Fake shipping notification emails and text messages: What you need to know this holiday season

When you order something online, you might get several emails or text messages about your order: Confirming your order. Telling you it shipped. Saying it's out for delivery. Notifying you about delivery. Did you know that scammers send fake package shipment and delivery notifications to try to steal people's personal information — not just at the holidays, but all year long? Here's what you need to know to protect yourself from these scams.

The bogus stories the scammers deliver

The scammers send bogus messages by email or text. The message might say that you missed a delivery attempt and ask you to click on a link to re-schedule the delivery. Or it could say that your item is ready to ship but you need to update your shipping preferences. Some create a sense of urgency by saying if you don’t respond right away, they'll return your package to the sender.

They want you to click on the link without thinking about it and enter your personal or financial information. But the site is fake. A look-alike of a real website. And it’ll capture all the information you enter. The link could also install harmful malware on your phone or computer that steals your information. Things like your usernames and passwords to your online banking, email, or social media accounts that scammers could use to steal your identity and open new accounts in your name.

What to do

• If you get a message about an unexpected package delivery that tells you to click on a link for some reason, don’t click.
• If you think the message might be legitimate, contact the shipping company using a phone number or website you know is real. Don’t use the information in the message.
• If you think it could be about something you recently ordered, go to the site where you bought the item and look up the shipping and delivery status there.
• No matter the time of year, it always pays to protect your personal information. Check out these resources to help you weed out spam text messages, phishing emails, and unwanted calls.

Read Our Privacy Act Statement

It is your choice whether to submit a comment. If you do, you must create a user name, or we will not post your comment. The Federal Trade Commission Act authorizes this information collection for purposes of managing online comments. Comments and user names are part of the Federal Trade Commission’s (FTC) public records system, and user names also are part of the FTC’s computer user records system. We may routinely use these records as described in the FTC’s Privacy Act system notices. For more information on how the FTC handles information that we collect, please read our privacy policy.

Read Our Comment Policy

The purpose of this blog and its comments section is to inform readers about Federal Trade Commission activity, and share information to help them avoid, report, and recover from fraud, scams, and bad business practices. Your thoughts, ideas, and concerns are welcome, and we encourage comments. But keep in mind, this is a moderated blog. We review all comments before they are posted, and we won’t post comments that don’t comply with our commenting policy. We expect commenters to treat each other and the blog writers with respect.

• We won’t post off-topic comments, repeated identical comments, or comments that include sales pitches or promotions.
• We won’t post comments that include vulgar messages, personal attacks by name, or offensive terms that target specific people or groups.
• We won’t post threats, defamatory statements, or suggestions or encouragement of illegal activity.
• We won’t post comments that include personal information, like Social Security numbers, account numbers, home addresses, and email addresses. To file a detailed report about a scam, go to ReportFraud.ftc.gov.

We don't edit comments to remove objectionable content, so please ensure that your comment contains none of the above. The comments posted on this blog become part of the public domain. To protect your privacy and the privacy of other people, please do not include personal information. Opinions in comments that appear in this blog belong to the individuals who expressed them. They do not belong to or represent views of the Federal Trade Commission.

I always go back to where I ordered the item(s).Walmart or Amazon. sign up for USPS informed delivery. you can log in and see the status of packages coming in the mail. legitimate orders don't need an update of address or delivery. I have never had to contact a "warehouse" to update delivery information

Great ideas worth mentioning to protect yourself. I receive fake phishing E-Mails all the time.

It happens on a daily basis! Get rid of one, another one pops up

In reply to It happens on a daily basis!… by Scotty Preston

So true. and I am paying for scammers and others to be identified and stopped.
Why even have this purching software on my phone!!

I get these all the time. I know when, where and if I'm expecting a shipment. The ones that are alarming is when you get an invoice telling you something has been renewed and they take your money. Fortunately, I don't have the accounts that say that. I also check the email domain if it ends with Gmail I just delete and report spam

First and foremost, ask yourself: have I really ordered anything recently? And if I did, and they "lost my address", how come they have my phone number?

They email me and say that I need to contact them because they need an address because my package was delievered to a wrong address

I never taught of that.. Thanks for that suggestion. Too bad that people who are smart enough to develop these scams use their intelligence for good things.

You know, the VERY FIRST thing that should be available is a link to send in our scam emails and
texts.
Instead of hiring 800 thousand IRS agents to squeeze the citizens, why don't we hire 800 thousand cyber experts to eliminate the evil citizens "have to be prepared for"!!

In reply to You know, the VERY FIRST… by Chris Lepper

In reply to You know, the VERY FIRST… by Chris Lepper

I agree Chris about hiring cyber experts although we also need to collect taxes from the super rich who often avoid paying their full share. I am sick of these phishing emails. My email provider has a site that I send all these emails and any others that are suspicious . The FTC needs such a site so everyone can have access to it, and hire cyber experts to check these things out instead of just compiling a data base.

In reply to I agree Chris about hiring… by Nancy Spears D…

I agree on both counts. In order to provide necessary consumer protection like cyber experts and other services, a government needs additional income which is only possible if we all pay our fair share in taxes.

In reply to You know, the VERY FIRST… by Chris Lepper

I totally agree with that. Quit from honest people and go after the crooks.

I received what look like a legitimate email from the United States Post Office. I was expecting a package filled out some info but the following page wanted my credit card information and to charge me .30 cents. These scammers are truly tech savvy and its getting scary.
Thank you for the articles that you send out, as they are very helpful.

I just got caught up in that scan but thankfully I mentioned it to my friend and they said it was a scan so called my debit card # on the card and put a freeze on my debit card and went to the post office on Monday the next day and they said it was indeed a scam and then I went to my bank and they checked my account and there was nothing taken out (0.30) and they are sending me a new debit card. But after reading this I'm afraid they still have my name and address. I don't know what they can do with just my name and address but I'm so angry that I fell for that. I usually, always delete those texts but I am expecting a package from out of country so I fell for it. The post office cite they send you too looks real. They even have all the different tabs that you can go to for different information. Ugh.

Yes, me too exactly the same.
Looks like the USPS website and has links that take you to real link on the postal service website. But why ask for my credit card for an incorrect address entry?
I’m sure there have been a lot of victims of this scam.

Thank you the FTC for bringing this to our attention.. it is overwhelming and scary. Congress needs to allocate more money to the FTC. To safeguard the American people.