A fake delivery notice is a phishing message dressed as a parcel update: it borrows a courier's logo, says a package could not be delivered, and asks you to pay a small fee, confirm your address, or pick a new delivery slot through a link. The fastest way to tell it from a real one is to never use that link. Copy the tracking number instead, type the carrier's address into your browser by hand, and paste the number into their own tracking page. A genuine shipment will be there. A fake number will not exist, or will belong to a parcel going somewhere else entirely. Everything else in this guide is a way of reaching that same answer faster.
Delivery scams are the most common phishing lure in circulation, and the reason is not subtle: almost everybody is waiting for something. The attacker does not need to know what you ordered or who from. They send the same message to millions of addresses and rely on a fraction of recipients having a parcel in transit that week, which makes an otherwise generic alert feel specific.
Why you get these even when nothing is on its way
The messages are untargeted. Your address came from a leaked list, a breached site, or an address book someone else's malware read, and the sender has no idea whether you have ordered anything. If a notice arrives when you are expecting nothing, that is not a puzzle to solve — it is the answer.
It is worth understanding what the scam actually wants, because the fee is rarely the point. A redelivery form that collects a card number hands over a working card, and a small charge is a convenient way to confirm it works before the number is sold or used properly. Other variants want the login to your account with the retailer, or enough personal detail — full name, address, phone number, date of birth — to open something in your name later. Some simply want you to install an "official tracking app" from a link, which on Android means a package from outside the store with permissions you would never grant deliberately.
The versions you will actually see
The redelivery or shipping fee
The most common one. A parcel is waiting, delivery failed, and a token amount is outstanding before it can be sent again — small enough that disputing it feels like more trouble than paying. The form asks for the card details and often for the billing address too, which is what makes the stolen number usable.
Customs or duty charges
This one is effective because the real thing exists. If you import something from outside your customs area, the carrier often does pay duty and VAT on your behalf and then bills you, usually with a handling fee of their own. The scam version copies that letter for a parcel you never sent for. The difference is that a real duty demand references a shipment you are expecting, from a sender you recognise, and the carrier will show it against the tracking number on their own site rather than only in an email.
The address problem
No money is asked for, which is what makes people relax. The message says the address is incomplete and invites you to correct it. The form collects a full set of personal details, and in the better-made versions it also asks you to log in to the retailer's account "to confirm the order" — on a page that is a copy of the real login.
The text message version
The same scripts arrive by SMS and messaging apps, usually shorter, with a shortened or unfamiliar link and sometimes a plausible-looking tracking number. Texts are harder to judge because there is no sender domain to read and no headers to check, so the tracking-number test matters more there, not less.
The checks that settle it
Check the tracking number somewhere else
This is the only check that cannot be faked, because it does not involve the message at all. Copy the number, open the carrier's site yourself — typed, or from a bookmark, not from the email — and paste it in. Carriers also use fixed formats, so a number that does not fit the shape is a giveaway before you even search: UPS numbers, for example, begin with the characters 1Z. If the message gives no tracking number at all, that alone tells you most of what you need to know.
Read the domain, not the logo
Logos are images anyone can copy. The sending domain is harder. Look at the part immediately before the first single slash in the link, and at the part after the @ in the sender address, and ask whether that is the carrier's real domain — not whether their name appears somewhere in it. Scam links put the brand in a place that looks right at a glance but is not the domain at all: a subdomain of something else, a lookalike spelling, or a long path on an unrelated host. On a phone, press and hold a link to see where it goes instead of tapping it.
Ask what the message knows
A real notification comes from a system that has your order. It can name the sender or the retailer, the tracking number, and usually the delivery address or at least the town. A fake one is written to fit any recipient, so it says "your parcel" and "our courier" and addresses you by your email address or not at all.
Pressure is part of the design
Real carriers hold parcels for days and tell you how long. Scam notices give you twenty-four or forty-eight hours before the package is "returned to sender", because a deadline stops you checking. The specific pattern of urgency plus a small payment appears across most email fraud, and the wider set of tells is worth knowing too — we go through them in how to spot a phishing email.
What real carriers do and do not do
Couriers differ in detail, but the boundaries are consistent. A real carrier will leave a physical card or a note in their own app, will let you find the same information by searching the tracking number on their site, and will take any genuine payment through your account on their own domain. A real carrier will not email you asking for a password, will not ask you to install an app from a link in a message, and will not ask for card details to release a parcel that has no duty owing on it.
One asymmetry is worth knowing: large carriers authenticate their mail properly, so a genuine notice carries SPF, DKIM and DMARC results that match the carrier's own domain. A forgery usually does not, and when it does, the signing domain belongs to something else. You can see both in the raw message with the email header analyzer, and SPF, DKIM and DMARC explained covers what each result actually proves. Treat that as confirmation rather than your first move: a pass means the sender is who they say they are, not that they are honest, so the domain still has to be the right one.
If you already paid or typed something in
- If you entered card details, call your bank or freeze the card in your banking app now, then dispute the charge. Watch for a second, larger attempt a few days later — a small test charge is often a rehearsal.
- If you entered a password, change it on the real site immediately, and change it anywhere else you used the same one. Turn on two-factor authentication while you are there.
- If you installed an app, uninstall it, and on Android check which apps hold accessibility or SMS permissions.
- Report it. Carriers run their own fraud reporting addresses, and most countries have a national reporting service for scam texts and emails. Reporting takes a minute and is how the hosting and the number get shut down.
- Expect more of them. An address that responded once is worth more to the next sender, and that is reason enough to keep your real address off forms you do not trust — what to do when your email address leaks goes through the rest.
The short version
- Never use the link. Search the tracking number on the carrier's own site instead.
- No tracking number, or one that does not match the carrier's format, means it is fake.
- A notice for a parcel you are not expecting is fake, however well made.
- Read the domain before the first slash, not the logo or the display name.
- Real duty charges exist, but they reference a real shipment and are payable on the carrier's own site.
- No carrier needs your password, your date of birth, or an app installed from a link.
- If you paid, freeze the card first and dispute second.