Package Delivery Text Scams: The Warning Signs Before You Tap

Almost everyone shops online now, which means almost everyone gets real delivery texts — and that ordinary habit is exactly what a specific scam is built to exploit. A message arrives saying a package "couldn't be delivered" or is "on hold" and asks you to tap a link to resolve it, often for a small fee. It looks plausible for the same reason it works: you probably are expecting something in the mail.

How the scam is built to work

The mechanism has three parts, and each one is doing a specific job. The first is a plausible premise — nearly everyone has a package moving through the postal system or a courier network at any given time, so the message doesn't need to be tailored to you. The second is urgency: the text implies your item will be returned, held, or destroyed unless you act "within 24 hours," which is designed to short-circuit the pause where you'd normally think something through. The third is the ask itself, which is usually small and reasonable-sounding — a redelivery fee of a few dollars, or "confirming your address" — precisely because a small request feels less risky than a large one and is more likely to get a fast, unthinking response.

The link itself typically leads to a page built to look like a shipping carrier's site, where you're asked to enter a card number to pay the "fee." That page exists only to collect payment information, and sometimes a name, address, and date of birth along with it. Some versions skip the payment step entirely and instead push a link that installs unwanted software or harvests your account credentials for services unrelated to shipping.

The tells that give it away

A handful of details separate a scam text from a genuine delivery notice, and once you know to look for them they tend to jump out.

• The sender doesn't match. Real carrier texts usually come from a short code or a consistent, recognizable number tied to a specific shipment you initiated. A scam text often arrives from a random-looking long number, an email address, or a number you've never received a legitimate notice from.
• The greeting is generic. Genuine delivery updates usually reference a tracking number, an order, or at minimum your name as it appears with that retailer. "Dear Customer" or no name at all is a signal.
• The tracking number format is off. Real carriers use consistent tracking number formats. A scam message might use a tracking number that's the wrong length, the wrong pattern of letters and digits, or simply not there.
• There's a payment request at all. Legitimate redelivery after a missed attempt is rarely conditioned on a text-message payment link. If a carrier genuinely needs money from you — customs duties, for instance — it is not typically collected by tapping a link in an SMS.
• The urgency is disproportionate. A real delivery issue doesn't usually carry a same-day countdown. Scam texts lean hard on artificial deadlines because deadlines suppress careful reading.
• The link's domain looks close but wrong. A carrier name with an extra word, a different ending, or a string of random characters in the address is a strong signal, though on a phone the full address is often hidden, which is exactly why tapping is the wrong first move.

Safer verification habits

The single most reliable habit is to never use the link in the text at all. If you think a delivery notice might be real, close the message and go directly to the shipping carrier's website by typing the address yourself, or open the app you already have installed. From there, you can look up the shipment using the tracking number you already have on file — from your order confirmation email, not from the text.

It's worth building the habit of checking your own order history before you check the scam text's claim. If you weren't expecting a package, that alone is a strong reason to be suspicious of any "delivery issue" text, regardless of how official it looks. If you were expecting something, compare the tracking number in the text against the one in your actual order confirmation; a mismatch ends the conversation immediately.

If you're ever unsure, contact the retailer or carrier through a phone number or website you find independently — not one provided in the suspicious message — and ask them directly whether there's an outstanding delivery issue on your account. Reputable carriers can always confirm shipment status through their own official channels without you needing to click anything from an unsolicited text.

What to do if you already tapped

If you tapped the link but didn't enter any information, you can generally just delete the message and move on, though it's reasonable to run a security scan on your device if it's the kind of link that could have attempted a background download. If you entered payment card details, contact your card issuer immediately to flag the transaction and request a new card number — this is faster and more effective than trying to dispute it after the fact. If you entered login credentials for an account, change that password immediately, and change it anywhere else you reused it, since credential-stuffing across sites is exactly what scammers do with harvested logins.

The habit that generalizes

The specific "package couldn't be delivered" wording will keep changing, but the underlying structure — a plausible everyday premise, artificial urgency, and a request funneled through a link you didn't seek out — is worth recognizing on sight. Any message that wants you to act immediately, through its link, about something you didn't initiate, deserves the same response: close it, and go verify independently through a channel you chose yourself.