EN
In a Nutshell
Every year, government agencies like the FBI’s Internet Crime Complaint Center (IC3) record hundreds of thousands of complaints related to phishing and smishing. Whether it is a text from "USPS" claiming a warehouse hold or a "fake DHL SMS" regarding customs, these messages are timed to coincide with global shopping habits. One wrong click can expose your financial identity to sophisticated fraud networks.
The delivery notification scam typically follows a three-step process: the bait, the hook, and the harvest.
Scammers use automated scripts to send millions of messages, knowing that even a tiny success rate yields massive profits. For more on how these domains are set up, you can check Scamadviser’s guide on identifying fake websites.
Scammers hide behind global giants like DHL, FedEx, UPS, and Royal Mail. In the United States, the "USPS phishing text" remains the most common threat. Criminals use high-definition templates to ensure their fake sites are indistinguishable from real ones. Treat every notification with skepticism—even if you are expecting a package.
Real couriers do not send random texts to people who are not in their active tracking system. If you aren’t expecting a delivery, it is almost certainly a scam. Trust your memory of recent purchases over a random notification.
While some scams use leaked data to personalize messages, many still rely on "Dear Customer" or "Valued User." Authentic companies usually have your name on file. Furthermore, if a text asks you to "click to see details" without providing a valid tracking number upfront, it is a trap.
The link is the most dangerous element. Scammers use URL shorteners or "look-alike domains" (e.g., fedex-parcel-update.net instead of fedex.com). Always hover over a link on a computer or long-press on mobile to see the actual destination.
Most legitimate services handle fees at the point of purchase. They will not hold a package hostage for a small "holding tax" via a text link. This small amount is a psychological trick to lower your guard; they are after your full credit card profile, not just a few dollars.
Phrases like "Action required within 4 hours" or "Final notice before return" are social engineering tactics. Real delivery delays rarely result in immediate package destruction. If a message makes you panic, it is designed to bypass your logic.
Many scams still feature pixelated logos or odd phrasing like "Your parcel is being holden." Professional corporations have rigorous quality control; a single typo is a major red flag that the message is fraudulent.
Official alerts usually come from 5 or 6-digit short codes. If an alert comes from a standard 10-digit mobile number or an international country code you don't recognize, it is likely a burner phone or a spoofed number.
Forward suspicious texts to 7726 (a free service in many countries). You should also report the attempt to the Federal Trade Commission (FTC) or your local equivalent. Reporting helps authorities track and shut down the infrastructure scammers use.
Frequently Asked Questions (FAQ)
Q: Can I get a virus just by opening the text message?
A: Simply opening the SMS is generally low risk. The danger lies in clicking the link, providing information, or downloading any "tracking app" attachments.
Q: I’m expecting a package and got a text. How can I be sure?
A: Never use the link in the text. Copy the tracking number and paste it directly into the search bar of the official website. If the number doesn't work there, the text is a scam.
Q: Does a "https://" at the start of a link mean it's safe?
A: No. Almost all phishing sites now use HTTPS to show the "padlock" icon. It only means the connection is encrypted, not that the site is legitimate.
Q: Why do scammers ask for such a small fee?
A: A $1.00 or $2.00 fee feels low-risk to the victim. However, once you enter your card details, the scammer uses them for much larger, unauthorized purchases.
Adam Collins is a cybersecurity researcher at ScamAdviser who operates under a pseudonym for privacy and security. With over four years on the digital frontlines and 1,500+ days spent deconstructing thousands of fraud schemes, he specialises in translating complex threats into actionable advice. His mission: exposing red flags so you can navigate the web with confidence.
