LINDEN

A text about a package you did not order.

Fake package delivery texts link to look-alike websites that collect your details, and this post explains the warning signs and what to do instead.

Source: This post is based on the FBI Atlanta Holiday Scams PSA, a public service announcement published by the FBI’s Atlanta Field Office on December 4, 2025.

A text arrives with an update about a package. It looks routine, and it has a link to track the parcel or sort out a problem. If you were not expecting anything, it may be a fake delivery text, the kind of scam known as smishing. Do not tap the link. If you are expecting a package, check it in the delivery company’s own app, or type its web address yourself.

The FBI has warned that scammers send fake shipping updates when many people are waiting for parcels, and police in Canada have warned about fake delivery notices sent by text. The link is the scam, so leaving it alone keeps you safe.

What the scam looks like

The FBI’s Atlanta field office says scammers send fake shipping updates, usually by text message or email. The messages contain links to websites made to look like a well-known delivery company or the postal service, and those websites are designed to harvest your information.

The FBI says the sender details often give it away. A text may come from a phone number with an overseas country code, which would not make sense for a US delivery service. It may also come from a strange email address, because emails can be used to send text messages.

Who it targets

Anyone who shops online or is waiting for a parcel. The FBI says scammers know people are anxiously expecting packages, especially around the holidays, and send fake updates then. The FBI agent in the warning describes the advice as what they would tell their own parents and grandparents, which makes it a good one to share as a family.

Warning signs

  • A text or email about a package you were not expecting, or did not order.
  • A link to track the package, change the delivery or fix a problem.
  • A sender number with an overseas country code, or an odd email address.
  • A website that asks for personal, card or banking details.

How to protect yourself

  • Do not tap the link. The RCMP advises not clicking links in unsolicited text messages and deleting the text.
  • Check the sender details. The FBI says to look at the sender’s phone number or full email address, not just the name shown.
  • Go to the delivery company yourself. The FBI advises going straight to official websites rather than following links you are sent.
  • Never type card or banking details into a site you reached from an unexpected message.
  • Filter unknown senders. The FBI suggests turning on your phone’s setting to filter unknown callers and texters.
  • Never share a sign-in code. The FBI says multi-factor authentication codes are for you alone, and no company will ask you for them.

A simple family plan

  • Agree to ignore delivery links and check orders only in the shop’s or delivery company’s own app or website.
  • Ask before you type in card details because of a text about a parcel.
  • Turn on unknown-sender filtering on each other’s phones.

Scams don’t stop at borders

This warning comes from the FBI in the United States, and police in Canada have reported fake delivery texts too. A text can come from anywhere in the world, so wherever you live it is worth staying informed and being wise before you pay or type in card details because of a message about a parcel.

The same pattern elsewhere

In Canada, the RCMP and the Canadian Anti-Fraud Centre warned about fake RCMP delivery notices sent by text on January 27, 2025. The messages say the RCMP could not deliver court documents and link to a fraudulent website to reschedule the delivery. The RCMP says it does not issue notices by text, and that anyone who clicked a link or entered personal details should contact their financial institution right away and report it to their local police service and the Canadian Anti-Fraud Centre.

What to do if you’ve been affected

If you entered card or banking details, call your bank on the number printed on your card or statement and tell them. If you entered a password, change it on the real website and turn on two-step sign-in. Being caught out is nothing to be ashamed of.

  • US: file a complaint with the FBI’s IC3 and report to the FTC at ReportFraud.ftc.gov. If you are 60 or older and need help filing with IC3, call the DOJ Elder Justice Hotline on 1-833-FRAUD-11 (1-833-372-8311).
  • UK: call 159 to reach your bank (Stop Scams UK) and report to Report Fraud or on 0300 123 2040.
  • Canada: report to the Canadian Anti-Fraud Centre and to your local police service.
  • Contact your bank on the number printed on your card or statement, not a number from the text.

If a call or message says it is from your bank instead, see a caller who says they are your bank.

How Linden helps

Linden is being built so older adults and their families can talk a money decision through with someone they trust. Even a routine-looking text is worth a quick check with someone else before you type in any details.

Sources

All scams