Maybe you did order something recently and can’t remember what. So you tap the link. That half-second of doubt is the entire scam.
Fake delivery texts, often called smishing (phishing over SMS), are a scam you’re likely to run into sooner or later, and they keep working because they’re built around something almost everyone does: order packages and glance at their phone without much thought. Here’s how the scam actually works and what a real shipping notice looks like by comparison.
Why this scam works so well
Delivery texts succeed because they don’t ask you to believe anything unusual. Nobody’s shocked to get a text about a package. There’s no elaborate story, no fake lottery win, no distant relative needing money wired overseas. It’s mundane, and mundane doesn’t trigger suspicion the way an outlandish claim does.
There’s also a built-in excuse for urgency. Real carriers do sometimes need action, like paying customs fees or rescheduling a missed delivery, so a message that says “act within 24 hours or your package will be returned” doesn’t sound like a scam script. It sounds like logistics.
And the volume game favors scammers. Most people have something in transit at any given time between online shopping, subscriptions, and gifts. Send enough of these texts and a share of recipients will have a real package they’re half-expecting, which makes the fake one land at exactly the right moment.
What the scam usually looks like
The details change, but the pattern is consistent enough to spot once you know what to look for.
A vague delivery problem. The text says a package couldn’t be delivered because of an incomplete address, a missed attempt, or an unpaid customs fee. It rarely names the retailer or the specific item.
A sense of urgency. You’ll often see a short deadline: respond within a day or two or the package gets returned to sender. That pressure is designed to get you clicking before you think it through.
A link that isn’t quite right. The link might use a shortened URL, a domain that resembles the real carrier but isn’t (an extra word, a different ending, a misspelling), or a generic-looking address with no connection to the shipping company at all.
A request for personal or payment information. Once you land on the fake page, you’re usually asked to “confirm your details” or pay a small redelivery fee. That page exists to harvest your name, address, and card number, not to reschedule anything.
A generic greeting. Real carriers that text you usually reference an order or tracking number tied to an actual purchase. Scam texts tend to stay vague because they’re sent to thousands of numbers with no idea what, if anything, each person ordered.
If a text hits several of these points at once, treat it as suspicious until proven otherwise. That’s the same instinct worth applying to unexpected messages on any platform, not just SMS. If you want a broader rundown of the same red flags applied to social media, How to Tell If a Direct Message Is a Scam Before You Click Anything covers similar ground.
How to verify a real delivery notice
You don’t have to guess. There’s a reliable way to check whether a delivery text is legitimate that doesn’t involve clicking anything in the message itself.
- Go straight to the source. Open the carrier’s official app or website directly, or use the retailer’s order tracking page, and enter your tracking number there instead of through the link in the text.
- Check your actual orders. If you can’t match the message to a recent purchase, that’s a strong signal on its own. Real delivery problems are tied to real orders.
- Look at the sender number. Legitimate carrier texts often come from a consistent short code. That’s not proof of anything by itself since numbers can be spoofed too, but wild inconsistency is a clue.
- Call customer service using a number you look up yourself, not one provided in the text, if you want to confirm a charge or delivery issue by phone.
- Never enter payment details on a page you reached by tapping a link in an unexpected text. Real carriers essentially never require a small fee via text link to release a package.
The common thread in all of this: verify through a channel you already trust, not through anything the suspicious message hands you. That one habit closes off almost the entire scam.
What happens if you tap the link
Not every fake delivery link leads to the same outcome, which is part of why this scam is worth taking seriously even though it looks minor.
Some links lead to a page designed to collect your personal information and payment details directly, the classic phishing outcome. Others attempt to install malicious software on your phone, particularly if you’re prompted to download an app or approve a permission you weren’t expecting. Some simply confirm that your number is active and attentive, which puts you on a list for more scam attempts later, delivery-themed or otherwise.
None of these outcomes are catastrophic on their own in the way a full account takeover might be, but they compound. A phone that’s collected a few pieces of malware or a number that’s been sold between scam operations becomes a soft target for the next attempt, which is one more reason why you should turn on automatic updates, even the ones that feel like they always pop up at the wrong time. Updates patch the vulnerabilities these scam pages sometimes try to exploit.
If you already tapped the link
It happens, and it doesn’t mean anything catastrophic has occurred. What matters is what you do next.
If you entered payment information, contact your card issuer or bank right away to flag the transaction and consider a replacement card. If you entered a password you use elsewhere, change it on every account where you reused it, and turn on two-factor authentication if you haven’t already. If the page prompted an app install or a permission approval, check your phone’s recently installed apps and remove anything you don’t recognize.
If you’re worried the incident might connect to a broader account compromise, especially your email, What to Do if Your Email Account Gets Hacked walks through the recovery steps in order. And if you later get an official notice that your information was part of a breach tied to this or any other incident, A Plain-Language Guide to Data Breach Notifications explains what that notice actually means and what to do about it.
A habit worth keeping
Delivery scams thrive on a moment of low attention, a quick glance at a phone between other tasks. The fix isn’t constant suspicion of every text; it’s a short pause before clicking anything that asks you to act fast about a package, a fee, or an account problem. Check it the way you’d check a stranger at the door: through a window you trust, not the one they’re holding open for you.
A quick safety note
This article is general information, not professional security, legal, or medical advice. No single tool or setting makes anyone completely safe; security works in layers. If you are dealing with a live incident, such as active fraud, ransomware, or a child in danger, contact the appropriate professionals or authorities. For a threat to a child, report it to the NCMEC CyberTipline at report.cybertip.org and to local law enforcement.
