How to spot a package delivery scam and verify it

A package delivery scam is a fake text, email, call, QR code, tracking page, or doorstep note that tries to make you click, pay, or share account details before you verify the delivery. The safest move is to stop, check the shipment in the carrier app, a bookmarked carrier site, or your retailer account, and ignore the contact details in the message itself. If you already clicked, paid, scanned, or entered information, treat it as a security problem and start cleanup right away.

If they pressure you to pay or click, assume it is suspicious

Treat any urgent delivery message as suspicious until you verify it yourself. Real shipping problems happen, but scammers usually push fast action, a link, a QR code, a phone number, or a payment request.

If the message says your parcel is held, missed, delayed, returned, waiting on customs, or blocked by a fee, pause before you act.

A delivery message is suspicious before you click anything if it does one or more of these things:

• It pushes you to act right now.
• It asks for a small redelivery, customs, or unpaid-fee payment.
• It wants you to call a number, scan a QR code, or open a tracking link.
• It uses vague wording instead of a clear order number, carrier reference, or account detail you recognize.
• It asks for personal details that a delivery company should not need just to show status.

Here is the common pattern by format:

Fake customs, redelivery, and unpaid-fee claims are especially common. They sound plausible, and they create pressure. A real carrier or retailer may need you to confirm an address, delivery window, or customs paperwork. Still, verify that claim through your own account or a trusted official channel before you pay anything. If the only place you see the fee is inside the message that asked for it, treat that as a red flag.

Check the shipment without touching their link or number

Verify delivery through a route you already trust. Do not use the message’s link, phone number, QR code, or callback instructions. Open the carrier app, a bookmarked carrier site, or the retailer’s own account page by typing it yourself or using a saved app.

1. Open the carrier app or the retailer account you normally use.

2. Sign in by going directly to that app or site, not through the message.

3. Check the tracking number in your account, or the retailer’s order history.

4. Compare the shipment status with the claim in the message.

5. If the shipment is real, use the contact details inside the carrier app or on the official site if you need help.

If you do not recognize the sender but the message names USPS, UPS, FedEx, Amazon, DHL, or Royal Mail, still verify through your own account first. A real shipping notification can exist, but the message itself may still be fake. The safest move is to leave the message alone and go to the carrier or retailer through a route you already trust.

If the scam arrived as a voicemail, do not call the number back from the message. Instead, find the carrier or retailer’s official support number yourself and check whether there is any open delivery issue on your account. If the scam came as an app notification, open the carrier or retailer app directly from your phone, not from the notification, and compare the status there. If a QR code was left at your door, treat it like a link from a stranger: do not scan it unless you can verify the delivery through an official account first.

What to do if you already clicked, paid, scanned, or shared details

Stop interacting right away if you clicked, scanned, entered information, or paid a fee. Don’t reply to the message, and don’t use the same page again to try to fix it.

1. Close the page or app and stop any back-and-forth with the sender.

2. If you entered a password, change it on the real site or app you trust.

3. If you used the same password anywhere else, change those accounts too.

4. If you entered a one-time code, assume the account may be at risk and review sign-in activity.

5. If you shared card numbers, login details, or ID information, contact the relevant provider right away and ask what protection steps are available.

6. If money moved, contact your bank, card issuer, or payment app right away using the number or support path on your card or official app.

7. Watch for takeover signs such as new logins, password reset emails you did not request, delivery-address changes, or new cards and payment methods you did not add.

A small payment in a redelivery fee scam can still be a real financial loss, and it can also mean the page was collecting card details. If you paid by bank card or payment app, ask the provider whether a dispute or chargeback step is available.

If you opened a file or installed anything from the link, run a security check with your device’s built-in protections or your trusted security software. Then remove anything unfamiliar. Change important passwords from a clean device if you think your phone or computer may be exposed. If you used the same password in other accounts, update those too.

What information you should never give in a delivery message

Never give passwords, one-time codes, card numbers, login details, or identity information in response to a delivery message. Legitimate carriers do not need your account password in a text thread, and they do not need a one-time code sent to your phone to release a parcel.

Be careful with login links, too. If a message asks you to “confirm your details” or “verify your account,” that is a common phishing move. Scammers often want enough personal data to take over accounts, redirect packages, or open credit in your name.

That includes full card details, government ID numbers, photos of ID, address history, and any code sent by text, email, or an authenticator app. A real delivery issue may need a valid tracking number or a delivery preference, but not your secret login information.

How to report it and clean up after exposure

Report the scam through the carrier, retailer, bank, or payment app involved, using official support channels you already trust. If the message pretended to be USPS, UPS, FedEx, DHL, Royal Mail, Amazon, or another retailer, report the fake text, email, voicemail, QR code, or doorstep notice to that company’s fraud or abuse path if one is available.

Also report the payment side. If you entered card details or sent money, contact the bank or payment provider immediately and ask what protection steps are available. If the scam arrived by text or voicemail, keep the message and any number or email header you can still see, since that may help with reporting.

If the message arrived in an app notification, use the app’s built-in report or block tools if they exist. Then check whether the notification matched anything in your account. If the message came from a QR code at your door, take a photo of the notice before discarding it if you still need evidence for a report.

If you opened a file or installed anything from the link, run a security check with your device’s built-in protections or your trusted security software. Then remove anything unfamiliar. Change important passwords from a clean device if you think your phone or computer may be exposed. If you used the same password in other accounts, update those too.

You are done when the message is ignored, the shipment is verified, and your accounts look normal

You are reasonably safe to move on once you have ignored the scam message, checked the real shipment through your own carrier or retailer account, and confirmed your payment and login activity look normal. If the package was real, the official account should show the true status without asking for a surprise fee or secret code.

You should act again only if you see a new payment, a password reset you did not ask for, a changed shipping address, or another message using the same trick. If none of that is happening, and you verified the delivery through a trusted source, you have handled the scam the right way.