How to spot a parcel delivery scam text

You are expecting a package. A text arrives saying it is held at customs and a small fee is required to release it. There is a link. The whole thing takes four seconds to read and about two to act on.

That is the entire attack, and it works on an extraordinary number of people, not because they are careless, but because it is engineered to arrive when it is plausible.

Why this one works so well

Most fraud has to manufacture a reason for you to care. Parcel scams do not. In any given week a large share of the population is genuinely waiting for a delivery, so the message lands in a context where it makes sense.

It also asks for an amount small enough to bypass scrutiny. Nobody carefully evaluates €2.99. The fee is not the goal. Your card details are.

The four signals

1. A fee that no real courier charges by text

Legitimate carriers do collect customs charges. They do not do it by sending a payment link over SMS to an unauthenticated phone number. They notify you in their own app, or leave a card, or charge at the door.

If a message asks for money to release a parcel, that is close to conclusive on its own.

2. A domain that does not belong to the sender

This is the one that never fails. Look at the actual domain, the part immediately before the first single slash.

dhl.de/tracking is real
dhl-parcel-fee.redirect-pay.co is not DHL, whatever the beginning says
dhl.tracking-update.info is not DHL either

Fraudsters put the brand name at the front because that is where your eye stops. The registered domain is at the end, and that is the only part that means anything.

3. Urgency with a deadline

"Within 24 hours." "Your parcel will be returned." "Final notice." Real logistics companies do not threaten you, because they have no reason to. Manufactured time pressure exists to stop you checking, which is precisely why noticing it should make you check.

4. A tracking number that does not match

If you are genuinely expecting something, you already have a tracking number from the retailer. Compare them. Scam messages either omit the number entirely or invent one that matches nothing you ordered.

The safest move costs nothing. Never use the link. Open the carrier's own app, or type their address into your browser and paste the tracking number from your order confirmation. If the parcel really is held, it will say so there.

What to do if you already tapped

Tapping the link alone is rarely enough to harm you. Entering data is what matters.

If you entered card details: call your bank immediately and have the card blocked. Do not wait to see whether anything happens.
If you entered a password: change it everywhere you reused it, starting with your email account.
If you entered nothing: you are almost certainly fine. Delete the message and mark it as spam.
Report it. Forwarding the message to 7726 works in the UK, the US, Canada, Australia and several other countries. Elsewhere, your carrier or national fraud body publishes the equivalent.

How Textly handles these

Our on-device model reads the structure of a message rather than matching a blocklist: sender type, intent, urgency markers, and whether the link domain agrees with the brand being claimed. Messages that fail get flagged, moved to Spam, and have their links disabled until you explicitly overrule it.

That last part matters more than the detection. Even a perfect classifier eventually meets a novel campaign. Disabling the link buys you the two seconds in which you would have noticed anyway.

Detection is a safety net, not a guarantee. It will occasionally flag something legitimate, and it will eventually miss something fraudulent. The rule that never fails: never enter payment or login details reached from a link in a message, regardless of whether anything warned you.