How do mail and parcel delivery scams target people expecting packages?

Parcel delivery scams are effective because almost everyone regularly receives deliveries and occasionally experiences the legitimate frustration of a missed delivery or customs delay. A text or email claiming to be from a well-known courier service, stating that a small fee must be paid to release a package, is psychologically pre-calibrated to feel familiar and urgent.

The amounts requested are deliberately small — a few pounds, dollars, or euros — because a minor fee to receive an expected parcel does not trigger the same alarm as a large financial request. The proportion of people who click through and pay is helped by the scale of legitimate delivery activity: if enough people are receiving these messages, a meaningful percentage will have a genuine delivery in progress that makes the message seem personally relevant.

The link in the scam message leads either to a payment page that harvests card details, or to a page that also requests personal information like name, address, and phone number under the guise of confirming delivery details. This data is then used for further fraud or sold. Some delivery scam pages install malware when visited.

The scam is also used to harvest account credentials for actual courier platforms. A fake login page for a real courier service captures the target's username and password, which the scammer can then use to redirect genuine deliveries, access linked payment methods, or sell as credentials in bulk.