Fake Package Tracking Update Scam on Email
Emails mimicking courier tracking notifications lure recipients into clicking malicious links or attachments disguised as shipment status updates.
Part of: Fake Package Tracking Update Scam
Last reviewed: 5 July 2026
Email remains a favored channel for fake tracking update scams because it allows scammers to embed convincing courier logos, formatted tables, and tracking-style layouts that are harder to fake convincingly in a short text message.
How this scam works on email
An email arrives styled like a routine shipment update, complete with a tracking number, courier logo, and a button labeled something like 'View Tracking Details' or 'Confirm Delivery Address.' Clicking the button leads either to a credential-harvesting page disguised as the courier's login portal, or triggers a download of a malicious attachment disguised as a 'delivery confirmation' document. Some versions ask the recipient to 'update payment information' to release a package supposedly held for an unpaid balance, funneling victims to a fake payment form. Because these emails are sent in bulk to large mailing lists, the sender doesn't need to know whether the recipient has a real shipment in transit — the goal is simply that some percentage of recipients are currently expecting a package and will click without checking the sender's actual email domain.
More targeted versions follow a recent real online purchase, sent shortly after a legitimate order confirmation, exploiting the fact that the recipient is now actively expecting tracking information and less likely to scrutinize the sender closely.
Common red flags
- Sender's email domain does not match the courier's real domain when you check the full address, not just the display name
- Generic greeting ('Dear Customer') instead of your name, despite claiming to have your shipment details
- Attachment claiming to be a 'delivery confirmation' or 'tracking receipt' rather than a link to the courier's own site
- Request to 'update payment' or 'confirm address' to release a package
- Urgent countdown language about a package being returned or destroyed
- Tracking number in the email does not match any real order confirmation you have
How to protect yourself
- Check the sender's full email address, not just the display name, before trusting any tracking email
- Go directly to the courier's official website and enter the tracking number yourself rather than clicking the email link
- Never open unexpected attachments claiming to be delivery confirmations
- Enable your email provider's phishing filters and report suspicious messages instead of just deleting them
- Verify unexpected 'payment update' requests by calling the courier directly through a verified number
How to report it
- Report the email as phishing through your email provider's built-in reporting tool
- Forward the email to the courier's official phishing reporting address
- File a complaint with the FTC at reportfraud.ftc.gov or your national equivalent
- Report compromised login credentials to the affected account provider immediately if you clicked through
Frequently asked questions
How can I quickly check if a tracking email is genuine?
Copy the tracking number and enter it directly on the courier's official website rather than clicking the email's link — if the number doesn't match any real shipment, the email is fake.
What if I already clicked a link or opened an attachment?
Run a security scan on your device, change any passwords you may have entered on the fake page, and monitor your accounts closely for unusual activity.