Delivery scams run on timing. The text lands while you are waiting for something, and a campaign only has to be right once in a few hundred sends for a GBP 1.45 “unpaid postage” fee to pay for itself. Four details separate a real courier notification from a fake, and you can check all of them without tapping the link.
The five scripts every fake parcel text reuses
Nearly everything in circulation is a variation on one of these, and each invents a reason why you must act within 24 to 48 hours:
- Unpaid postage. A parcel is being held because 1.45 pounds, 1.99 dollars or 120 taka is outstanding. The figure is small on purpose: it has to feel cheaper than the bother of arguing.
- Failed delivery. “We attempted delivery today and nobody was available. Book redelivery or the item returns to sender.”
- Address problem. The label is “incomplete” and you are asked to confirm your full address, which is the actual objective: name, street and postcode for a later burglary or identity attempt.
- Customs charge. A “clearance fee” must be settled before release, usually with a convincing photo of a customs form attached.
- Tracking lure. No money is mentioned at all. The link is a “view your parcel” page that asks you to sign in with your email, harvesting a password you almost certainly reuse elsewhere.
The US Postal Inspection Service advisory on package-tracking smishing documents this exact pattern: the message imitates a carrier, the link imitates a carrier, and the payment page imitates a checkout.
Sender, domain and tracking number: the three checks
Sender. On Android, open the thread and tap the header to see the raw number or alphanumeric ID. On iPhone, tap the bubble at the top. Legitimate alerts arrive from a shortcode or a fixed number you have seen before; scams rotate through +44 7xxx mobiles, +63 and +234 country codes, or spoof a name such as “DPD-Info”. A spoofed sender name proves nothing, so verify the number and ignore the label.
Domain. Read an address from right to left. In royalmail.com.parcel-reschedule.info the site you would actually reach is parcel-reschedule.info, not Royal Mail. Lookalikes usually swap a letter for a digit, insert a hyphen (dpd-delivery.co), or bury the real brand in a subdomain. A genuine courier keeps tracking on its own domain and never hosts a card form there.
Tracking number. A real notification quotes the number the retailer gave you. Check it in the carrier’s own tracker: Royal Mail at royalmail.com/track-your-item, DPD at dpd.co.uk, Evri at evri.com, USPS at usps.com. For marketplace orders, ignore the text and open the Daraz or Amazon app, then Your Orders – Track package. If the number does not exist in the carrier’s own system, the message is fake.
What no courier will ever ask you for
No courier needs a full card number, expiry date and three-digit CVV through a text link to release a parcel, and none asks for a bank app code or a bKash PIN. Cash-on-delivery is collected by the rider, or paid inside the courier’s own app after you log in yourself. Fakes also add pressure: “within 12 hours or the parcel is destroyed”, where a genuine held-parcel notice gives you days. A third is the hostage: a suspiciously cheap phone, laptop or graphics card you never ordered, because greed is a faster hook than fear.
Report and silence it on iPhone and Android
iPhone: do not reply, not even “STOP”, since a reply confirms a live number. Open the thread, tap the sender, then Info – Block this Caller. To keep unknown texts out of your main list, go to Settings – Messages – Unknown & Spam and turn on Filter Unknown Senders; those threads move to a separate tab with a Report Junk option.
Android with Google Messages: long-press the message, open the three-dot menu and choose Block & report spam. Then go to the menu – Settings – Spam protection and confirm it is on, because it filters known scam patterns on the device itself. Samsung Messages hides the same command under More – Report spam.
In the UK, forward the text to 7726 (free on EE, O2, Vodafone and Three) before deleting it; US carriers use the same shortcode. Screenshot it first, because the URL and timestamp are what your bank asks for if money moves.
If you already tapped the link
Work in this order. Close the page without submitting anything. If you typed card details, freeze the card inside your banking app and call the number printed on the back, asking for a replacement rather than a temporary block, because the number is now on a list that gets sold. If you entered an email password, change it and sign out of all other devices. If you handed over a one-time code, treat the account as compromised: change the password, then revoke active sessions.
Next, look for leftovers. On iPhone, Settings – General – VPN & Device Management should show nothing you did not install yourself. On Android, Settings – Apps – Special access – Install unknown apps should show no browser with permission switched on. Then expect a follow-up call within a day from someone claiming to be your bank’s fraud team: hang up and dial the number on your card instead.
For the wider pattern, stopping phishing text scams before you tap anything covers the email and link variants, and five fast checks that identify a safe website explain how to read a domain before you trust it. If the calls start arriving instead of texts, blocking spam calls and texts is the next step.