A package delivery message can look routine while leading to a fake tracking page, a payment form, or a credential-stealing login screen. This guide explains how to check unexpected delivery texts, emails, QR codes, and missed-delivery notices without clicking first, how to distinguish useful carrier information from pressure tactics, and what to do if you already opened a link or paid a fee.
Overview
A package delivery scam usually begins with a message about a shipment you may or may not be expecting. The sender might claim that an address is incomplete, a delivery needs to be rescheduled, a customs or handling fee is due, or a package will be returned unless you act immediately. The message may use a carrier’s name, logo, colors, or a shortened link to appear legitimate.
The safest answer to “Is this a scam?” is not based on appearance. Verify the shipment through a channel you choose yourself. Open the retailer’s app or website by typing its address, review your order history, and use the carrier’s official website or app if a tracking number is available. Do not rely on the phone number, web address, QR code, or reply option supplied in the unexpected message.
Delivery scams are often designed to collect one or more of the following:
- Payment-card details for a small delivery, redelivery, or customs charge.
- Account passwords through a fake carrier or retailer login page.
- Personal information such as an address, date of birth, or government identifier.
- One-time security codes used to access an account.
- Permission to install software or call a fraudulent support number.
A message can be fraudulent even when you are genuinely waiting for a package. Scammers commonly use broad delivery themes because many people have recent online purchases. Treat the notification and the order as separate questions: first verify that the message is authentic, then verify the shipment independently.
What to track
Before interacting with a delivery notification, compare its details with information you already trust. The following table highlights useful differences, but no single sign proves that a message is genuine or fraudulent.
| Message feature | More consistent with a legitimate notification | Warning signs of a delivery scam |
|---|---|---|
| Shipment context | Matches an order you can see in a retailer account or a shipment you arranged. | You do not recognize the order, sender, tracking number, or delivery address. |
| Link or QR code | Can be ignored while you verify the shipment in the carrier’s app or manually entered website. | Uses a shortened, misspelled, unfamiliar, or lookalike domain and demands an immediate click. |
| Payment request | Any charge is independently confirmed through the retailer, carrier, or official account you opened yourself. | Requests card details, gift cards, cryptocurrency, payment-app transfers, or an unusual fee through the message. |
| Urgency | Provides information without threatening immediate loss or demanding a rushed response. | Claims the package will be destroyed, returned, or seized unless you pay or confirm details now. |
| Personal information | Does not ask for sensitive data merely to view ordinary tracking information. | Requests a password, one-time code, full payment details, or unnecessary identity information. |
| Missed-delivery notice | Can be checked against a delivery attempt you expected and verified through an official channel. | Includes a surprise reschedule fee, a QR code, or a link to “release” a package. |
Track the exact sender address or phone number, the displayed link text, the destination domain after inspection, the wording of the request, and whether the message matches a known order. Sender identity alone is weak evidence: phone numbers and email addresses can be spoofed, copied, or made to resemble a familiar organization.
Look for fake website signs such as a domain that adds extra words, substitutes characters, uses an unrelated top-level domain, or sends you through several redirects. A padlock or encrypted connection does not prove that a website is operated by a carrier. If you need a second opinion, preserve the message and use an online scam checker workflow rather than submitting information to the suspicious page.
Cadence and checkpoints
Use this short verification routine every time an unexpected delivery message arrives:
- Pause. Do not click, scan, reply, call the number in the message, or open an attachment. Urgency is a reason to verify, not a reason to hurry.
- Record the basics. Note the sender, time, claimed carrier, tracking number, requested action, link domain, and payment method. A screenshot can help with reporting, but avoid forwarding the message widely.
- Check your orders independently. Type the retailer’s address yourself or use its official app. Confirm whether an order exists, which carrier is handling it, and whether the tracking number matches.
- Verify through an official route. Navigate manually to the carrier’s known website or app. Enter the tracking number there, or contact the retailer using contact details from your account or receipt.
- Inspect the request. Be especially cautious if the message asks for a password, one-time code, card number, gift card, cryptocurrency, payment-app transfer, or a fee unrelated to information shown in your verified order.
- Report and delete. Use your phone’s spam-report function, your email provider’s phishing-report option, and the carrier or retailer’s official abuse channel when available. Do not use a reporting link supplied by the suspicious message.
For a text scam, avoid replying even with “STOP” unless you have independently confirmed that the sender is a legitimate service using a trusted account. A response can confirm that your number is active. For email, do not download attachments or enable macros while investigating. For QR codes, remember that scanning can open a website immediately; inspect the destination on a separate, trusted device or avoid scanning altogether.
If you entered a password, change it from the real service’s website and change it anywhere else you reused it. If you supplied payment details, contact the card issuer or financial institution using the number on the card or a verified statement. If you installed software, disconnect the device from sensitive accounts and seek trusted technical assistance. The post-scam recovery checklist covers additional steps for accounts, payments, and reporting.
How to interpret changes
Delivery scam messages change their wording and appearance frequently, but the underlying pattern is usually stable: an unexpected problem, a request for sensitive information or payment, and pressure to use the message’s link or contact details. Do not treat a polished design, correct logo, familiar carrier name, or accurate address as proof of authenticity.
Pay attention to changes in the claimed event. A message that first asks you to confirm an address and then requests a payment is more suspicious than a simple status update. A fee request that appears only in a text, but not in the verified retailer or carrier account, should not be paid. Likewise, a tracking number that produces no result through the official carrier channel is a reason to stop, although a delayed system update can also occur. Resolve that uncertainty through the retailer or carrier—not through the suspicious message.
Keep a small record of recurring patterns in your household or organization: common sender names, fake domains, delivery seasons that produce more messages, and the payment methods requested. Technology teams can preserve message headers, URLs, and timestamps in a safe evidence folder while ensuring that links are not opened on production devices. If a message resembles a broader phishing campaign, review the phishing email triage playbook for a structured response.
When to revisit
Revisit this guide whenever you receive an unexpected package message, place an order with a new retailer, or see a new delivery theme such as a QR-code notice, missed-delivery alert, address-confirmation request, or customs-fee demand. It is also useful to review your household or workplace verification steps monthly or quarterly, especially before periods when online ordering increases.
Editors should refresh this article when major carriers change their notification practices, official tracking domains, payment procedures, or reporting routes. Readers should independently confirm those details through the carrier’s current website or app rather than relying on an old list of domains. If you are unsure whether a request is connected to a bank, retailer, or payment service, use the relevant bank text scam guide or marketplace and payment app checklist.
The practical rule is simple: do not pay, log in, scan, or provide information from an unexpected delivery message. Verify the order independently, use a trusted route to reach the carrier, report the suspicious communication, and then remove it. That routine remains useful even when the wording, logo, sender, or delivery story changes.
