If a delivery text says your parcel needs an address correction or payment, open the retailer’s order history or the carrier’s official app yourself instead of following the message’s link. Match the shipment to an order you recognize, then investigate any problem through that independent route. Expecting a parcel makes a message plausible; it does not establish who sent it.
A real order and a fake message can arrive together
Imagine you are waiting for a replacement charger when a text announces that a parcel cannot be delivered. The timing feels specific, but the text has not demonstrated a connection to that purchase. In this hypothetical situation, the useful evidence is the carrier and tracking reference in your existing order record, not the coincidence that something is on its way.
Phishing is an attempt to obtain information or access by pretending to be a trusted sender; the text-message version is often called smishing. The U.S. Postal Inspection Service describes messages that impersonate package tracking and lead people toward unfamiliar links. The small inconvenience in the story—fix an address, pay a fee, prevent a return—can distract from the larger request for personal or payment details.
📦 Start inside the purchase record
Open an app you already use for that retailer, or enter its known website address yourself. Find the relevant order and its shipment details. If you need the carrier, reach its official service independently and use the tracking number from the order record, rather than a number or contact button supplied only by the suspicious text. The Federal Trade Commission recommends contacting a company through a website or phone number you know is genuine.
Check whether the carrier, destination and reported problem fit that particular shipment. If the order record does not settle the question, contact the retailer or carrier through its established support route. An absent update is a reason to ask there, not a reason to return to the text and try its payment page. Keep the order confirmation available; the purchase-proof habits in our paper-receipts guide also help connect a delivery question to the correct transaction.
A payment request needs verification, not a universal rule
It would be convenient if every delivery-related payment text were automatically fake. Carrier practices are more complicated: FedEx’s U.S. fraud guidance says international recipients may receive email or SMS links for applicable duties and taxes, and directs customers to verify the message and amount through its Import Tool. That is a specific exception, not permission to trust any text displaying the FedEx name.
This is why independent verification is a stronger habit than memorizing one suspicious phrase. The UK National Cyber Security Centre warns that scams can look convincing and use pressure or emotion to rush a decision. A neat logo, familiar wording or a tiny requested amount does not replace checking the actual shipment. The worry about losing a parcel is understandable; allowing that worry to choose the route to your account is the part to interrupt.
Already responded? Separate the exposure from the fear
Close the suspicious page and stop interacting with the sender. Write down what happened: opening a page, typing a password, supplying payment details and installing software are different actions that call for different responses. Do not assume a click proves an account was taken over, but do not use the absence of an immediate charge as proof that nothing needs attention.
If you supplied a password, change it on the real service and on other accounts where you reused it. If you shared bank or card details, contact the bank or card provider through its official app or the number on your card. The NCSC recommends responding according to the information exposed; after opening a link on a computer or installing software, it advises running a full antivirus scan if that software is available.
Use your device maker’s security guidance if software was installed on a phone, and tell workplace IT promptly if an employer’s device or account was involved. Report the suspicious message through your messaging app or the appropriate local reporting service, then block or delete it as directed. Reporting routes differ by country. Our passkey and account-recovery guide explains why securing the next sign-in also requires a usable recovery plan.
Keep the message out of the verification route
For the next parcel you are expecting, find its order record before any warning arrives. Keep the retailer, carrier and tracking reference together in a private place you can reach easily. Then a troubling text becomes a prompt to check an existing record, rather than the doorway through which you must solve the problem.
Should I reply to the sender to ask whether the text is genuine?
Use the retailer or carrier’s independently obtained contact route instead. Asking the sender to confirm itself adds no independent evidence, and a plausible reply still leaves the original identity unverified.
Sources & further reading
Source material reviewed Oct 21, 2026. Source names are provided as plain text. Worked examples and editorial interpretations are identified in the text.
- Federal Trade Commission: How To Recognize and Avoid Phishing Scams
- United States Postal Inspection Service: Smishing — Package Tracking Text Scams
- FedEx: How to Recognize and Help Prevent Fraud and Scams
- UK National Cyber Security Centre: How to Spot a Scam Email, Text Message or Call
- UK National Cyber Security Centre: Phishing Scams — If You Have Shared Sensitive Information
Join the conversation
What would you add, question or explain differently? Please discuss the idea and respect the person.
Comments are screened for spam and abuse. Some are held for review. We store your comment and a daily security identifier; see privacy. Keep personal contact details out of your comment.