Watch Out for Package Delivery Scams Around the Holidays

By
Cameron Huddleston
January 9, 2025

If you plan to shop online this holiday season, you’ll likely get lots of shipment notifications by email or text message. Beware, though: Some of these notifications could be scams.

Scammers send fake package delivery notifications throughout the year. However, these scams surge around the winter holidays as more consumers shop online, according to the Better Business Bureau.

Often, these notifications look legitimate. So you need to be careful to avoid being tricked into handing over your personal information to a scammer. Here’s how to spot and avoid fake package delivery scams.

How package delivery scams work

Package delivery and shipping notification scams typically begin as emails or text messages. They appear to come from USPS, UPS, FedEx, or Amazon and alert you about a problem with delivering a package. For example, the message might claim that a package couldn’t be delivered because of incomplete address information.

The messages typically urge you to click on a link to confirm your address or update delivery or payment information. If you click on the link, you might be prompted to enter your personal information, pay a delivery fee, or cover the cost of customs or taxes, according to the Federal Communications Commission. Or, the link might download malware onto your device.

Sometimes these messages include a phone number to call rather than a link. If you call, the requests will be the same—for your personal information or a payment. In some cases, simply calling the number will cost you money if it’s an international call or has an 809 area code, according to FCC.

With all of these scam messages, there is no package. Scammers are just trying to steal your money or personal information, which they can use to steal your identity.

How to spot package delivery scams

Package delivery scams typically have telltale signs. Look for these red flags if you receive messages about issues with shipments.

• Unexpected package delivery notifications: The biggest tip-off that a message is a scam is if you aren’t expecting a package. Scammers might have sent you a phishing email or smishing text message in hopes that you have made recent online purchases.
• Request for personal information to deliver a package: All of the major package delivery companies—U.S. Postal Service, UPS, FedEx, and Amazon—state on their websites that they don’t ask for personal information in unsolicited emails, text messages, or phone calls.
• Request for money to deliver a package: The USPS does not charge a fee for redelivery of packages. Delivery companies will not ask you to wire money or send money orders, gift cards, or cash to receive a delivery. And UPS notes on its website that only a few types of packages require delivery fees: pay-on-delivery shipments and duty fees on international shipments. Use tracking numbers you receive when you make purchases to check the status of your delivery and any fees owed on the shipping company’s website.
• Spelling and grammatical errors: Misspelled words, typos, grammatical errors, and excessive use of capitalization and exclamation points are red flags of scams.
• Suspicious email addresses, websites, and phone numbers: If you receive a package delivery email, check the email address of the sender. For example, if the email supposedly is from USPS or UPS but the email address is a gmail account, it’s a scam. Hover your mouse over links in emails to see where they are directing you. Beware of any URLs that are http:// instead of https://. And pay attention to the number where text messages and phone calls originate from to see if they are international numbers.

How to avoid package delivery scams

Don’t click on links in emails or text messages. If you get a message about a problem with a package delivery, go directly to the shipping company’s website to check the status of the shipment. Do not click on any links in unsolicited emails or text messages because they could take you to fake sites or download malware onto your device.

Don’t provide your personal information in response to package delivery messages. The major shipping companies won’t ask for identifying information such as your Social Security number or account login credentials to deliver a package. And don’t use any forms of payment that will make it difficult to get your money back, such as wire transfers, money orders, gift cards, or cash.

Know delivery company policies. The major shipping companies share their policies and offer tips to avoid fraud on their websites.

• USPS states that it never reaches out directly to consumers to ask for money or personal information. It won’t send unsolicited messages. Customers must register online with their package tracking numbers to receive shipment updates. When the USPS sends text messages, the messages originate from numbers with only five digits (five-digit short codes) and won’t contain any links. Forward any fraudulent emails and report fake delivery texts to spam@uspis.gov.
• UPS states that a real UPS link will start with "https://www.ups.com" or "https://billing.ups.com." Real UPS emails come from accountconfirm@ups.com; mcinfo@ups.com; pkginfo@ups.com; customer-notifications@ups.com; auto-notify@ups.com; emailinfo@ups.com; invoice-notification@ups.com; UPSAdministrationSupport@ups.com; or donotreply@ups.com. Real UPS texts come from 94601, 69877 or 48515.
• FedEx doesn’t request any personal information from customers through unsolicited mail, email, or text messages. Fraud can be reported to abuse@fedex.com.
• Amazon will never call customers to ask them to disclose or verify personal information. If you receive an email claiming to be from Amazon, log onto your account and check the Message Center to see all email correspondence sent by Amazon. Any links to legitimate Amazon sites should have a dot before amazon.com. For example, the Amazon Pay website is https://pay.amazon.com/. Amazon does not send emails with links to web addresses with a string of numbers, such as http://123.456.789.123/amazon.com/. Share any suspicious correspondence with Amazon’s Report a Scam.

You can file complaints about unwanted calls and text messages with the FCC. If you share your personal information with a scammer or make a payment, visit IdentityTheft.gov to get a recovery plan.

Cameron Huddleston

Cameron Huddleston is an editor-at-large at Carefull and the author of Mom and Dad, We Need to Talk: How to Have Essential Conversations With Your Parents About Their Finances _.