Delivery fraud
How to spot a fake delivery message
"Your parcel could not be delivered" with a link to reschedule: that is how one of the most common fraud patterns starts. It works because it connects to something you are genuinely expecting, and because the message can imitate a carrier you already use. The US Federal Trade Commission lists exactly this shape among its phishing warning signs: a claim that there is a problem with your account or payment, and a link to fix it (FTC, how to recognize and avoid phishing scams).
The message itself rarely gives it away. Treat the delivery notice as a reason to check your own tracking, not as a source of truth about a parcel.
Direct answer: five checks before you click
- Open your own carrier app or type the tracking page yourself. Use the app or the carrier's tracking page and look up the reference number there. The message you received is never the place where you verify the delivery.
- Compare the reference with what you actually expect. Are you waiting for a parcel at all, and does the town or postcode match? A notice about a shipment you do not recognise is a reason to stop, not to click.
- Inspect the link without following it. Legitimate carriers use their own domain. Look at the domain in the message, not the display text; a fake page is designed to look like the branded one.
- Watch for urgency, generic greeting and any payment request. The US Federal Trade Commission lists exactly these tactics for phishing messages: suspicious-activity claims, problems with an account or payment, requests to confirm personal information, and links to make a payment (FTC, how to recognize and avoid phishing scams). A small "customs fee" is still a payment to an unknown party.
- Never install a file or app from a delivery message. An installation file (often an APK) is the core of the parcel-type malware pattern: the message claims a courier sent the receipt, and installing it gives the attacker access to the phone, messages and banking apps. A carrier never asks you to sideload an app to see a delivery.
What a detector does and does not see
A delivery notice is usually text, sometimes a screenshot. You can run the text through the text detector or a screenshot through the image detector. That is triage: it helps you decide which message to verify first. It says nothing about authenticity. Phishing templates and very short messages contain too little writing style for a reliable signal, and a genuine message with a generic greeting can draw one. So a low score never proves the message came from the carrier.
What a delivery message cannot tell you
- whether the sender really is the carrier, even when the sender ID or logo matches;
- whether a shipment for you actually exists;
- whether the link leads to the official site — only the domain shows that;
- whether it is fraud; only a bank or law-enforcement body can establish that.
Treat the message as a prompt to check your own app, never as evidence that something is wrong with your parcel.
If you already clicked or paid
- Contact your bank immediately if you entered card or login details, or shared a code; speed determines the chance of a block or a recall.
- Installed an app or file? Remove it, run a malware scan and change the passwords you used there.
- Keep the message, the sender ID, the link, the screenshot and the timestamp.
- Report it to the carrier and to the national fraud desk, and file a police report if you lost money.
More on judging this kind of message is in the guides on spotting a fake payment proof, checking a suspect invoice and AI photos in a rental listing. To check a file or a piece of text on its own, use the free checker. If instead someone calls you claiming to be your bank and asking you to move money or share a code, follow the five checks on a fake bank call.
Frequently asked questions
Is a delivery message with a payment link always fake?
No, but it is the pattern that goes wrong most often. Carriers state that they do not ask for payment through a link in an email or text; verify in the app or on the tracking page instead.
Does a high detector score prove the message is fake?
No. The score describes patterns in a text or a file and says nothing about the sender. A low score does not prove the message is genuine either.
May I forward the message or upload a screenshot?
Forward it to the carrier and to the national fraud desk. Upload only imagery you are permitted to use and that contains no other people's personal data; a screenshot of your own message is usually fine, but remove your own details where you can.