Delivery messages and scam links: how to check a parcel message before clicking

Delivery messages and scam links: check these before clicking

Parcel scams work well because many people are genuinely expecting a delivery. Criminals imitate the communications of carriers and online stores.

A typical structure

The message claims, for example, that:

• the address is incomplete
• the parcel is waiting for a small payment
• the delivery failed
• the parcel will soon be returned.

The aim is to get the user to open a link and enter their details.

Check the shipment without using the link in the message

Open the carrier's official app or type the address of its website yourself. Enter the tracking number there.

The sender's name does not prove authenticity

The sender name of a text message or the visible sender of an email can be forged or imitated.

Urgency is a warning sign

A scam often tries to force you to act immediately. It is safer to spend a moment checking a genuine shipment than to pay a "redirection fee" of a few euros on the wrong site.

If you clicked but did not enter any details

Close the page. If you downloaded a file or installed something, the situation is different and the device should be checked.

If you entered payment details

Contact your bank or payment service quickly and follow their instructions.

Source

National Cyber Security Centre Finland (Kyberturvallisuuskeskus): phishing and scam messages distributed in the names of organisations.

The URL tells you more than the logo in the message

A scam site can have a perfect copy of a carrier's logo. Check the address bar of your browser. A single wrong letter or an unusual domain can give the site away.

A short link hides the destination

A short URL used in a text message can prevent you from seeing the real destination before opening it. If the message concerns a real parcel, you should be able to check the same thing in the official app or on the tracking page without the link.

A "small fee" is an effective trap

A payment of a few euros feels harmless, but the form often asks for card details that can later be used for larger charges.

If you entered a password

Change the password quickly in the genuine service and in all other services where the same password is in use. Enable multi-factor authentication if the service offers it.

Check the tracking number before making any payment

If the message claims to concern a parcel, enter its tracking number in the official service. If the code cannot be found or the shipment requires no action, there is no reason to trust the payment request in the message.

A real parcel does not automatically make the message genuine

A scammer may happen to hit a moment when you are expecting a delivery. Always check tracking from the official service, even if the timing of the message looks perfect.

A scam message often tries to create urgency

A typical message claims that the parcel will be returned, the address is wrong or a small fee must be paid immediately. The purpose of the urgency is to get the recipient to open the link without checking it.

If a message takes you by surprise, do not act through it. Open the carrier's official service separately.

The sender's name does not prove the message is genuine

The sender name of a text message or the visible name of an email can be forged. Check the actual domain and the tracking code.

A scam message that appears inside an existing message thread can look especially convincing.

A small "delivery fee" is a common trap

A scam site may ask for a payment of 1–3 euros and collect your card details at the same time. If a genuine shipment requires an additional fee, check it in the carrier's official service or with the seller.

Do not enter card details on a page opened from a message link just because the amount is small.

Read the spelling of the domain slowly

A scam address can differ from the genuine one by a single letter or use a familiar name as part of a long subdomain. Look at the actual main domain, not just the beginning of the address.

If you are suspicious, type the company's address into the browser yourself or use the official app.

The tracking code is a good way to verify

If the message contains a tracking code, enter it on the carrier's genuine website. If the code cannot be found or the shipment does not match the order you were expecting, the message should not be considered genuine.

Remember, however, that a scam message can sometimes contain a genuine-looking code, so other checks are still necessary.

Do not log in to your bank through a link in a message

Bank or payment confirmation is done in the bank's own app or on a page you open yourself. If a message asks for online banking credentials to release a parcel, it is a very strong warning sign.

A carrier does not need your banking credentials to prove your identity through a message link.

What to do if you clicked but did not enter any details?

Close the page. If you did not download a file, install an app or enter credentials, the risk is usually lower. Even so, check your browser downloads and any notification permissions.

If you entered passwords, change them immediately in the genuine service.

What to do if you gave your card details?

Contact your bank or card issuer quickly through their official channel. They can advise you on closing the card and monitoring transactions.

Do not continue the conversation with the scam site or the sender of the message.

It is worth reporting a scam message

You can report the message to the carrier and, if necessary, to the authorities or a cyber security organisation. This helps identify campaigns and protect other users.

Delete the message only after you have saved the information needed for the report.

The best protection is routine

When you receive a delivery message: do not rush, open the official tracking yourself, check the code and only then act. The same four-step routine works for almost all parcel scams.

Technical checklist for a scam message

When a message seems suspicious, check four things before doing anything: the sender's real address or number, the main domain of the link, the tracking code claimed in the message, and whether the same event can be found in the carrier's own service. If even one point does not match, do not enter any details.

The grammar of a message is no longer a good measure of reliability, because scam messages can be very polished and written in the local language.

A QR code can lead to the same scam site as a text link

A QR code on a parcel or in an email should be treated like any other link. Check the domain that opens in the browser before logging in or paying.

Do not assume that a physical letter or sticker automatically makes a QR code genuine.

Do not ignore a browser warning in a hurry

If the browser warns about an untrusted certificate, a harmful site or a suspicious download, stop. Do not choose "continue anyway" just because the message claims the parcel will soon be returned.

Open the official service separately.

A scam can use genuine delivery information

A data breach or a public tracking link can give a scammer the information that you are expecting a parcel. That is why a correct name or even the correct carrier in the message does not alone prove authenticity.

Official tracking is still the best place to check.

Payment card transaction alerts help quickly

Notifications from the bank or card service about new payments can reveal misuse immediately. If you see an unknown charge after a scam link, contact your bank through its official app or number.

Quick reaction is more important than conversing with the sender of the message.

For organisations, a scam message should be reported internally

If you use a work phone or company email, report the message to the IT or information security team. The same campaign may be targeting other employees.

Do not send a suspicious link to colleagues to click; use the company's reporting function instead.

In a parcel scam, personal information can add credibility

The message may contain your own name, your town or even an order reference that looks genuine. Such information does not make a link safe. What matters is whether the same shipment can be found in the carrier's official service that you open yourself.

Keep a suspicious message before reporting it

Take a screenshot of the sender, the content of the message and the visible link without opening it. This helps the bank, carrier or information security organisation understand what kind of campaign is involved.

Previewing the link in a message can reveal a fake domain

On a computer, you can often see the address by hovering the mouse over the link without clicking. On a phone, a long press may show the destination address. If the domain does not match the carrier's official address, do not open the link.

A scam site can also imitate a carrier's tracking

A genuine-looking logo, map or parcel status bar alone does not prove that the site is real. Always check the main domain and compare the information with the carrier's official service that you open yourself.

Also, do not automatically assume that the first result from browser history or a search engine ad link is genuine.

A request to install an app in a parcel message is a strong warning sign

Ordinary shipment tracking does not usually require installing an unknown APK, profile or other app file from a message link. Use only your device's official app store and look for the carrier's app yourself.

Do not grant extra device management or accessibility permissions in order to track a delivery.

In a scam situation, the most important thing is to break the chain quickly

If you gave credentials, change the password in the genuine service. If you gave payment details, contact your bank. If you installed a suspicious app, disconnect the device from the network if necessary and ask for reliable technical help.

Quick reaction is more useful than continued messaging with the scammer.

You do not need to use the link in a parcel message at all

The safest way to check a shipment is to open the carrier's own app or type the address of its website into the browser yourself. You can enter the tracking number there. This way you do not have to assess the authenticity of a text message or email link in a hurry.

A scam message often tries to create urgency

The message may claim that the parcel will be returned in a few hours, the address must be confirmed immediately or a small payment must be made right away. The feeling of urgency is exactly how users are pushed to act before checking.

It is always worth comparing the details of a real order with the original order confirmation.

The sender's name alone does not prove the message is genuine

The sender name of a text message or the visible sender name of an email can be imitated. More important are the address of the link, the content of the message and whether the message actually corresponds to an expected delivery.

If no order is on its way at all, there is no need to open or pay anything in a parcel message.

Be suspicious of a small extra fee if it was not agreed in the order

Scam messages often ask for a very small amount so that the payment feels harmless. The real risk, however, can be the collection of card details. It is not worth making a payment from a message link if it cannot be confirmed in the carrier's official service.

A tracking number helps verify the message

If the message shows a tracking number, you can compare it with the online store's shipping confirmation. A different number, or a missing number altogether, is a reason to check before acting.

Delete a suspicious message only after documenting it

If you want to report a scam to the bank, the carrier or the authorities, a screenshot of the message and the link address can be useful. You do not need to open the link for documentation.

Check the authenticity of a message at three points

The first question is whether you are genuinely expecting a parcel. The second is whether the tracking number matches your own order. The third is whether the same information can be found in the carrier's official service. If any of these does not match, the link in the message should not be used.

A QR code can equally lead to a scam site

Not all risks come as an ordinary link. A QR code in a message or on a slip of paper can open a website in the same way. After scanning a code, check the address bar before entering any details.

A parcel scam can use the name of a genuine carrier

A well-known logo and genuine-sounding language prove nothing. The effectiveness of the scam is based precisely on the message looking familiar. That is why checking should be based on process, not appearance.

Entering payment card details via a message is a high-risk situation

If a message asks for card details for a small delivery fee, the safest approach is to close the message and check the possible payment directly in the carrier's official service. If the payment does not appear there, the link should not be used.

A language error in a message is not the only sign of a scam

Current scam messages can be well written. Therefore good language alone does not make a message genuine, and poor language is not the only warning sign.

You can report a suspicious message without opening the link

A screenshot, the sender's number or email address and the visible link address are often enough for a report to the bank, the carrier or the authorities.

Read the domain from right to left

In a scam link, a familiar company name may appear only in a long subdomain, while the actual domain is something entirely different. Before entering any details, look at the registered domain rather than just the logo on the page or the beginning of the address.

A shortened link hides the destination address

If a message uses a shortened link, the recipient cannot see directly where it leads. Parcel information can be checked more safely in the carrier's official app or at an address you type yourself.

A genuine parcel message does not need banking credentials to track a delivery

A tracking number is usually enough for tracking. If a page asks for banking credentials or full card details before it even shows the shipment information, the process should be stopped.

Compare the timing of the message with the stage of the order

If a "delivery problem" message arrives before the online store has even announced that it has sent the parcel, the contradiction is a strong reason to suspect the message.

A scam message can arrive at the same time as a genuine order

Coincidence makes the message more credible. That is why even a message that feels genuine is always checked in the official tracking.

A safe routine makes checking quick

When the procedure is always the same, you do not need to analyse a message for long: do not use the link, open the official service, enter the tracking number and compare the information with the order.

In preventing parcel scams, the best protection is a familiar way of working

When every delivery is always checked from the same official app or website, the appearance of an individual message matters less. This reduces clicks made in a hurry and makes it easier to recognise a genuine delivery exception.

When in doubt, you can leave the message entirely unused

A genuine shipment does not disappear because you do not open the link in a text message. Tracking can still be found in the order confirmation and in the carrier's own service.

The simplest rule is the most effective for parcel message security: tracking is opened from your own order confirmation or the carrier's official service. When the link in the message is not needed in the normal process, much of the urgency and credibility of scam attempts loses its meaning.