The Phishing Scam That Uses Fake Shipping Notifications to Steal Your Money

You get a text message or email that looks like it came from FedEx, UPS, or the United States Postal Service. Maybe it says your package couldn’t be delivered because of an incomplete address, or that you need to pay a small customs fee to release your shipment. There’s a link right there, taunting you to click it so you can “reschedule delivery” or “update your information.” You were expecting a package from Amazon or maybe a gift from a relative, so it feels plausible. You click. And within minutes, your bank account is drained, your credit card is maxed out, or your identity is stolen.

This is the fake shipping notification phishing scam, and it is one of the most successful tricks in the cybercriminal playbook right now. It works because it plays on two things every middle-class American deals with regularly: the convenience of online shopping and the nagging fear of missing a delivery. Scammers know you’re busy. They know you’re likely to act fast when you think a package is at risk. And they know that a small fee of two or three dollars sounds too trivial to double-check. That’s how they hook you.

Here’s how the scam typically unfolds. The message arrives via SMS, email, or even a pop-up notification on your phone. It looks official—complete with company logos, professional wording, and sometimes even a tracking number that appears real. The link in the message doesn’t take you to the actual shipping company’s website. Instead, it sends you to a fake page that mimics the real one down to the color scheme and font. Once you land there, you’re asked to enter personal information: your name, address, phone number, and often your credit card number to pay the “fee.” In some versions, you’re directed to “confirm your identity” by providing your Social Security number or your online banking credentials. Whatever you enter goes straight to the criminals.

But the damage doesn’t stop with that one transaction. Many of these fake sites install malware or keyloggers on your device, recording every keystroke you make for weeks afterward. That means your passwords, your answers to security questions, even your PIN numbers can be stolen without you noticing until it’s far too late. Other variations of the scam tell you that you need to download a “shipping label” or “delivery confirmation” PDF. That PDF is actually a file that locks your computer and demands a ransom to unlock it. Or it could be a remote access tool that gives the scammers complete control over your device.

The reason this scam is so dangerous for people in the 45-to-64 age group is twofold. First, you are likely to have a steady income, decent credit, and accumulated savings—exactly the kind of target scammers love. Second, you grew up in an era where phone calls and paper mail were the norm, and you may not be as naturally suspicious of digital messages as younger generations who’ve been trained to question everything since childhood. That’s not your fault. It’s just a fact that scammers exploit.

How do you spot a fake shipping notification without falling for it? Start with the sender’s address or phone number. Legitimate shipping companies never send unsolicited messages from Gmail, Yahoo, or random 10-digit numbers. The message will come from an official domain like usps.com or fedex.com. Hover over the sender name—don’t click anything—to see the actual email address. If it looks fishy, it is. Next, examine the language. Real shipping notifications are generic and rarely demand immediate payment. If the message pressures you with phrases like “act now” or “your package will be returned,” that’s a red flag. Also, official tracking links usually contain the company’s real website address. A fake link might say something like “fedex-delivery-update.xyz” or “usps-track-now.net.” Those are not legitimate.

Never click a link in an unsolicited shipping notification. Instead, open your browser and go directly to the carrier’s official website. Type in the tracking number if you have one. Or use their official app. If you don’t have a tracking number, ignore the message entirely. If you’re still unsure, call the company using the phone number printed on their official website—not the one in the suspicious message. A genuine customer service agent will tell you whether a delivery issue exists.

If you have already clicked a link and entered information, act immediately. Contact your bank and credit card companies to freeze your accounts and issue new cards. Change your online passwords, especially for email, banking, and shopping accounts. Run a full antivirus scan on your device. Then file a report with the Federal Trade Commission at ReportFraud.ftc.gov. The faster you respond, the better your chances of limiting the damage.

The fake shipping notification scam is not going away. It adapts with every holiday season, every Prime Day, every wave of online shopping. The only defense is skepticism. Before your thumb moves to tap that link, stop. Ask yourself: Did I order anything that would require a customs fee? Is this message really from the company, or is it a lookalike? If the answer is anything but a solid yes, delete the message. Your packages are safe. Your money and identity are not.