What to do when you get a fake delivery notification: quick steps to stay safe

Fake delivery notifications (email, SMS, or messaging app) are designed to make you act quickly. The safest immediate response is to stop, verify independently, and avoid the links or phone numbers in the message. Below are specific steps for what to do right away, how to verify the message, how to respond if you clicked something, and where to report fraud.

Immediate actions — what to do in the first 10 minutes

1. Do not click links, open attachments, or call numbers in the message. These can steal credentials, install malware, or connect you to scammers.
2. Take a screenshot or save the message. You’ll need it for reporting and investigation.
3. If you use a phone, disconnect from Wi‑Fi or mobile data only if you downloaded a suspicious file or app. Otherwise leave the device online so you can run security tools in the next step.
4. Open your courier or retailer app or website directly (not via the message). Enter the tracking number manually or check your order history to confirm whether a delivery is expected.
5. Log into the retailer or carrier account from the official site or app. Do not use links from the suspicious message.

How to verify whether the notification is fake

• Check the sender carefully. On email, view the full email address (not just the display name). On mobile, remember SMS and sender IDs can be spoofed; a nearby-looking number is not proof of legitimacy.
• Inspect the link without clicking (desktop): hover to see the destination URL. If it’s a short link or a domain that doesn’t match the official carrier or retailer, don’t click. On mobile, press and hold a link to preview the URL—if your device shows a preview, check it for mismatched domains.
• Confirm tracking on the carrier’s official site: open their website or app and enter the tracking number yourself. If the number is invalid or the site shows no record, treat the message as suspicious.
• Check the order with the retailer: sign in to the store where you ordered and check Recent Orders. If there’s no order that matches the notification, it’s likely fake.
• Look for red flags in the message: urgent pressure to pay a fee, requests for unusual payment methods (gift cards, cryptocurrency, wire transfers), grammar and spelling errors, and mismatched logos or poor formatting.

If you clicked a link or opened an attachment — clear next steps

Act quickly and follow the relevant path below.

If you clicked but did not give information or download files

• Close the browser tab. Clear the browser cache and history.
• Run a full scan with reputable security software on that device.
• Change passwords for sensitive accounts if you used the same browser session for logging in anywhere else recently.

If you entered login credentials or personal data

• Change the password immediately for that account and for any other account that used the same password.
• Enable two‑factor authentication (2FA) on that account and on other important accounts if you haven’t already.
• Check the account’s recent activity (logins, shipping addresses, payment methods) and remove anything unfamiliar.
• Notify your bank or card issuer if you provided payment card or bank details. Ask them to monitor or block suspicious transactions.
• Consider placing a fraud alert or credit freeze with your credit bureau(s) if financial data was exposed; procedures vary by country and vendor.

If you downloaded an attachment or installed an app

• Disconnect the device from the internet to limit further activity by malware.
• Run a full malware/antivirus scan. On mobile, use a reputable mobile security app if available for your platform.
• If scans find malware that cannot be removed, or if the device behaves oddly (battery drain, unfamiliar apps, popups), back up important files and consider a factory reset. Warning: a factory reset erases data—back up first.

How and where to report the scam — evidence to keep

Reporting helps stop scammers and may assist in getting refunds. Keep copies of everything and share them with the right parties.

• Save the original message and screenshots. Include timestamps and the full message view.
• For email: preserve the full email headers (the servicing "full headers" or "show original" option) if you can—this helps investigators trace the sender.
• Report to the carrier or retailer: use the support or fraud page on the company’s official site. Forward phishing emails to the company’s abuse address if they list one.
• Report to your email or phone provider: mark emails as phishing and SMS messages as spam, and follow provider reporting steps so they can block similar messages.
• Report to law enforcement or consumer protection bodies: many countries have a national fraud reporting site or consumer protection agency—use those channels when money or sensitive data is involved.
• Inform your bank or credit card company immediately if you shared payment details or suspect fraudulent charges.

Simple prevention habits that reduce risk

• Enable two‑factor authentication on accounts that offer it.
• Use a password manager to generate unique passwords and avoid reusing them across sites.
• Update your devices and apps regularly to reduce malware risk.
• Install security software on computers and consider mobile security tools for phones if appropriate for your platform.
• When in doubt, verify independently: always use the carrier’s or retailer’s official site or app, not links or numbers provided in the message.

Taking calm, specific steps protects you and makes it easier to recover if a scam succeeds. Save the message, verify independently, secure accounts if anything looks wrong, and report the fraud so others are safer.