What is changing now
The current pattern.
Delivery smishing remains a common text-message lure. The message may mention unpaid postage, an incomplete address, a missed delivery or a final chance to reschedule. The small fee makes the page feel low risk while the form collects much more valuable information.
How it works
Confidence first, then pressure.
Scammers send large numbers of messages because many recipients are expecting a parcel. The timing does not need to be precise: normal online shopping makes the story relevant to a wide audience.
The link opens a look-alike carrier or postal page and asks for an address, card details or an account sign-in. Some pages add a countdown or claim the parcel will be returned. Information entered into the form can be used for unauthorised payments, identity fraud or more convincing follow-up calls.
The real question is not whether you expect a parcel. It is whether the delivery can be confirmed independently through the retailer, a known tracking number or the carrier’s official service.
Warning signs
Reasons to stop and verify.
- An unexpected text with a shortened, misspelled or unfamiliar link
- A small redelivery, customs, address-correction or unpaid-postage fee
- A threat that the parcel will be destroyed or returned immediately
- A request for card details before showing verifiable tracking information
- A generic greeting with no retailer, order number or recognisable shipment
- A sender that asks you to reply or move to a different messaging app
Safer response
Move the decision outside the contact.
- 01
Check the order account
Open the retailer’s app or website from your own bookmark and review the order status there.
- 02
Use known tracking
Type the carrier’s official address yourself and enter the tracking number from the original purchase confirmation.
- 03
Do not test the card form
A small amount does not make the page safe. Do not enter information to see whether the payment succeeds.
- 04
Report and delete
Use the phone’s report-junk feature or forward unwanted texts to 7726 where that reporting service is supported.
If you already acted
Protect access and contact the real provider.
- Contact the card issuer immediately if card details were entered.
- Change any reused or submitted password through the real service.
- Watch for follow-up calls that reference the information entered on the fake page.
- Review statements and account alerts rather than waiting for a visible fraudulent charge.
- Report the fake message to the carrier or postal service using its official website.
Sources
Official guidance used for this article.
Stop & Verify summarises these sources for general education. Reporting routes and legal protections vary by location.