SafetySift

A delivery text is not your tracking page

Find the parcel you actually ordered without letting a text message choose the website, phone number or payment screen.

··9 min read
A person preparing a cardboard parcel at a desk beside a laptop.
Photo: Bench Accounting / Unsplash.
Contents

A delivery text is persuasive when a parcel really is due. The timing makes it easy to connect two things that have not yet been shown to belong together: your actual order and an incoming demand for an address correction or small payment. I would begin with the order record, not the message. A real parcel does not establish who sent the text or where its link will lead.

The distinction I use is between the shipment and the claim about it. One can be real while the other is false. Keeping those questions separate helps when a message names a familiar carrier, arrives on the expected day or asks for an amount too small to feel worth investigating. The useful response is a short independent check, rather than trying to judge the sender from polished wording or a logo.

This guide explores how to evaluate package notifications without relying on the links provided in messages. By comparing what the official merchant or carrier says against what an external text demands, you can protect your payment cards, your passwords, and your peace of mind.

Match the order, not the message

A parcel is due, and a text says the carrier needs another address detail. The timing is persuasive because you really are waiting for something. Start with the one fact you can establish: the order exists. That does not tell you who sent the text or whether the shipment needs any action.

Open the retailer's app or the account you used to place the order. Locate the item and its dispatch record. If the record gives a tracking number, take that number to the carrier's official app or website yourself. A carrier name, order number or convincing logo printed in the text is a clue to investigate, not a link you need to use.

  1. Open your browser and navigate directly to your retailer account without using message links.
  2. Locate your recent purchase history and find the item currently in transit.
  3. Copy any genuine tracking numbers provided by the merchant.
  4. Use the tracking number in the carrier's official app or a website reached through a known address or the retailer's established tracking route.

Keep two separate records

Think of this as two pieces of paper on a kitchen table. On one is the message: an alleged missed delivery, a fee and a deadline. On the other is the dispatch record you obtained independently. Compare the carrier and the current status. Different information does not always mean the parcel is in trouble; order records and tracking updates can lag.

If an important delivery really does show a problem, start the correction through the retailer or carrier interface you opened independently. Do not call an alleged driver using a number in the suspicious text. In the US, the Postal Inspection Service explains that unsolicited messages with strange links asking for a response about USPS delivery are a common form of smishing. A different country's carrier may have a different notification policy.

  1. List the details claimed in the incoming text message on your mental scratchpad.
  2. List the facts found inside your legitimate retailer dashboard side by side.
  3. Identify discrepancies in carrier names, website domains, or requested fees.
  4. Resolve any genuine shipping address issues exclusively through the official merchant support channel.

Working a legitimate parcel plus fraudulent fee

Suppose Sarah orders a kitchen appliance and receives a text saying a parcel needs a small customs payment. The sender uses a familiar carrier name and a convincing page design. Sarah's retailer account confirms that an appliance shipped, but that only establishes the real purchase. It does not authenticate the text, and the absence of a fee in the retailer account is not conclusive either: different systems can show different information at different times.

Sarah takes the tracking number from the real order and opens the named carrier's official service independently. If a fee remains unclear, she contacts that carrier through the route listed there. For USPS specifically, the US Postal Inspection Service says its tracking messages are customer-initiated, free and do not contain links. That is a useful USPS rule, not a claim about every carrier or customs process worldwide. Sarah resolves any actual shipment issue through the independent channel and leaves the unverified link unused.

  1. Keep the real order and the incoming payment claim separate.
  2. Check the shipment through the carrier reached independently.
  3. Ask the actual carrier about a fee you cannot resolve from its records.
  4. Do not use the suspicious message as the payment route.

Working a gift delivery with no order record

Consider another hypothetical scenario where a delivery text arrives claiming a package cannot be delivered because the street number is missing, but you have not placed any orders recently. Because you have no order record, your initial instinct might be that a friend or family member sent a surprise gift.

A gift is possible, but possibility is not verification. Ask a likely sender through a conversation you already have, without treating a failed callback as proof either way. If someone confirms the gift, ask for the carrier and tracking number from their order record. If you cannot establish an order or sender, leave the link alone. You do not need to enter your address, card number or account password to find out whether an unknown message is genuine.

  1. Review your recent memory and email receipts to confirm you ordered nothing.
  2. Reach out directly to friends or relatives who might plausibly send a gift.
  3. Avoid interacting with web forms that ask for personal details to release an unknown package.
  4. Block the sender number and report the message as spam through your mobile operating system.

The spectrum of interaction: seeing, clicking, typing, approving

Choose the next step according to what happened. Merely receiving a text is different from opening its page, typing information, installing software or approving a payment. Write that sequence down if you need help; it gives a bank or support team something specific to respond to. Avoid jumping from seeing a suspicious message to assuming every account is compromised, but do not dismiss information exposure just because no money has moved yet.

If you opened the page, close it and do not accept further prompts or downloads. If you typed sensitive details, tell the relevant provider even if you never pressed Submit; the Postal Inspection Service specifically warns readers not to wait for that distinction. If you installed software, granted access or approved a payment, describe that too. The appropriate response depends on the action, device and information involved, rather than a single ritual applied to every click.

  1. Distinguish receiving, opening, typing, installing and approving.
  2. Close the unverified page and decline new requests.
  3. Treat typed sensitive information as potentially exposed.
  4. Tell the relevant provider or trusted support team exactly what you did.

Action plan based on what you shared

For card or bank details, contact the institution promptly using its official app or independently obtained number. Ask which protective actions fit what was shared; do not assume that a card freeze addresses every kind of account exposure. For a password, change it at the genuine service and anywhere it was reused, then review account security and supported extra verification. Do not return to the suspicious page to look for a cancellation button.

If you installed software or gave someone remote access, stop using that device for sensitive account changes and follow the device provider's or a trusted support team's guidance. Downloading a file and running it are different facts, so report both accurately. Keep the legitimate shipment record separate from this cleanup. A real missed delivery may still need attention through the carrier even after you have reported a fraudulent message about it.

If another household member dealt with the message, ask what they saw without blame. A useful note is: opened the page, entered an email address, entered a card number, stopped before the code prompt. That is much more actionable than saying they clicked something bad. Keep screenshots or message details privately when useful, without copying passwords or full card numbers into a group chat. Use the carrier's official reporting instructions, and remember that reporting a text does not itself cancel a transaction or secure an account.

  1. Contact the relevant financial provider promptly for exposed payment information.
  2. Change exposed and reused passwords through the genuine services.
  3. Seek device-specific help if software was installed or access granted.
  4. Resolve the real delivery separately through the independently reached carrier.

Frequently asked questions

The tracking number matches. Is the link safe?

A matching number does not establish who controls the linked website. Use the number at the carrier's independently opened official service. You can investigate a shipment without accepting the message's proposed payment or sign-in route.

What do I tell someone expecting a gift?

Give them the carrier name and tracking number through a conversation you already share, such as a direct phone call or trusted chat app. They do not need to use an unexpected text message to check delivery status or resolve shipping issues.

What should I do if I typed my password into a fake tracking page?

Change your password immediately at the genuine service provider. If you reused that password on other online accounts, update those as well to prevent attackers from gaining widespread access to your personal digital life.

What if I opened the link but typed nothing?

Close the page, decline requests and note any download, installation or permission you accepted. Opening alone does not prove that a payment happened or an account was accessed. If something was installed or the device behaves unexpectedly, follow device-specific support guidance.

Do legitimate carriers ever send texts?

Some do, with policies that differ by carrier and country. USPS says its requested tracking messages are free and contain no links. Use the actual carrier's published policy and independently opened tracking service rather than applying one organization's rule to every delivery.

Putting it into practice

Keep the parcel and the message on separate tracks. Start with the real order, reach the actual carrier independently and handle any genuine delivery problem there. If information was shared, act on that exposure directly. You do not need to prove exactly who wrote the text before choosing a safer way to check the shipment.

Sources & further reading

Have a correction? Contact the editors.