Delivery, refund and logistics scams
Delivery scams work on timing, not persuasion. Almost everyone is waiting for a package, so a message about one arrives already half-believed.
What it is
A delivery scam is a message claiming there is a problem with a package. A fee is owed, an address needs confirming, redelivery must be scheduled, customs is holding it.
It is the highest-volume scam type by a wide margin, and it works on numbers rather than on any single victim. The sender does not know whether you are expecting a parcel. They know that most people are, most of the time.
What they want is small and specific: a card number entered on a page that looks like the carrier's, or a login, or a small fee that captures the card. The fee is often a dollar or two, because a trivial amount attracts less scrutiny than a large one, and the card details are the actual prize.
How it starts
A text message, most often. Sometimes email, sometimes a WhatsApp message, occasionally a voicemail or a card through the door with a phone number on it.
The carrier named is whichever is most common where you live: USPS, UPS, FedEx, DHL, Amazon. The message is short, mildly urgent, and contains a link. Tracking numbers look plausible. Some messages carry no link at all and ask you to reply, which starts a conversation with a person.
The link goes to a page that is a close copy of the carrier's site, occasionally an exact one, on a domain that is close but wrong: a hyphen added, a letter substituted, or a legitimate-looking subdomain on a domain the operator owns.
A related variant runs in the other direction. A refund is owed to you, from a retailer, a bank or a service you cancelled, and to receive it you provide card or account details. The emotional register is pleasant rather than urgent, which is why it often gets less scrutiny.
Why it works
The message arrives into an existing expectation. You do not have to be persuaded that a package might exist. You already believe it. The message only has to be plausible enough not to interrupt that belief.
The ask is trivially small. A $1.99 redelivery fee does not trigger the caution a large payment would. The amount is not the objective. Your card is.
It takes ten seconds to comply and longer to check. Verifying means finding the tracking number, going to the carrier's real site, and looking it up. Tapping the link is faster, and the message is designed to be read while doing something else.
Volume beats precision. These campaigns are sent in the millions. A response rate far below one per cent is still a large business, which is why the same message keeps arriving.
The brand does the work. You are not evaluating a stranger. You are looking at a logo you have seen a thousand times.
How to spot it
A fee is requested for redelivery or customs. US carriers do not text you asking for a payment card to release a domestic parcel
The link domain is not the carrier's own. Check the part immediately before the first single slash, not the words around it
The message arrived from a random mobile number, an email address, or an overseas number
You are not actually expecting anything, or not from that carrier
The tracking number does not resolve on the carrier's real website
Urgency: the parcel will be returned today, held for 48 hours, or destroyed
Personal detail is missing. Real carrier notifications usually reference something specific to your order
Small spelling, spacing or grammatical errors, though the better ones now have none
What to do
Never use the link. Go to the carrier's own app or website and enter the tracking number there. If there is no shipment, there is no problem to solve.
If you tapped the link but entered nothing. Little or no harm in most cases. Close the page, do not return to it, and watch for follow-up messages, since responding marks your number as live.
If you entered card details. Call your bank now, using the number on the back of your card, and say the card is compromised. Ask for it to be cancelled and reissued. Then check for a small test charge, which is usually what appears first.
If you entered a password. Change it immediately, and change it anywhere else you have used it. Turn on two-factor authentication on the account and on your email.
Report it. Forward the text to 7726, which is free and reaches your carrier's spam team. Then delete it.
Stop the next one. Delivery scams surge around holidays and sale periods. The message will look different next time; the shape will not.
---
Have this emailed to you
Send yourself this page so you can forward it, or read it later when you are not standing in a shop.
Email it to myselfPaste a text, email or direct message
A text, an email or a chat message. Take out names and account numbers first.
Add a screenshot
Check it
No account needed.
What happens to your message
Checking the message now. Stay on this page.
Flggd could not check this message just now. Try again in a moment, or use the Flggd app.
Try again
Flggd could not read this image, so it has not been checked. This is not a verdict. Try a clearer screenshot, or paste the text instead.
Paste a message or add a screenshot first.
Text Submission
Image Submission
Flggd Verdict
Scam
Red flag
High confidence of a scam. The content, the sender, the intent and where its requests lead all point the same way. Do not reply, click, call or pay.
Likely to be a scam
Yellow flag
It asks you to act: a link, a number, a reply or a payment. Where that request leads is where the harm starts.
Looks normal
Green flag
High confidence this is normal. The content reads as expected, the sender has a safe history, and anything it asks leads somewhere legitimate. Accounts can be taken over, so if a request seems out of character, check again.
Likely to be a scam
Grey flag
Nothing is asked of you yet. The content, the sender or the intent do not add up. Scams like this start friendly and ask later.
This result could not be shown. Check the message again. If it happens twice, use the Flggd app instead.
Score
Scam type
Confidence
Why Flggd says this
What this message wants you to do
Has anything happened yet?
You do not have to answer. Nothing you tap here is sent or recorded, and the verdict above stands either way.
Change answer
Nothing has happened yet
Good. Checking first is the safest thing to do. Do not tap any link, reply, or call any number in the message. Block the sender and delete the message. If it claims to be from an organisation you know, contact them using details you already trust.
Change answer
You tapped a link
Opening a link does not usually take money or details on its own. The harm comes from what you do on the page it opens. If you entered nothing and installed nothing, close the page and do not go back to it. If it asked you to sign in, enter a code, or install something, and you did, choose Gave details instead.
Change answer
You gave details
Work through this in order. First, if you gave bank or card details, call your bank now on the number on your card. Next, change the password for any account you entered, and for any other account that uses the same password. If you shared a one-time code, tell the organisation it belongs to straight away. Then turn on two-step verification where you can, and watch your statements for anything you do not recognise.
Change answer
You sent money
Call your bank now, on the number on your card or in your banking app. Say: "I have been scammed and I need to stop a payment." The sooner they hear from you, the more they may be able to stop or recover. In the UK you can call 159 to reach your bank. Do not pay anyone who offers to get the money back. That is another scam.
Report it. US: ReportFraud.ftc.gov, and ic3.gov for online crime. UK: reportfraud.police.uk or 0300 123 2040; in Scotland, Police Scotland on 101. Australia: scamwatch.gov.au. Have ready the message, the sender's number or address, and any payment details.
What to do next
Do not reply, click any link, call any number in the message or send money. If it claims to be from an organisation you know, contact them using details you already trust.
Do not reply, click any link, call any number in the message or send money. If it claims to be from an organisation you know, contact them using details you already trust.
No action needed. If the sender later asks for money, codes or personal details, check that message too.
Do not reply at all, not even to say wrong number. A reply tells them the number is live. Block the sender and delete the message. If a request follows, check it again.
Text read from your image
Your image
The closest scam in the Flggd library. Similar, not necessarily the same message.
How this scam works
The closest match is the scam described on this page.
Share this result
Email it to myself
Copied. Paste it anywhere to share it.
Could not copy. Select the text and copy it, or use Email it to myself.
Checked with Flggd at flggd.com
My Flggd verdict
Check the next one on your phone
The Flggd app checks texts, emails and screenshots wherever you are, and teaches you the warning signs as you go. Free on iPhone and Android.
Get the app
What Flggd does about this
Worried about someone else rather than yourself?
Helping someone else
