Suspicious package message: check the request first

If a delivery message says your package is held, delayed, missing an address, waiting on customs, or needs a redelivery fee, do not use the link or number in the message to check it.

Open the retailer account, carrier app, or carrier website yourself. The risk depends on what happened next: ignored message, clicked link, entered card details, shared a code, downloaded something, or called a number.

Verify the delivery without using the message

1. Open the retailer account, marketplace order, or carrier app yourself.
2. Type the carrier website directly or use a saved bookmark.
3. Compare the tracking number, sender, destination, delivery status, and order history.
4. If the message has no matching order or tracking record, treat it as suspicious.
5. If you are expecting a package, still do not use the message link as proof.

Redelivery, address, customs, and postage requests

USPS says it does not charge a fee for redelivery. USPIS also says USPS text tracking is tied to a customer-initiated tracking request and suspicious package texts with unfamiliar links should not be clicked.

Other delivery payments need more nuance. UPS says only some packages require money for delivery, such as collect-on-delivery, duties, or taxes, and that tracking is the safest way to see whether a fee is due. DHL says email or SMS payment requests are only for customs duties and taxes, with safety measures in its process.

The practical rule is the same: do not pay from an unexpected message link. Check the fee through the official carrier, retailer, marketplace order, or customs process you reached yourself.

If you clicked the delivery link

A click is not the same as submitting a card number, password, one-time code, or ID. The useful question is what loaded and what you approved.

• If the page did not load, close it and do not try again.
• If the page loaded but you entered nothing, check for downloads, permission prompts, calendar/profile prompts, or account alerts.
• If you typed financial details, even without finishing the form, contact the card issuer or bank.
• If the page asked you to install an app, profile, file, or extension, remove it and review device and account activity.
• If the page sent you to a phone number, do not call back through that number.

For phone, app, browser, or account changes after a click, use the phone and account compromise page.

If you entered card, login, code, or personal information

Act based on what was exposed.

1. Card number or CVV: call the card issuer using the number on the card, official app, or official website. Ask about card replacement, pending charges, disputes, and monitoring.
2. Bank login or payment account: change the password from the real site, turn on multi-factor authentication, and review sign-ins or transfers.
3. Retailer, carrier, or Amazon login: open the real account yourself, change the password, review orders and messages, and report suspicious communication through the official support path.
4. One-time code: treat it as possible approval of a login, payment, account change, or password reset.
5. Name, address, phone, or email: expect more targeted follow-up messages. If SSN, ID images, or financial documents were exposed, use the personal-information exposure page.

Do not pay another fee to cancel, refund, release, or recover the first payment.

Fake tracking numbers and real-looking package timing

A tracking number, logo, carrier name, or delivery deadline does not prove the message is real. A number can be fake, copied, expired, unrelated, or attached to a shipment that is not yours.

Check whether the tracking record matches the order, sender, destination, and carrier you expect. If the message says there is a delivery problem but the real order page does not show one, trust the account you opened yourself over the message.

What to save

1. Screenshot the text, email, QR notice, voicemail, door notice, or call log.
2. Save the sender number, short code, email address, caller ID, or visible URL.
3. Save the tracking number, carrier name, order number, and delivery claim.
4. Write down whether you clicked, scanned, replied, called, typed, submitted, paid, downloaded, or approved a prompt.
5. Keep payment records, transaction IDs, card alerts, bank alerts, and account security emails.
6. Save follow-up texts, calls, or emails connected to the same package, fee, or address.

Where to report or get help

ScamClarity is not an official reporting destination. Use the path that matches what happened.

• Use your phone or email app's report junk, spam, or block option.
• Forward scam texts to 7726 when your carrier supports it.
• For USPS-related package smishing, follow USPIS reporting steps and include the message, sender, date, screenshot, and what happened.
• Report consumer fraud to FTC ReportFraud.
• Report internet-enabled fraud, losses, or account compromise to IC3.
• Report unwanted calls or texts through the FCC complaint center when appropriate.
• Report impersonated carriers through FedEx, UPS, DHL, Amazon, or the carrier's official fraud-reporting channel.
• Contact the card issuer, bank, payment provider, retailer, marketplace, account provider, or carrier through official channels if payment or account information was entered.

For U.S.-specific reporting context, the United States scam reporting page explains how FTC, IC3, IdentityTheft.gov, local police, and providers fit together.

How this overlaps with smishing and phishing

A delivery scam sent by text is also smishing. A delivery scam sent by email, QR code, fake website, voicemail, or app message can overlap with phishing or vishing.

Use the smishing page when the main issue is a text-message link, reply, 7726 reporting, or phone-specific concern. Use the phishing page when the main issue is a suspicious email, attachment, login page, QR code, or cross-channel link.

FAQ

Can one click on a delivery link hack my phone?

One click is not the same as entering information, approving a prompt, or installing something. Close the page, do not reopen it, and check for downloads, app/profile prompts, browser permissions, or account alerts.

Is a small delivery fee always fake?

No. Some duties, taxes, postage, or collect-on-delivery charges can be real. The unsafe part is paying through an unexpected message link. Verify through the carrier or retailer account you opened yourself.

What if I entered my card number but the payment failed?

Contact the card issuer anyway. A fake form can still collect card details even if the page says the payment failed.

What if the tracking number works?

Check whether it matches your order, sender, destination, and delivery status. A real tracking number can still be unrelated to you.

Is this the same as smishing?

If it came by text, yes. Delivery scams can also arrive by email, QR code, voicemail, fake tracking pages, app messages, or phone calls.