Fake Delivery Scams: Beware of “Package Held” Messages

By /

Few things feel more routine than receiving a delivery update — and scammers know it. Fake delivery scams prey on our daily reliance on courier texts and emails by sending messages that appear to come from UPS, DHL, FedEx, Canada Post, or Amazon. These messages claim that your package is delayed, that a fee must be paid, or that your address needs to be confirmed. In reality, they are phishing attempts designed to steal your credit card numbers, passwords, or identity details.

Fake delivery notifications surged during and after the pandemic, when online shopping hit record highs. Today, these scams remain among the most common phishing tactics worldwide because they exploit one simple fact: almost everyone expects a parcel.

How Fake Delivery Scams Work

1. The Message

You receive an SMS or email claiming:

“Your parcel cannot be delivered until customs fees of $2.50 are paid.”
or
“We tried to deliver your package today. Please reschedule delivery: [shortened link].”

The sender often uses convincing branding, including official logos and colors, to look like a genuine courier. The domain may even contain the company’s name, such as dhl-update.com or postoffice-fee.net.

2. The Link

The link in the message leads to a spoofed courier website designed to look authentic. It may display your name, tracking number, or address — all easily generated or purchased from previous data breaches.

Once you click, you’ll be asked to “verify” your information or pay a small delivery fee. The payment form captures your credit card details and sometimes your login credentials, which scammers can use or sell.

3. The Follow-Up

Some victims are redirected to pages that install malware or spyware. Others receive phone calls from “delivery agents” requesting further verification. In severe cases, scammers use the stolen information to attempt identity theft or additional charges.

Red Flags to Watch For

  • The message contains urgent language, such as “final notice” or “delivery will be canceled.”
  • The sender’s address or URL does not match the official courier domain (e.g., @dhl-express.co instead of @dhl.com).
  • The link is shortened or obscured, often using bit.ly, tinyurl, or amztrk.io.
  • The message requests a small payment or personal details to release your package.
  • It contains spelling errors, inconsistent fonts, or misplaced logos.
  • You weren’t expecting a delivery or the tracking number doesn’t match any recent purchase.

Real-World Examples

  • DHL Fee Scam: Victims receive a text claiming a parcel is being held for customs charges of $1.99. Once they enter card details, multiple unauthorized charges appear within hours.
  • Canada Post “Address Confirmation” Email: A phishing campaign sent realistic-looking emails requesting updated delivery addresses. Clicking the link installed a keylogger on the user’s device.
  • Amazon Tracking SMS Scam: Users receive fake updates about a “missed delivery,” linking to a fake Amazon login page. The stolen credentials are then used to order items or commit identity theft.

Why These Scams Work

Fake delivery messages succeed because they exploit timing and trust.

  • Timing: Scammers send messages when online shopping volume is high — holidays, sales seasons, and weekends.
  • Trust: Courier companies are familiar and non-threatening, which lowers suspicion.
  • Emotion: The fear of losing or delaying a package creates instant urgency.

Even savvy users can be caught off guard if the message arrives when they genuinely expect a parcel.

What to Do If You Receive a “Package Held” Message

  1. Check the sender carefully. Real couriers use official domains — not free email addresses or random numbers.
  2. Do not click the link. Instead, manually visit the courier’s official website or app and enter your tracking number.
  3. Compare tracking numbers. If the number doesn’t match any of your recent purchases, it’s fake.
  4. Look up the message online. Search key phrases from the message along with the word “scam” to see if others have reported it.
  5. Contact the courier directly. Use the verified customer service number found on the courier’s website. Never trust a number or email in the suspicious message.
  6. Delete the message. Avoid replying or forwarding it to anyone except an official fraud reporting address.

If you’ve already clicked the link, don’t panic — follow the steps in the next section to secure your accounts and devices.

What to Do If You Clicked the Link

  1. Disconnect from Wi-Fi or mobile data to prevent potential malware downloads.
  2. Do not enter any payment or login details if the fake website is still open.
  3. Run a full antivirus scan on your device.
  4. Change passwords immediately for any accounts that use the same credentials.
  5. Notify your bank or credit card provider if you entered payment details. Ask to block the card and monitor for charges.
  6. Report the scam to your national fraud agency and the courier company being impersonated.

Where to Report Delivery Scams

Courier Companies:

Fraud Reporting Agencies:

How to Stay Safe

  • Use official courier apps with built-in tracking and push notifications.
  • Enable SMS filtering and spam protection on your smartphone.
  • Avoid clicking any links in unexpected messages about deliveries.
  • Regularly check your bank and credit statements for small test charges.
  • Educate family members and colleagues — scammers often reuse scripts and templates, so awareness stops repetition.

Key Takeaway

Fake delivery scams succeed because they mimic the ordinary. A short text with a familiar logo can seem harmless, but one careless click can expose your data. By pausing to verify before acting, you transform from a target into a skeptic — and that single habit can prevent most phishing attacks.

Leave a Comment

Your email address will not be published. Required fields are marked *

Scroll to Top