Fake Delivery Texts

Fake delivery texts, also called smishing (SMS phishing), impersonate parcel couriers, national postal services, and logistics companies. They send a text or messaging app notification claiming that a delivery attempt has failed, that a small customs or redelivery fee is outstanding, or that you need to confirm an address to release a parcel. The message contains a link to a phishing page that closely mimics the courier's real website.

The goal is to steal card details and personal information, which are then used for financial fraud or sold to other criminals. The small fee — often just a few pounds or dollars — is not the primary target. It is a pretext to get a victim to enter full card details on the fake page.

These messages are sent in bulk to large numbers of phone numbers, many of which belong to people who genuinely are expecting parcels. This overlap with real shopping activity makes the messages feel plausible, and the timing often seems coincidental.

The scam begins with a text or WhatsApp message that appears to come from a familiar courier name. The message is typically brief and urgent: a parcel is held, a small fee is due, or delivery will be returned in 24 hours. A link is included.

Clicking the link takes the victim to a page that copies the courier's visual design, colour scheme and logo. The page asks for a small payment, typically a convincing amount for a customs or redelivery charge. To make the payment, the victim enters their full card number, expiry date, and security code, along with their name and sometimes address.

This information goes directly to the scammers. The card details are used for fraudulent purchases, or the full set of personal details is sold. Some sites also harvest login credentials by presenting a fake courier account login page. Because the fee is small and the design is convincing, many people complete the form before becoming suspicious.

The effectiveness of fake delivery texts comes from timing and plausibility. Most people order things online regularly, so a message about a parcel feels relevant even when it is not. The small fee reduces resistance — it seems like a minor inconvenience, not a threat. The urgency (return to sender, 24-hour deadline) discourages careful thought.

Smishing messages also benefit from mobile browsing habits. On a small screen, it is harder to inspect a URL carefully, and people are less likely to independently navigate to the courier's official site to verify. The combination of a trusted brand name, a small financial ask, and a deadline creates a powerful push toward compliance.

A person receives a text claiming their parcel could not be delivered and a small redelivery fee is due. They tap the link, which opens a page that looks exactly like the courier's website. They enter their card details to pay the fee. Within hours, they notice unfamiliar transactions on their card — much larger than the original fee. They contact their bank, which confirms the card details were used fraudulently. The original parcel, meanwhile, is delivered normally the next day through the real courier.

Your parcel is held pending a [amount] redelivery fee. Pay now at [fake link] to avoid return.

We attempted delivery of your parcel today. Schedule redelivery and pay your [amount] fee at [fake link] within 24 hours.

Your parcel has been held at customs. An import fee of [amount] is due. Pay at [fake link] to release your item.

Please confirm your delivery address to release your parcel: [fake link]. Delivery will be attempted tomorrow.

Your parcel could not be delivered. Reschedule for free within 12 hours: [fake link].

Never click the link in a delivery text. Instead, go directly to the courier's official website by typing the URL yourself, or open the courier's official app. Enter the tracking number from your original order confirmation to check the real status of your parcel.

If you are unsure which courier is handling a parcel, check the order confirmation email from the retailer — it will usually name the courier and provide a tracking link. Genuine couriers may send texts with tracking links, but they do not typically demand fees via SMS links, and their links will clearly show their own official domain rather than a lookalike.

If you received a text and want to check its legitimacy without clicking, you can copy just the URL (without clicking) and check it against the official courier domain name.