That urgent text about your undelivered package could cost you thousands of dollars and your personal identity.
Package delivery text scams have exploded across Canada, with smishing attacks increasing by a staggering 300 percent since the pandemic began. Fraudsters are exploiting the massive surge in online shopping, sending millions of fake delivery notifications that impersonate Canada Post, FedEx, UPS, and Amazon. These deceptive messages claim your package is being held and require a small fee to release it. The reality is far more sinister: clicking that link opens the door to credit card theft, identity fraud, and financial devastation. During the holiday shopping season from November through January, these scams reach their peak, catching countless Canadians off guard when they are expecting legitimate deliveries.
Key Highlights
TL;DR: Package delivery text scams impersonate legitimate carriers like Canada Post, FedEx, and UPS, claiming your package needs a small payment for delivery. These are always fraudulent. Real carriers never request payment via text message. Delete suspicious texts immediately and report them to the Canadian Anti-Fraud Centre.
| Quick Facts | Details |
|---|---|
| 📈 Increase Since Pandemic | 300% rise in smishing attacks |
| 🎯 Peak Season | November through January (holidays) |
| 💰 Common Request | Small fees ($1.50 to $5.00) |
| 🚫 Legitimate Carrier Texts | Never ask for payment |
| 📱 Report To | Canadian Anti-Fraud Centre |
| ⚠️ Risk Level | High - identity theft, financial loss |
How Package Delivery Scams Work
Package delivery scams, also known as smishing (SMS phishing), follow a calculated psychological approach designed to catch victims at their most vulnerable moments. Understanding the mechanics of these scams is your first line of defence against falling victim.
The scam begins when fraudsters send mass text messages to thousands of phone numbers simultaneously. They use automated systems that can send millions of messages in a single day. The messages are crafted to look official, often including tracking numbers, carrier logos in the text, and urgent language that creates immediate anxiety.
The timing is deliberate. Scammers know that Canadians are ordering more packages than ever before, with online shopping becoming the norm rather than the exception. During the holiday season, the average Canadian household receives multiple deliveries per week. This creates the perfect environment for fraud because recipients genuinely expect packages and may not question a delivery notification.
When you click the link in the message, you are taken to a convincing replica of a legitimate carrier website. These fake sites are sophisticated, often copying the exact design, colours, and logos of Canada Post, FedEx, or UPS. The site then requests personal information, starting with seemingly innocent details like your name and address, before escalating to credit card information for a supposed delivery fee.
The small fee amount is strategic. Requesting $1.99 or $2.50 seems harmless enough that many people enter their credit card information without hesitation. However, the scammers are not interested in that small amount. They now have your complete credit card details, which they use to make fraudulent purchases or sell on the dark web.
Some advanced scams go further, installing malware on your device when you visit the fraudulent website. This malware can capture all your passwords, banking information, and personal data for weeks or months before you notice anything suspicious.
Common Fake Delivery Messages
Recognizing the language scammers use helps you identify fraudulent messages before they cause harm. Below are real examples of scam texts that have targeted Canadians, with the telltale signs that reveal their fraudulent nature.
Canada Post impersonation texts often read:
“Canada Post: Your package has been held at our facility due to incomplete address information. Please update your details to schedule delivery: [suspicious link]”
“CANADA POST: A $1.99 shipping fee is required for your parcel. Pay now to receive your package: [suspicious link]”
“Your Canada Post delivery is scheduled for today. Track your package and confirm delivery window: [suspicious link]”
FedEx scam messages typically state:
“FedEx: We attempted delivery of your package but no one was home. Schedule redelivery and pay the $2.50 redelivery fee: [suspicious link]”
“FEDEX ALERT: Your shipment is on hold pending customs clearance. Pay the $4.99 customs fee to release: [suspicious link]”
UPS fraudulent texts include:
“UPS: Your package could not be delivered. There is an outstanding payment of $1.50 required. Complete payment here: [suspicious link]”
“UPS Delivery Update: Package delayed due to incorrect postal code. Verify your address: [suspicious link]”
Amazon delivery scams appear as:
“Amazon: Your order cannot be shipped until you verify payment method. Update billing info: [suspicious link]”
“AMAZON DELIVERY: Package returned to warehouse. Reschedule delivery for $1.99: [suspicious link]”
The common thread in all these messages is urgency combined with a request for action. They create anxiety about missing a package and offer an easy solution that requires clicking a link.
How to Spot Fake Delivery Texts
Protecting yourself requires knowing the warning signs that distinguish legitimate carrier communications from sophisticated fraud attempts. Every scam message contains identifiable red flags if you know where to look.
Suspicious sender numbers are the first indicator. Legitimate carriers send messages from short codes or verified business numbers. Scam texts often come from regular phone numbers, international numbers, or strings of random digits. Canada Post uses specific short codes that you can verify on their official website.
Generic greetings reveal mass-sent scam messages. Real carrier notifications typically include your name or specific tracking information. Scam texts use vague language like “Dear Customer” or simply “Your package” because they are sent to thousands of recipients simultaneously.
Urgency and pressure are psychological manipulation tactics. Phrases like “act now,” “immediate action required,” or “package will be returned” create panic that overrides critical thinking. Legitimate carriers do not pressure you with artificial deadlines.
Payment requests via text are never legitimate. Canada Post, FedEx, UPS, and Amazon do not request payment through text messages. Any text asking for fees, customs charges, or delivery payments is fraudulent without exception.
Suspicious links often reveal themselves upon close inspection. Look for misspelled domain names, unusual extensions, or shortened URLs that hide the actual destination. A legitimate Canada Post link will always use canadapost.ca, not variations like canada-post-delivery.com or canadapost.tracking-update.net.
Poor grammar and spelling indicate messages not from professional organizations. While scammers have improved their language skills, many texts still contain subtle errors that legitimate corporate communications would never include.
Requests for personal information beyond what a carrier would need signal fraud. Delivery notifications do not require your social insurance number, banking details, or passwords. Any request for such information is a scam.
What Canada Post, FedEx, UPS Actually Do
Understanding how legitimate carriers communicate helps you immediately recognize when something is wrong. Each major carrier has specific policies about customer contact that scammers cannot replicate.
Canada Post sends delivery notifications through their official app, email, or cards left at your door. They never send text messages requesting payment. If there are any fees associated with a package, such as customs duties, you pay directly at the post office or through the official Canada Post website after logging into your account. Canada Post will leave a delivery notice card at your address if a signature is required or if no one is home.
FedEx communicates through their official app, verified emails, and their website. Legitimate FedEx tracking updates never request payment through text messages. If duties or fees apply to international shipments, FedEx contacts you through official channels and provides multiple payment options, never through random text links.
UPS provides tracking information through their My Choice service, official emails, and app notifications. UPS never requests payment via SMS. Any brokerage or customs fees are handled through documented, verifiable processes with multiple contact methods.
Amazon manages all delivery communications through your Amazon account, their app, and verified email addresses. Amazon delivery drivers do not have your phone number and cannot text you. Any delivery-related payment would be handled entirely within your Amazon account.
All legitimate carriers share these common practices: they use verified communication channels, they never request payment through text links, they provide tracking numbers that work on official websites, and they offer multiple ways to verify any communication you receive.
What Happens If You Click the Link
Understanding the consequences of clicking a scam link helps emphasize why vigilance matters. The damage extends far beyond losing a few dollars, potentially affecting your financial stability and personal identity for years.
Immediate credit card theft occurs when you enter payment information on the fraudulent site. Scammers capture your card number, expiration date, and security code in real-time. Within minutes, they can begin making purchases or selling your information to other criminals.
Identity theft follows when you provide personal details. Your name, address, phone number, and any other information you enter becomes part of your stolen identity profile. Criminals use this information to open credit cards, apply for loans, or commit fraud in your name.
Malware installation happens silently when you visit sophisticated scam sites. Some fraudulent pages automatically download malicious software to your phone or computer. This malware can capture passwords, monitor your banking activity, and send your personal data to criminals for months without detection.
Account compromise extends beyond the initial scam. Criminals use information from one breach to access other accounts, especially if you reuse passwords. Your email, banking, social media, and shopping accounts all become vulnerable.
Financial losses vary dramatically. Some victims lose the few dollars they intended to pay for the fake fee. Others discover thousands of dollars in fraudulent charges. The most severe cases involve complete identity theft resulting in ruined credit scores and years of recovery efforts.
Emotional impact accompanies financial damage. Victims often experience shame, anxiety, and ongoing fear about their personal security. The stress of resolving identity theft affects mental health, relationships, and work performance.
How to Protect Yourself
Prevention is always preferable to recovery. Implementing strong protective habits ensures you never become a smishing victim in the first place.
Never click links in unexpected texts. If you receive a delivery notification, go directly to the carrier’s official website or app by typing the address yourself. Use bookmarks for sites you visit regularly. This simple practice eliminates the primary attack vector for smishing scams.
Verify through official channels. If a message claims your package needs attention, call the carrier directly using the number from their official website, not any number provided in the text. Use official tracking tools with the tracking number from your original purchase confirmation.
Enable delivery notifications from carriers directly. Sign up for Canada Post’s delivery updates, FedEx Delivery Manager, and UPS My Choice through their official websites. When you receive legitimate notifications through these services, you will immediately recognize unauthorized texts as fraudulent.
Keep your phone’s software updated. Security updates patch vulnerabilities that scammers exploit. Enable automatic updates for your operating system and all apps to maintain the strongest protection.
Use strong, unique passwords for all accounts. A password manager helps you maintain different passwords for every service. If one account is compromised, your other accounts remain protected.
Enable two-factor authentication wherever available. This adds a second verification step that prevents unauthorized access even if someone obtains your password.
Monitor your financial accounts regularly. Check your credit card and bank statements weekly for unauthorized transactions. Early detection limits the damage from any successful fraud.
Trust your instincts. If something feels suspicious, it probably is. Take time to verify before acting on any unexpected message, especially those creating urgency.
What to Do If You Clicked a Scam Link
Acting quickly after clicking a scam link can minimize damage and begin the recovery process. Follow these steps immediately if you suspect you have been victimized.
If you entered credit card information, contact your card issuer immediately. Report the card as compromised and request a replacement with a new number. Review recent transactions and dispute any unauthorized charges. Most credit card companies have fraud protection that limits your liability if you report promptly.
If you entered personal information, place a fraud alert on your credit file with Equifax and TransUnion Canada. This makes it harder for criminals to open new accounts in your name. Consider a credit freeze for maximum protection.
Change passwords immediately for any accounts that may be connected to information you provided. Start with your email, as it is often the key to resetting other passwords. Use strong, unique passwords for each account.
Scan your device for malware using reputable security software. If you visited the scam site on your phone, consider a factory reset after backing up important data. For computers, run a complete antivirus scan and consider professional malware removal.
Document everything related to the scam. Screenshot the text message, note the time and date, record any phone numbers involved, and keep records of all steps you take. This documentation helps with fraud reports and potential recovery efforts.
Monitor your credit reports closely for the next several months. Look for unfamiliar accounts, address changes, or inquiries you did not authorize. Canadian residents can access free credit reports from Equifax and TransUnion.
File reports with appropriate authorities (detailed in the next section). Reporting helps authorities track scam operations and may assist in your recovery.
How to Report Smishing Scams
Reporting scams helps protect other Canadians and assists law enforcement in tracking criminal operations. Multiple agencies accept and act on fraud reports.
Canadian Anti-Fraud Centre (CAFC) is the central agency for reporting fraud and identity theft in Canada. You can report online or by phone. The CAFC collects information on fraud and scams to identify trends, build cases, and support law enforcement.
Your mobile carrier should be notified of scam texts. Forward the message to 7726 (SPAM) to report it directly to your carrier. This helps carriers identify and block scam numbers.
Canada Post accepts reports of messages impersonating their service. Report through their official website or customer service line. They work with law enforcement to address fraudulent use of their brand.
Competition Bureau Canada handles reports of deceptive marketing and scam operations. While they focus on business practices, reports help them track patterns of fraud.
Local police should be contacted if you suffered financial loss. While they may not investigate individual small-scale scams, your report contributes to understanding the scope of fraud in your area.
The Canadian Centre for Cyber Security provides resources for cyber threats and accepts reports of phishing and smishing attempts. Their information helps protect Canadian infrastructure and citizens.
When reporting, include as much detail as possible: the full text of the message, the sender’s number, any links included, and what happened after you clicked (if applicable). Collective reporting creates the evidence needed to pursue organized fraud operations.
FAQ
Q: Will Canada Post ever text me about a delivery?
Canada Post may send text notifications if you have signed up for delivery alerts through their official Delivered Tonight or FlexDelivery services. However, these legitimate texts never ask for payment or request that you click links to pay fees. Any text requesting money is fraudulent.
Q: What should I do if I already paid the fake fee?
Contact your credit card company immediately to report the fraudulent charge and request a new card. The sooner you act, the better your chances of recovering the money and preventing additional fraud. Most credit cards have fraud protection that limits your liability.
Q: Can scammers really steal my identity from one text?
A single scam interaction can provide enough information for identity theft if you enter personal and financial details. Criminals combine information from multiple sources, so even partial information is valuable to them. Protect all personal data carefully.
Q: How do scammers get my phone number?
Phone numbers come from various sources: data breaches, purchased marketing lists, random number generation, and social media profiles. Your number does not need to be specifically targeted. Scammers send millions of messages knowing some will reach people expecting packages.
Q: Are package delivery scams more common during holidays?
Yes, scams peak from November through January when online shopping increases dramatically. Scammers know more Canadians are expecting packages during this period, making them more likely to believe delivery notifications are legitimate.
Q: How can I tell if a tracking number is real?
Enter the tracking number directly on the official carrier website, not through any link in a text message. Legitimate tracking numbers produce detailed shipment information. Fake numbers either produce no results or vague generic information.
Q: Do these scams only target older people?
Smishing scams target all demographics. While older adults may be stereotyped as more vulnerable, young adults who shop online frequently are also heavily targeted. Anyone expecting a package can fall victim to a convincing scam.
Q: What if I clicked the link but did not enter any information?
You may still be at risk if the site installed malware. Run a security scan on your device, monitor for unusual behavior, and watch your accounts closely. If you did not enter information, your risk is lower but not zero.
Q: Can I block these scam texts?
You can block individual numbers, but scammers use new numbers constantly. Report scam texts to 7726 and enable spam filtering on your phone. However, the most effective protection is recognizing and ignoring scam messages.
Q: How do I know if my information was sold on the dark web?
Credit monitoring services can alert you if your information appears in known breaches. Some services specifically monitor dark web marketplaces. Signs include unexpected credit inquiries, accounts you did not open, or credentials appearing in breach databases.
Q: Is it safe to reply to the text saying “STOP”?
No, never reply to scam texts. Replying confirms your number is active and monitored, making you a more valuable target for future scams. Delete the message without responding.
Q: What if the text includes my actual name?
Scammers obtain names from data breaches and combine them with phone numbers. A personalized message does not mean it is legitimate. Verify through official channels regardless of how much correct information the message contains.
Q: Can my phone get a virus from a text message?
Simply receiving a text cannot infect your phone. However, clicking links in scam texts can lead to sites that download malware. Modern phones have security protections, but keeping your software updated provides the best defence.
Q: Should I call the number in the scam text to verify?
Never call numbers provided in suspicious texts. Scammers answer these lines pretending to be legitimate companies. Always use official contact numbers from carrier websites or your original order confirmations.
Q: How much money do Canadians lose to these scams annually?
Canadians lose hundreds of millions of dollars to fraud annually, with delivery scams representing a significant and growing portion. Many losses go unreported due to embarrassment, meaning actual figures are likely much higher.
Final Thoughts
Package delivery text scams represent one of the most pervasive and damaging forms of fraud affecting Canadians today. The 300 percent increase in smishing attacks since the pandemic reflects how effectively criminals exploit our reliance on online shopping and package delivery.
Protection requires consistent vigilance and healthy skepticism toward any unexpected message requesting action or information. Remember that legitimate carriers never request payment through text messages. When in doubt, verify directly through official websites and phone numbers you find independently.
If you have been targeted or victimized by a delivery scam, take immediate action to protect your financial accounts and personal information. Report the incident to the Canadian Anti-Fraud Centre and your mobile carrier to help protect other Canadians.
Share this information with friends and family, especially during the holiday shopping season when scams peak. Awareness is our strongest collective defence against these increasingly sophisticated fraud operations. Stay informed, stay cautious, and always verify before you click.
Sources: Canadian Anti-Fraud Centre, Canada Post, Canadian Centre for Cyber Security, Competition Bureau Canada
