Package held text scam: how to check a delivery message

A text saying your parcel is held and you must pay a small fee or confirm your address is almost always a scam, even if you are expecting a package. Don't use the link. Open the courier's official app or website yourself, type your tracking number, and see whether anything is really pending. If you already entered your card details, call your bank now to block the card.

What these messages look like

They arrive by text message, WhatsApp or email, and they imitate couriers and postal services, including real, well-known ones. Here are two invented examples, using a made-up courier called Mensajería Ejemplo, whose real site would be mensajeria-ejemplo.co:

MENSAJERIA EJEMPLO: Your package is held at our warehouse because the address is incomplete. Update your details within 24 hours or it will be returned: mensajeria-ejemplo.co.entregas-ya.top/track

We couldn't deliver your shipment today. Pay the 2.99 redelivery fee to schedule a new date: [short link]

They share a few features:

• A small amount: a customs fee, a redelivery charge, storage or "incomplete postage".
• A deadline: 24 or 48 hours, or the package "will be returned".
• A link, often a short link or a long address that contains the courier's name.
• No real details: no store name, no order, often no tracking number, or one that doesn't exist.

Some messages ask you to reply with a letter or a number and then open the message again. That's a trick: some phones switch off links in texts from unknown senders until you reply. Don't reply at all. A reply also tells the sender that your number is active.

Timing proves nothing. These messages go out to huge numbers of people at once, and since so many people shop online, many happen to be waiting for a delivery when one arrives.

Why the fee is so small

A small fee doesn't make you stop and think, and that's the point. The scammers don't want the fee. They want what you type to pay it: card number, expiry date and security code, and often the one-time code your bank sends by text, which lets them approve charges. Some fake pages also ask for your ID number, date of birth, address or online banking password.

The fake page usually looks just like the courier's site, with the right logo and colors. It will probably have a padlock too. The padlock only means the connection is encrypted; it says nothing about who runs the site. The guide on how to check if a link is safe explains this in more detail.

How to check a delivery message, step by step

1. Don't tap the link and don't reply. Checking takes a minute and you lose nothing by waiting.
2. Find your real tracking number. It's in the order confirmation email or in your account on the store where you bought. If you didn't buy anything, there's nothing to track.
3. Go to the courier yourself. Open its official app, or type its address in your browser, or follow the link on the store's order page. Enter the tracking number. If there's a real problem or a real charge, it will show there, with the official way to solve it.
4. Paste the whole message into the scam checker. It recognizes the held-package wording and the deadline, follows up to three links and looks up how old their domains are. For many banks, couriers and postal services in Latin America it knows the official domain, so it can tell you when a link uses a courier's name on a domain that isn't the courier's. The text stays in your browser; only the links go to our server (api.ethorns.com), and results are kept for up to an hour.
5. Unroll the link without opening it. Long-press the link, choose "Copy link", and paste it into the short link expander. Our server follows every redirect, so your phone never visits the page. Look at the final address.
6. Read the domain. The site you land on is decided by the end of the name, just before the first single slash. Read it from right to left.

Address	Real domain	What's going on
mensajeria-ejemplo.co/rastreo	mensajeria-ejemplo.co	The courier's own domain in our example
mensajeria-ejemplo.co.entregas-ya.top	entregas-ya.top	The courier's name is only the start
mensajeria-ejemplo-pagos.com	mensajeria-ejemplo-pagos.com	An extra word makes it a different domain
rnensajeria-ejemplo.co	rnensajeria-ejemplo.co	"rn" posing as "m"

For the last kind of trick, paste the address into the lookalike domain checker. It runs in your browser and sends nothing. It spots letters from other alphabets that look Latin, digits in place of letters, pairs like "rn" that read as "m", and a real-looking start that hides the real domain. A green result only means it found none of those tricks; it doesn't prove the site belongs to the courier.

If you already tapped the link or paid

1. If you only opened the page and typed nothing, close it. That's usually the end of it. If it offered an app or a file, don't install it.
2. If you entered card details, call your bank now. Use the number on the back of your card or in the official app, never a number from the message. Ask them to block the card and tell them exactly what you typed: card number, security code, one-time code. Ask them to stop pending charges and dispute any you didn't make, and write down the claim number.
3. Follow the steps for your case. In the "scammed or hacked? what now" tool, choose "I gave my card or bank details, or a one-time code" and your country. It lists what to do now and in the next days, and where to report. It's a page of steps and sends nothing anywhere. If you installed an app from the link, choose "I installed a suspicious app or APK".
4. Watch out for the follow-up call. After a card is stolen, a fake "fraud department" sometimes calls to "help", and asks for codes or for you to move your money to a "safe account". Hang up and call the number on your card.
5. If you typed your ID number or address, watch for loans or lines opened in your name. The guide on loans in your name shows how to check.
6. Report it. See where to report a scam for official channels, including where to forward phishing messages.

Quick checklist

• I didn't tap the link or reply, not even with one letter.
• I found my tracking number in my order confirmation, not in the message.
• I checked it on the courier's official app or site, opened by me.
• I read the real domain of the link, from right to left.
• I didn't pay a fee or type card details on a page from a message.
• If I did, I called my bank and blocked the card.

Frequently asked questions

I really am waiting for a package. Could the message be real?

Couriers do send real notifications. You don't need to guess which kind it is: check the tracking number on the official app or site. If something is really pending, it shows there.

Do couriers ever charge fees?

Yes. International parcels can owe import taxes or duties, and some services charge for redelivery. When a charge is real, it appears on the official tracking page and you pay it through official channels.

How did they get my number?

Usually they know nothing about you. The same text goes out to many numbers at once, some taken from leaked lists and some simply generated. The lack of any real order details is a clue.

Is it safe to open the link just to look?

Opening a page rarely harms your phone by itself, but fake pages are convincing. The short link expander shows you the destination without your phone visiting it.

Try it

• 1.1Is it a scam?Paste a message or link you received and see its warning signs: brand look-alikes, new domains, short links, scam wording.
• 1.4Short link expanderSee where a short link (bit.ly, t.co, tinyurl…) really goes before you click it: every redirect, the final URL and warning signs.
• 1.7Lookalike domain detectorCheck a link or domain for look-alike tricks: letters from other alphabets, digits for letters, a hidden real domain.
• 1.3Is this file safe?See what a file from WhatsApp or email really is and spot attachment tricks: disguised programs, macros, PDF scripts, SMS-reading apps.

For your team

• US$19Phishing awareness kit for small businessesA 30-minute session on fake messages, ready to give to your team: a facilitator guide, 12 example messages, a poster, a policy and a quiz.