Fake Package Tracking Update Scam on Email
Emails mimicking courier tracking notifications lure recipients into clicking malicious links or attachments disguised as shipment status updates.
Part of: Fake Package Tracking Update Scam
Last reviewed: 5 July 2026
Most shipping emails are genuine, which gives this scam its cover. Email suits fake tracking updates better than text messages because it can carry courier logos, formatted tables, and a tracking-style layout, and because bulk sending means the scammer never needs to know whether you have a parcel in transit — some recipients always do. The message's button leads to a credential-harvesting login page, a fake payment form for a supposed unpaid balance, or a malicious attachment. The distinction that matters most is the sender's actual address, which matches the courier's real domain only on genuine mail.
How this scam works on email
An email arrives styled like a routine shipment update, complete with a tracking number, courier logo, and a button labeled something like 'View Tracking Details' or 'Confirm Delivery Address.' Clicking the button leads either to a credential-harvesting page disguised as the courier's login portal, or triggers a download of a malicious attachment disguised as a 'delivery confirmation' document. Some versions ask the recipient to 'update payment information' to release a package supposedly held for an unpaid balance, funneling victims to a fake payment form. Because these emails are sent in bulk to large mailing lists, the sender doesn't need to know whether the recipient has a real shipment in transit — the goal is simply that some percentage of recipients are currently expecting a package and will click without checking the sender's actual email domain.
More targeted versions follow a recent real online purchase, sent shortly after a legitimate order confirmation, exploiting the fact that the recipient is now actively expecting tracking information and less likely to scrutinize the sender closely.
Common red flags
- Sender's email domain does not match the courier's real domain when you check the full address, not just the display name
- Generic greeting ('Dear Customer') instead of your name, despite claiming to have your shipment details
- Attachment claiming to be a 'delivery confirmation' or 'tracking receipt' rather than a link to the courier's own site
- Request to 'update payment' or 'confirm address' to release a package
- Urgent countdown language about a package being returned or destroyed
- Tracking number in the email does not match any real order confirmation you have
How to protect yourself
- Check the sender's full email address, not just the display name, before trusting any tracking email
- Go directly to the courier's official website and enter the tracking number yourself rather than clicking the email link
- Never open unexpected attachments claiming to be delivery confirmations
- Enable your email provider's phishing filters and report suspicious messages instead of just deleting them
- Verify unexpected 'payment update' requests by calling the courier directly through a verified number
How to report it
- Report the email as phishing through your email provider's built-in reporting tool
- Forward the email to the courier's official phishing reporting address
- File a complaint with the FTC at reportfraud.ftc.gov or your national equivalent
- Report compromised login credentials to the affected account provider immediately if you clicked through
Frequently asked questions
Why do these emails often arrive right after I've made a real online purchase?
Some versions of this scam are timed to follow a genuine order confirmation, since scammers know you're actively expecting tracking information and are less likely to scrutinize the sender closely. This makes checking the sender's actual email domain especially important right after any online purchase.
Can opening the email itself infect my device, or only the attachment?
Simply opening a plain email is generally low risk, but clicking links or opening attachments is where the danger lies, since those can lead to phishing pages or malicious downloads. Avoid interacting with any part of a suspicious tracking email beyond reporting or deleting it.
How do I report a fake tracking email without accidentally clicking anything harmful?
Use your email provider's built-in 'report phishing' button rather than forwarding or replying to the message yourself, since this reports it safely without requiring you to interact with any links. You can also forward suspicious courier-branded emails to the real courier's official phishing report address.
How can I quickly check if a tracking email is genuine?
Copy the tracking number and enter it directly on the courier's official website rather than clicking the email's link — if the number doesn't match any real shipment, the email is fake.
What if I already clicked a link or opened an attachment?
Run a security scan on your device, change any passwords you may have entered on the fake page, and monitor your accounts closely for unusual activity.