The Bank Call That Wants You to Move Your Money
A calm callback routine for an alarming call, including what changes when a caller already knows something true about your account.
Find the parcel you actually ordered without letting a text message choose the website, phone number or payment screen.

A delivery text is persuasive when a parcel really is due. The timing makes it easy to connect two things that have not yet been shown to belong together: your actual order and an incoming demand for an address correction or small payment. I would begin with the order record, not the message. A real parcel does not establish who sent the text or where its link will lead.
The distinction I use is between the shipment and the claim about it. One can be real while the other is false. Keeping those questions separate helps when a message names a familiar carrier, arrives on the expected day or asks for an amount too small to feel worth investigating. The useful response is a short independent check, rather than trying to judge the sender from polished wording or a logo.
This guide explores how to evaluate package notifications without relying on the links provided in messages. By comparing what the official merchant or carrier says against what an external text demands, you can protect your payment cards, your passwords, and your peace of mind.
A parcel is due, and a text says the carrier needs another address detail. The timing is persuasive because you really are waiting for something. Start with the one fact you can establish: the order exists. That does not tell you who sent the text or whether the shipment needs any action.
Open the retailer's app or the account you used to place the order. Locate the item and its dispatch record. If the record gives a tracking number, take that number to the carrier's official app or website yourself. A carrier name, order number or convincing logo printed in the text is a clue to investigate, not a link you need to use.
Think of this as two pieces of paper on a kitchen table. On one is the message: an alleged missed delivery, a fee and a deadline. On the other is the dispatch record you obtained independently. Compare the carrier and the current status. Different information does not always mean the parcel is in trouble; order records and tracking updates can lag.
If an important delivery really does show a problem, start the correction through the retailer or carrier interface you opened independently. Do not call an alleged driver using a number in the suspicious text. In the US, the Postal Inspection Service explains that unsolicited messages with strange links asking for a response about USPS delivery are a common form of smishing. A different country's carrier may have a different notification policy.
Suppose Sarah orders a kitchen appliance and receives a text saying a parcel needs a small customs payment. The sender uses a familiar carrier name and a convincing page design. Sarah's retailer account confirms that an appliance shipped, but that only establishes the real purchase. It does not authenticate the text, and the absence of a fee in the retailer account is not conclusive either: different systems can show different information at different times.
Sarah takes the tracking number from the real order and opens the named carrier's official service independently. If a fee remains unclear, she contacts that carrier through the route listed there. For USPS specifically, the US Postal Inspection Service says its tracking messages are customer-initiated, free and do not contain links. That is a useful USPS rule, not a claim about every carrier or customs process worldwide. Sarah resolves any actual shipment issue through the independent channel and leaves the unverified link unused.
Consider another hypothetical scenario where a delivery text arrives claiming a package cannot be delivered because the street number is missing, but you have not placed any orders recently. Because you have no order record, your initial instinct might be that a friend or family member sent a surprise gift.
A gift is possible, but possibility is not verification. Ask a likely sender through a conversation you already have, without treating a failed callback as proof either way. If someone confirms the gift, ask for the carrier and tracking number from their order record. If you cannot establish an order or sender, leave the link alone. You do not need to enter your address, card number or account password to find out whether an unknown message is genuine.
Choose the next step according to what happened. Merely receiving a text is different from opening its page, typing information, installing software or approving a payment. Write that sequence down if you need help; it gives a bank or support team something specific to respond to. Avoid jumping from seeing a suspicious message to assuming every account is compromised, but do not dismiss information exposure just because no money has moved yet.
If you opened the page, close it and do not accept further prompts or downloads. If you typed sensitive details, tell the relevant provider even if you never pressed Submit; the Postal Inspection Service specifically warns readers not to wait for that distinction. If you installed software, granted access or approved a payment, describe that too. The appropriate response depends on the action, device and information involved, rather than a single ritual applied to every click.
For card or bank details, contact the institution promptly using its official app or independently obtained number. Ask which protective actions fit what was shared; do not assume that a card freeze addresses every kind of account exposure. For a password, change it at the genuine service and anywhere it was reused, then review account security and supported extra verification. Do not return to the suspicious page to look for a cancellation button.
If you installed software or gave someone remote access, stop using that device for sensitive account changes and follow the device provider's or a trusted support team's guidance. Downloading a file and running it are different facts, so report both accurately. Keep the legitimate shipment record separate from this cleanup. A real missed delivery may still need attention through the carrier even after you have reported a fraudulent message about it.
If another household member dealt with the message, ask what they saw without blame. A useful note is: opened the page, entered an email address, entered a card number, stopped before the code prompt. That is much more actionable than saying they clicked something bad. Keep screenshots or message details privately when useful, without copying passwords or full card numbers into a group chat. Use the carrier's official reporting instructions, and remember that reporting a text does not itself cancel a transaction or secure an account.
A matching number does not establish who controls the linked website. Use the number at the carrier's independently opened official service. You can investigate a shipment without accepting the message's proposed payment or sign-in route.
Give them the carrier name and tracking number through a conversation you already share, such as a direct phone call or trusted chat app. They do not need to use an unexpected text message to check delivery status or resolve shipping issues.
Change your password immediately at the genuine service provider. If you reused that password on other online accounts, update those as well to prevent attackers from gaining widespread access to your personal digital life.
Close the page, decline requests and note any download, installation or permission you accepted. Opening alone does not prove that a payment happened or an account was accessed. If something was installed or the device behaves unexpectedly, follow device-specific support guidance.
Some do, with policies that differ by carrier and country. USPS says its requested tracking messages are free and contain no links. Use the actual carrier's published policy and independently opened tracking service rather than applying one organization's rule to every delivery.
Keep the parcel and the message on separate tracks. Start with the real order, reach the actual carrier independently and handle any genuine delivery problem there. If information was shared, act on that exposure directly. You do not need to prove exactly who wrote the text before choosing a safer way to check the shipment.
Have a correction? Contact the editors.