Package Delivery Scam: Fake UPS, FedEx and DHL Messages

A package delivery scam is an email, text or voicemail pretending to be from a courier such as UPS, FedEx or DHL, saying a package couldn’t be delivered, is being held, or needs a customs fee or address update before it can arrive. The link leads to a fake page built to take your card details, login or personal information. Don’t tap the link. Check the delivery by typing the courier’s official website or app address yourself and entering a tracking number from your own order confirmation.

These messages work because most of us are expecting something at any given time. If you’ve already clicked or paid, you haven’t done anything unusual, and the steps below will help you limit the damage.

How the package delivery scam works

Scammers send huge numbers of messages, knowing some recipients will be waiting for a parcel. The message creates a small, urgent problem with an easy fix: a few clicks and a small payment. The real goal is usually what you type into the fake page, not the fee itself.

• Your card details, which can be used for larger purchases or sold.
• Your personal information, such as your name, address, date of birth and phone number, used for further scams or identity theft.
• Your login details, if the page asks you to sign in with an email or courier account.
• A foothold for follow-up calls, where someone pretending to be your bank calls about “suspicious activity” on the card you just entered.

If the message claims to be from the US Postal Service, our dedicated guide to the USPS text scam covers USPS’s own rules and reporting routes. This guide focuses on private couriers and international shipments.

Common versions of the scam

Missed-delivery texts and emails

A message says the courier tried to deliver but no one was home, or the address was incomplete, and you need to reschedule or confirm your address through a link. Some add a small “redelivery fee”.

Fake customs or import fees

A message says an international package is held at customs and needs duties, taxes or a clearance fee paid before release. Genuine duties can apply to international shipments, which is what makes this convincing. The difference is how you check and pay: through the courier’s official site or app, or with the courier directly, never through a link in an unexpected message.

Fake shipping notifications with attachments

An email carries an attachment called something like “shipping label” or “invoice” and asks you to open it to see your delivery. Attachments in unexpected emails can contain malware. Our guide on how to spot a phishing email covers the signs.

Delivery calls and voicemails

A call or recorded message claims to be from a courier and asks you to press a key or call back to arrange delivery, then asks for payment or personal details over the phone.

Missed-delivery cards and QR codes

A printed card left at your door or in your mailbox asks you to scan a QR code or call a number to reschedule. Treat the code or number with the same caution as a link in a text; our guide to QR code scams explains why.

Warning signs of a fake delivery message

• You weren’t expecting a package from that courier, or the message doesn’t name the sender or item
• The message was sent from a personal phone number, an odd email address or a long string of digits
• The link goes to a web address that isn’t the courier’s official domain, even if it contains the courier’s name
• It asks for a small fee to redeliver, release or insure a package
• It creates urgency, such as “your package will be returned in 24 hours”
• It asks for your card details, date of birth, Social Security number or a login to “confirm” your identity
• The grammar, logos or formatting look slightly off
• The tracking number doesn’t match any order you placed, or doesn’t work on the courier’s real site

What to do if you got the message but didn’t click

1. Don’t tap the link or reply, not even to type STOP.
2. Forward scam texts to 7726 (SPAM) so your mobile carrier can block similar messages, then delete them.
3. Report phishing emails to the courier using the fraud or phishing reporting instructions on its official website, then delete them.
4. Check any genuine delivery through the store’s order page or the courier’s official site.

What to do right now if you clicked or paid

1. Call your card issuer or bank using the number on the back of your card or in the official app. Say you entered your card on a scam site and ask them to block the card and issue a new one.
2. Watch for follow-up calls. Scammers sometimes call soon after, posing as your bank’s fraud team. Hang up and call your bank back on the number you already trust.
3. Change passwords if you entered a login. Start with your email, then any account that shares the same password, and turn on two-factor authentication. Our guide on what to do if your account was hacked helps if you’ve lost access.
4. Protect your identity if you entered your date of birth, Social Security number or ID details. Place a fraud alert or credit freeze, and use IdentityTheft.gov for a recovery plan.
5. If you opened an attachment or installed something, disconnect the device from the internet, run a security scan, and get help if you’re unsure.
6. Save the evidence: screenshots of the message, the sender’s number or address, the web address and any payment confirmation.

A worked example

This is an illustrative scenario, not a real person or client.

Tomás has ordered a jacket from an overseas store. A text arrives saying a courier is holding his parcel at customs and he needs to pay a small import fee within 24 hours through a link. The link opens a page with the courier’s logo, asking for his card details and date of birth.

Tomás pauses and opens the store’s order confirmation email, which lists the courier and a tracking number. He types the courier’s official web address and enters the number himself. The tracking page shows the parcel in transit, with no fee due. He forwards the text to 7726 and deletes it. His jacket arrives two days later.

If a real duty had been due, it would have appeared on the official tracking page, with instructions from the courier itself.

Where to report a package delivery scam

• Your mobile carrier, by forwarding the text to 7726 (SPAM).
• The courier being impersonated, using the fraud reporting page on its official website. UPS, FedEx and DHL each publish guidance on fraudulent messages.
• The FTC at ReportFraud.ftc.gov.
• The FBI’s Internet Crime Complaint Center at ic3.gov if you lost money or entered financial details.
• IdentityTheft.gov if your personal information was used or could be misused.
• The US Postal Inspection Service if the scam claimed to be from USPS or arrived by mail.

Our guide on how to report a scammer explains what each route does and what information to include.

Will you get your money back?

If you paid by credit or debit card, your card issuer may be able to dispute the charge and will usually replace the card. Act quickly, since issuers set time limits for disputes. The fee itself is often small; the bigger risk is later charges made with your card details, so review your statements for the next few months.

If you paid through a payment app, a wire transfer, gift cards or crypto, recovery is often difficult or impossible, but report it to the provider straight away. And be wary of anyone who contacts you promising to recover your money for a fee; our guide to recovery scams explains why that’s usually a second scam.

How to protect yourself from fake delivery messages

• Track packages only from the source. Use the store’s order page or type the courier’s address yourself.
• Sign up for alerts on the courier’s official app or site if you want delivery updates, so you know what real messages look like.
• Use your phone’s spam filtering and your carrier’s scam-blocking tools.
• Never pay a fee through a text link. Genuine couriers give you an official way to see and pay any charges.
• Talk to family members, especially anyone who shops online often or receives gifts from abroad.

Delivery texts are one of the most common kinds of smishing, and the same habit protects you against most of them: never act on the link, check the source directly.

Common mistakes to avoid

• Paying “just a small fee” to make the problem go away. The fee is bait for your card details.
• Trusting a link because it contains the courier’s name. Scammers register addresses that include real brand names.
• Replying to the text. It confirms your number is active.
• Calling the number in the message. Look up the courier’s contact details on its official site.
• Waiting to call your bank. The sooner you report it, the more options your card issuer has.

Businesses whose customers receive fake delivery messages in their name can help by telling customers which courier they use and how shipping updates are sent. If fake shipping messages are hurting your store’s reviews, our ecommerce reputation management team can help you respond.

Frequently asked questions

Do UPS, FedEx or DHL text you about missed deliveries?

Couriers can send delivery updates, typically when you’ve signed up or when the sender provided your number. But a text asking you to pay a fee or enter card details through a link is a strong sign of a scam. Check tracking on the courier’s official site or app instead.

Is a customs fee text real?

Genuine duties can apply to international parcels, but scammers copy this. Check by entering your tracking number on the courier’s official site, which you type in yourself. If a fee is really due, it will show there.

What happens if I clicked a fake delivery link but didn't enter anything?

The risk is usually lower. Close the page, don’t enter details, and keep your phone updated. If you downloaded anything or entered information, follow the steps above.

How do I report a fake package delivery text?

Forward it to 7726 (SPAM), report it to the courier through its official website, and report it to the FTC at ReportFraud.ftc.gov. If you lost money, also report it to ic3.gov.