URLVISGuide
How to identify a fake package delivery message
URLVIS Security Team · Last updated: August 25, 2026
A delivery message is likely a scam when it is unexpected, creates urgency over a held parcel, and links to a domain that does not belong to the carrier. Do not use the message link; verify the tracking number in the carrier's official app or on a website you type yourself. Fake delivery notifications are among the most widely distributed phishing lures because they exploit a near-universal experience: almost everyone is waiting for a parcel at some point, and a "missed delivery" message primes people to act without scrutinizing the source. Scammers time mass campaigns to coincide with major shopping seasons — holidays, sale events, and long weekends — when recipients are genuinely expecting multiple packages and are less likely to question an unexpected notification. The typical fake page mirrors a real carrier's branding closely, then presents a small fee — often less than two dollars — to reconfirm a delivery slot or correct an address. The low amount makes entering a full card number, expiry date, and CVV feel routine. In reality, those card details are captured immediately and used for unauthorized purchases or sold. Some fake delivery pages go further and install malware or browser extensions that harvest credentials across other sites. The good news is that the verification step is straightforward: the tracking number either exists in the carrier's real system or it does not. Taking sixty seconds to open the carrier's official app or website and entering the number there is always the right first move.
How to Identify
- Match the message to an order you actually placed. If no retailer in your order history supplied the same carrier and tracking number, treat the alert as unverified.
- Long-press or hover over the link before opening it. Misspelled carrier names, unrelated domains, extra words before the real-looking name, and URL shorteners are strong warning signs.
- Copy the tracking number only, then enter it on the carrier website or app you opened independently. A number that is missing, invalid, or attached to a different shipment does not validate the message.
- Be suspicious of a small redelivery, address-correction, customs, or storage fee. A low amount is often used to make entering a full card number, expiry date, and CVV feel harmless.
- Stop if the page asks for an account password, Social Security number, bank login, or one-time security code. Those details are not needed to reschedule an ordinary parcel.
- Notice pressure such as “final attempt,” a countdown, or a threat to destroy or return the parcel within hours. Verify first; a timer on a webpage is not proof of a carrier deadline.
- Test the surrounding site without entering data. A payment form with broken navigation, copied policies, or no verifiable company address is not a normal carrier service page.
- Be alert to messages that arrive from a standard mobile number rather than a dedicated business shortcode, especially when the sender cannot be verified against the carrier's published communication channels.
- Question any delivery message that combines a tracking alert with a request for personally identifying information such as a national ID, date of birth, or full residential address. Carriers do not require identity verification to redeliver a package.
- Check whether the carrier named in the message matches any carrier you have actually used for current orders. Attackers send mass campaigns without knowing which carrier a recipient uses, relying on the name sounding plausible.
Real-World Examples
The examples below are illustrative only. They do not refer to any real person, brand, or organization and exist solely to show the scam pattern.
Fabricated redelivery text
Fictional example — ParcelTrack Dispatch: We could not deliver item PT-48192. A $1.74 scheduling fee is due today. Review at parceltrack-status.example.
Fabricated customs email
Fictional example — Global Route Desk: Your shipment is on hold. Confirm your address and card details within 6 hours to prevent return.
Fabricated identity-verification delivery page
Fictional example — SwiftReach Courier: To release your parcel, confirm your full name, date of birth, and ID number on our secure portal at swiftreach-id.example.
Sources
Reporting Channels
- United States Postal Inspection Service: Forward USPS-themed suspicious emails or texts to [email protected].
- UK National Cyber Security Centre: Forward suspicious emails to [email protected] or texts to 7726.
- Federal Trade Commission: Report the scam or fraudulent charge through ReportFraud.ftc.gov.
- Report Fraud (UK): Report fraud or cyber crime affecting you in England, Wales, or Northern Ireland.
FAQ
What should I do if I clicked a fake delivery link?
Close the page and do not download anything. If you entered no information, clear any site notification permission and run a device security scan if a file opened. Then find the shipment through the retailer or carrier independently.
What if I entered my card details on the page?
Call the card issuer using the number on the card or in its official app, explain that the details were entered on a phishing site, and follow its advice on freezing or replacing the card. Review transactions and save screenshots of the message and URL.
Can a genuine carrier ask for customs or redelivery fees?
Fees can be legitimate, but an unexpected message is not proof that one is due. Open the carrier site yourself, enter the known tracking number, and confirm the charge there or through an independently sourced customer-service channel.
Does a familiar logo or HTTPS padlock make the page safe?
No. Logos are easy to copy, and HTTPS only encrypts the connection to that domain. Check the exact registered domain and the shipment in a trusted account before providing information.
How do I find a shipment if I have no tracking number?
Log into the retailer's platform where you placed the order. Your purchase history will show the carrier and any tracking number assigned. If a message claims a parcel is held but no matching order appears in your accounts, the message is almost certainly fraudulent.
Why is the fee always so small on fake delivery pages?
A small charge — often under two dollars — reduces skepticism. The real objective is capturing your card number, expiry date, and CVV, which are valuable regardless of the transaction amount. Once entered on a phishing page, those details can be used for unlimited unauthorized purchases or sold on criminal marketplaces.
Related Risks
How This Guide Was Prepared
This guide was compiled from publicly available fraud-reporting sources and URLVIS's own multilingual risk taxonomy; an AI-assisted draft was reviewed before publication. It is for general information only and is not legal or financial advice. Spotted an error or outdated detail? Report it to [email protected].