Package delivery scams are on the rise – a study by TransUnion showed that there was over a 1500% increase in instances of shipping fraud from 2019 to 2021, possibly due to the growing trend of ecommerce and adoption of digital solutions in the aftermath of the pandemic.
More recently, a 2023 study revealed that almost half of all scam email and text messages were related to package delivery. If you're affected, it means your personal data has been compromised, and you could become a victim of fraud – hence this is a major cause for concern. Here's what you need to know about these scams, including how to protect yourself from falling prey to them.
How do package scams work?
Shipping fraud scams can be simple or elaborate – either way, they can be very convincing if you don't know what to look out for. Most are text message scams, but they can also happen over email or sometimes without you receiving any communication at all. Take a look at these common types of package scams below.
1. Text messages about a package you never ordered
In most cases, alarm bells will go off if you receive a text about something you didn't order in the first place. But there are instances when you might just be about to order something or have placed an order for a different product – and the message suddenly looks genuine.
In a scam like this, the texts will attempt to defraud you by:
Asking for personal information that was 'missing' when you placed the order and is now needed to complete the delivery.
Claiming that there was a problem with delivery (such as it being missed by you or routed to an incorrect address), thus asking that you reply to the postal service to reschedule it.
Claiming there is a hold-up with the delivery that requires you to complete a security check, which involves sharing personal information.
Encouraging you to click a link to track your package or make a small payment to reschedule delivery (hence taking you to a fake website or triggering malware download).
2. Fake tracking number text
This scam can occur when you order and pay for something online, but your purchase doesn't arrive. So you contact the seller to chase up delivery and eventually receive a shipping notification text with a fake tracking link or number. This can either suggest the package is on its way or has already been delivered. But in reality, the order never arrives because the seller is a scammer. Often, you don't get your money back either unless you've paid via a platform that offers payment protection, like PayPal.
3. Prize scams
If you receive a text message saying you've won a prize or sweepstake, it probably is too good to be true. Often, these messages ask you to pay a small shipping and handling fee so your prize can be issued. But then a substantial sum of money is deducted from your bank account without your permission.
4. An unexpected package actually arrives at your address
When you receive a parcel at your address that you haven't ordered, you might feel fortunate – almost like you've received a free gift! However, this is usually the sign of an elaborate scam called 'brushing', where dodgy ecommerce sellers use your personal details to boost their sales rankings and reviews.
Why would a scammer send me a package?
It works like this: a fraudster uses your personal details to place an order and then writes a fake 5-star review to artificially inflate ratings, increasing their chances of selling more products. They may only need your name and address for this type of scam. While the scam won't directly affect you at first (as you won't receive any communication, just a parcel), it does mean that your personal data has been compromised and could lead to other scams later down the line. If this happens to you, take steps to protect your personal data ASAP.
How and why delivery scams occur
The goal of delivery scams is to collect personal information from unsuspecting victims, such as social security numbers, home or email addresses, credit card details, location details and device information. This information is then misused for identity theft, financial fraud, etc.
Such scams typically involve impersonating a well-known courier service because the big brand delivery companies convey trust. Scam messages will create a sense of urgency (overusing capital letters and exclamation marks) to try to get the recipient to click on a shady link, leading to a fake payment portal or online form designed to look legitimate. These links can also install malware onto your device – opening the door for fraudsters to steal sensitive information or send unwanted ads or messages.
How to stay safe from text message delivery scammers
There are some particular red flags that can help you spot whether you've been sent a text message delivery scam.
Suspicious-looking URLs – if the SMS hyperlink contains random characters rather than a proper domain name, e.g. www.rz-dxoasdl8.com. Note that shortened URLs can also be suspicious – they're sometimes used in smishing attacks. These types of malicious links can be tricky to verify as many genuine businesses use link shorteners due to length constraints.
Spelling or grammatical errors – ensure the spelling of the sender's website domain is correct and exactly matches that of the brand that's supposedly messaging. For example, the United States Postal Service (USPS) would never address itself as US PS or US:PS. The same goes for URLs. The legitimate URL for USPS is www.usps.com – whereas us-ps.com or usps.org are fake.
Suspicious Sender ID – check whether the name or number the SMS appears to be coming from is genuine. For example, a scam number may come from an area code you don't recognise, and a dodgy branded sender name might have a typo in it. So instead of 'Domino's', your text might come from 'Dominoes' or 'Domiinos' (not legit).
Inconsistencies in content or design – if you get several very different messages professing to be from a big-name brand, this can also be a warning sign.
Any text asking for sensitive data – legitimate companies won't ask you to submit any personal details by text.
Messages saying you're a winner – virtually all texts saying you've won something will be a scam.
Always verify any tracking IDs or numbers provided in a text message on the original service provider’s official website or tracking portal. If you know you're not expecting any deliveries, trust yourself and go with your gut – resist the urge to click suspicious links! Disengage with the text message at the first sign of suspicion: block, report and delete.
Bonus tip: set up two-factor SMS verification to ensure scammers can’t log into your personal bank accounts or access other private information even if they do manage to steal some of your credentials.
How to report delivery scams to the authorities
In the United States, you can report delivery scams to the Federal Trade Commission (FTC) and FCC. Do also email specific delivery services such as USPS, FedEx, DHL or UPS with the relevant details – these companies all have fraud reporting mechanisms in place. Finally, report spam texts to 7726 using the keyword 'SPAM'.
Protect yourself from delivery service scams
Fraudsters and cybercriminals will use any tactic available to them to try and steal your personal data. Parcel delivery scams are one to be aware of. By knowing what to look out for – the types of unsolicited mobile text messages and emails with any of those above red flags, and even unexpected parcels arriving on your doorstep – you can take the necessary steps to protect yourself.
If you receive a suspicious text message, block the number, report the sender to the relevant authorities and then delete the message from your SMS inbox. Change your online passwords at your earliest opportunity, as a phishing scam message or the arrival of an unexpected parcel may indicate your personal details have been unlawfully accessed.
Related reading: Can Blocked Numbers Text You?
