“Your parcel couldn’t be delivered. Pay a small fee to rearrange delivery.” Texts like this are one of the most common scams in the world. In the US, fake package delivery problems were the most commonly reported type of text scam in 2024, and people reported losing US$470 million to scams that started with a text that year (FTC, April 2025). The fee is tiny on purpose: the real goal is your card number, your personal details, or getting you to install a malicious app.
What these texts look like
- “We attempted to deliver your package but no one was home. Reschedule here: [link]”
- “Your parcel is held at our depot due to an incomplete address. Update within 12 hours or it will be returned.”
- “A customs fee of $2.99 is due before we can deliver your item.”
- “Download our tracking app to see your delivery.”
They use the names of real carriers: Australia Post, USPS, Royal Mail, NZ Post, DHL, FedEx, UPS, Evri, DPD and others. The link leads to a convincing copy of the carrier’s website.
7 signs a delivery text is fake
- It asks you to pay. Australia Post says it will never call, text or email to request payment (Australia Post). Royal Mail says it doesn’t ask for payment for underpaid items by text or email and leaves a grey “Fee to Pay” card instead; the exception is customs charges, where it may text if the sender gave your details (Royal Mail).
- You never asked for tracking texts. USPS only texts people who signed up for tracking with a tracking number, and those texts won’t contain a link (USPIS).
- The link isn’t the carrier’s real website. Look for extra words, odd endings or short links. NZ Post, for example, says its links only go to nzpost.co.nz or its nzp.st short links (NZ Post).
- It comes from an overseas or random number. NZ Post says it never texts from a number outside New Zealand (NZ Post). Australia Post warns about texts marked “Unverified” or from unfamiliar numbers (Australia Post).
- It’s urgent. “Within 12 hours or your parcel will be returned” is designed to stop you thinking.
- It asks you to install an app. Netsafe warns that some delivery texts try to put a malicious app on your phone (Netsafe).
- It arrives on WhatsApp or another chat app. NZ Post says it doesn’t use apps like WhatsApp to contact customers (NZ Post).
How to check a parcel safely
Ignore the link. Open the carrier’s official app, or type its address into your browser yourself, and enter the tracking number from your order confirmation. If there’s really a problem, it will show there. You can also paste the sender’s number into our free scam phone number checker to see where it’s from and whether other people have reported it.
What to do if you clicked or paid
- Entered card details or paid? Call your bank or card provider now, on the number on the back of your card. Ask them to block the card and dispute the payment. Watch your statement for small “test” charges, which often come first.
- Typed in a password? Change it straight away, plus anywhere else you used the same password, and turn on two-factor authentication. Our guide on checking if your email was in a data breach walks through it.
- Gave your name, address, date of birth or ID? Expect follow-up scam calls, texts and emails that use those details. In Australia and New Zealand, IDCARE offers free identity support; in the US, IdentityTheft.gov has a recovery plan.
- Installed an app? Delete it, check for apps you don’t recognise, and change your banking and email passwords from another device.
- Report it (see below), then delete the text.
Where to report fake delivery texts
- Australia: report it to Scamwatch, and send Australia Post scams to scams@auspost.com.au (Australia Post). If you lost money, also use ReportCyber.
- United States: forward the text to 7726 (SPAM) and report it at ReportFraud.ftc.gov. For USPS texts, also email spam@uspis.gov with a screenshot showing the sender and date (USPIS).
- United Kingdom: forward the text to 7726 for free, send a screenshot of Royal Mail scams to reportascam@royalmail.com (Royal Mail), and report losses to Action Fraud.
- New Zealand: forward the text free to 7726 (the Department of Internal Affairs), then reply with the sender’s number (DIA). Get advice from Netsafe, and call your bank if you paid.
Related: is this a scam number?, unpaid toll text scams and how to check if an email is really from a company (the same tricks turn up in fake delivery emails).
Questions
I’m expecting a parcel. Could the text be real?
It could, which is exactly why scammers send these texts to everyone. Don’t use the link. Track the parcel in the carrier’s own app, or type its website address yourself and use the tracking number from the shop that sent it.
Do Australia Post, USPS or Royal Mail charge redelivery fees by text?
Australia Post says it will never call, text or email you to request payment. USPS says it only texts people who asked for tracking with a tracking number, and those texts have no links. Royal Mail says it doesn’t ask for payment for underpaid items by email or text and leaves a grey “Fee to Pay” card instead, though it may text about customs charges if the sender gave your details.
I clicked the link but didn’t enter anything. Am I OK?
Usually the bigger risk comes from typing in details, but close the page, don’t install anything it offers, and run your phone’s updates. USPS advises telling your bank if you interacted with a scam link at all, even without pressing submit.
The text asked me to install a tracking app. What now?
Don’t install it. If you already did, delete the app, check your phone’s settings for unknown apps with special permissions, and change passwords for banking and email from a different device. Your phone shop or carrier can help if you’re unsure.
Will my bank refund a fake delivery fee?
Call your bank or card provider straight away. They can block the card and tell you whether they can dispute or refund the payment. The sooner you call, the better the chance.
Check the number, then protect yourself
Paste the sender’s number into our free scam phone checker to see its country, line type and reports from other people. ImposterWatch Personal (US$9/month) adds breach alerts for up to three personal email addresses, account recovery help if a scammer gets into an account, and one AI-powered romance scam check a month.
Check the number freeGet Personal for US$9/monthMore guides
- Fake job applicants and deepfake interviews
- What is DMARC and do I need it?
- How to stop someone spoofing your email domain
- Lookalike domain examples
- Fake invoice email scams: how to spot one
- Hacked Facebook business page: what to do
- Is this a scam number? How to check
- Unpaid toll text scams (E-ZPass, Linkt and more)
- All guides
General information only, not legal or financial advice. ImposterWatch is operated by Cloud Investments FZE (UAE) and is not a background check or private investigator service.