How does a parcel delivery or missed delivery scam work?
Fake parcel notifications impersonate delivery companies to harvest card details or install malware, using the universal expectation of online deliveries to bypass scepticism.
Last reviewed: 10 June 2026
Explanation
The message arrives by text or email claiming that a parcel could not be delivered and requires a small redelivery fee or customs charge. The branding mimics a well-known courier — the logo, colours, and font are copied precisely. A link leads to a convincing fake site that requests card details to process the fee. These details are then used for fraud or sold on dark-web markets.
Malicious variants direct victims to install an 'app' to track the parcel. This app is malware that requests excessive permissions, harvests banking credentials, reads SMS messages (including two-factor codes), and may enrol the device in a botnet. Android devices are more commonly targeted because they allow installation from outside official app stores.
The effectiveness of this scam derives from timing: most people are waiting for at least one online delivery at any given time. The generic message 'your parcel could not be delivered' matches the victim's real expectation often enough to lower suspicion. Volume is high — millions of messages are sent cheaply, and even a small success rate is profitable.
Some variants claim customs duty is owed on an international shipment. The duty amount is plausible, the courier branding is authentic-looking, and the payment page may even show partial shipping details sourced from earlier data breaches to appear legitimate.
Common red flags
- A text or email about an undelivered parcel arrives when you are not expecting anything
- The message asks for a fee by clicking a link rather than instructing you to collect at a depot
- The URL in the link does not match the courier's official domain
- The message is sent from a personal email address or a random phone number
- You are asked to install an app from outside an official app store to 'track' the parcel
What to do now
- Do not click the link — go directly to the courier's official website and enter your tracking number there
- If you already entered card details, contact your bank immediately and request a replacement card
- If you installed an app, uninstall it and run a malware scan; change banking passwords from a different device
- Report the phishing message to the courier company's official fraud reporting channel
- Forward suspicious texts to your national spam reporting number if available
Frequently asked questions
How do fraudsters know I use a particular courier?
They often do not — the message is sent to millions at random. Because many people do have deliveries pending, the hit rate is still profitable.
Is a small customs or redelivery fee ever genuinely requested by text?
Real couriers do sometimes notify by text, but they typically direct you to their official app or website, not to a payment link in the message itself. Verify through official channels.
Can the scam steal my money without me entering card details?
Yes, if you install malware. Malicious 'tracker' apps can steal banking credentials directly from your device without you ever typing them into a website.