Technique

Package Delivery Scam

Also known as: Delivery Notification Scam, USPS Smishing, FedEx Text Scam, Shipping Notification Phishing, Fake Package Text, Package Tracking Scam, Parcel Delivery Scam

DELIVERY

Fake shipping notifications via SMS or email claiming delivery issues to harvest credentials or payment information.

Common attack flows

How it fits in a scam

This technique shows up duringDELIVERY

Before

Data Breach HarvestingTARGETING
Data BrokersTARGETING

After

Credential TheftCOMPROMISE

Defense

How to defend against this

How to spot it

Unexpected messages about packages you don't recall ordering
Any link in USPS text (real USPS never sends links without customer request)
Requests for small delivery fees (.99-.99)
Suspicious URLs mimicking carriers (e.g. royalmail-bill.com)
Urgency about packages being returned to sender
Requests for personal/payment info via text link
Messages from unfamiliar numbers about delivery issues