In short
Got a text saying your parcel is on hold until you pay a small fee? See how fake delivery texts work, the red flags, and what to do if you tapped.
Top warning signs: The fee is tiny; The link isn't the courier's real website; A deadline.
First thing to do: Don't tap the link. If you want to check, open the courier's official app or type their website address yourself and enter your tracking number from the shop's order email.
How the scam works
Criminals send huge numbers of texts or emails pretending to be a delivery company: DHL, UPS, FedEx, USPS, Royal Mail, Canada Post, Australia Post, India Post, Correios, J&T, your national post, or simply “Customs”. They don't know whether you're expecting a parcel. They don't need to: most people are.
The link opens a copy of the courier's website. It asks for your name, address and date of birth, then a tiny payment, often under 3 dollars, pounds or euros. The fee isn't the point. Your full card details are. Some sites also ask for your bank's name so a second scammer can call you pretending to be your bank's fraud team.
That follow-up call is where the real losses happen. The caller knows your details from the fake form, sounds professional, and says your card was “used fraudulently”. Then they talk you into moving money or reading out a code.
Red flags to look for
- The fee is tiny. Real couriers rarely text you asking for a fee of a dollar, pound or euro or two. A small amount makes you less careful about typing in card details.
- The link isn't the courier's real website. Look at the part just before the first single slash. royalmail.com is real; royalmail-redelivery.top or royalmail.parcel-help.com are not.
- A deadline. “Within 12 hours or it will be returned” is designed to rush you.
- Sent from a mobile number or a random email. Big couriers usually message from a named sender or their official app.
- You weren't expecting anything from that company. Scammers pick the biggest brands and hope you are.
What to do if you get one
- Don't tap the link. If you want to check, open the courier's official app or type their website address yourself and enter your tracking number from the shop's order email.
- Forward the text to your phone network's spam number (for example 7726 in the UK, US, Canada and New Zealand, 33700 in France, 8080 in Poland), then delete it. Find your country's number.
- Check it with TapSafely if you're unsure. We'll show you who really owns the link.
Why these texts get past spam filters
Scammers rotate thousands of cheap domain names and phone numbers, often registering new ones hours before a campaign. That's why the same message keeps arriving from different numbers, and why a very new website is one of the strongest warning signs our checker looks for.
If you already paid or shared details
Act quickly. It makes a difference.
- Call your bank using the number on the back of your card and tell them you entered your card details on a fake delivery site. They can block the card and send a new one.
- Expect a follow-up call pretending to be your bank. Your bank will never ask you to move money to a “safe account” or read out a one-time code.
- Watch your statements for small “test” payments, and report the scam to your national fraud reporting service.
More help: what to do after a scam, and where to report it in your country.
Questions people ask
Can I get hacked just by opening the text?
Opening the text is very unlikely to harm your phone. The danger is tapping the link and typing information into the page.
I only entered my address, not my card. Is that a problem?
It's lower risk, but scammers may use your details to make later messages or calls more convincing. Be extra careful with calls claiming to be your bank for the next few weeks.
How do customs fees work for real?
Genuine import charges are usually requested by the courier handling your parcel, and you can see them in your tracking page on the official website or app. If in doubt, contact the courier directly.
Official sources and further reading
We check our guides against advice from government agencies and consumer protection bodies.
- Smishing: Package Tracking Text Scams (US Postal Inspection Service)
- How to Recognize and Report Spam Text Messages (US Federal Trade Commission)
- Phishing (Canadian Anti-Fraud Centre)