A familiar situation
Fictional example: Anna receives a text while paying for groceries. It says her delivery address is incomplete. She expects nothing, but remembers ordering a jacket several weeks earlier. She puts her phone away instead of entering details in a hurry. At home, she opens the clothing shop account herself. The jacket was delivered, and no further shipment appears.
That finding answers a limited question: this message does not match that order. Anna does not need to identify a criminal or explore an unfamiliar website before choosing not to use its link.
Step 1: Follow your own order records
Look in accounts you actually use. Compare the retailer, order date and tracking reference recorded there. Use an installed app or an established bookmark. A search advertisement carrying a familiar logo is less useful than the route you already know belongs to your retailer.
Remember pre-orders and split deliveries. If a gift is plausible, ask the likely sender through their existing contact details. You can mention the named delivery company without forwarding the suspicious clickable message to someone else.
Step 2: Separate three possible outcomes
If the shipment matches an order, continue tracking through the genuine account or the carrier listed in that order. A match still does not create any need to use the text link.
If the match remains unclear, ask the retailer or delivery company. Take its contact details from previous paperwork or an independently opened official website. If you have no traceable order, expected shipment or confirmed sender, do not pay or submit personal information through the message.
Signs that cannot prove authenticity
A correct logo, your name and polished spelling do not establish who sent a text. Sender information can be manipulated. A message appearing alongside earlier genuine delivery texts is therefore not reliable confirmation either.
A tiny amount is not reassuring on its own. On a copied payment page, collecting card information may matter more to the criminal than the stated fee. Equally, this does not mean every real shipping charge is illegitimate: the useful question is whether the actual provider confirms the specific transaction through an independent route.
If you already interacted
Write down what happened: reading the text, opening a page, entering information and paying are different actions. Opening a page does not automatically mean somebody has taken over an account. Close a suspicious page and avoid downloads or approval requests.
If you entered card information, contact the card provider promptly using details you already trust. If you disclosed a password, change it at the genuine service and at any other account where you reused it. When money or an account is affected, preserve the message and timing for the relevant reporting service. A general checklist cannot investigate an individual device.
Your checklist
The checkboxes are for your own reference. No entries are sent to us. To keep a copy, print the page or save it as a PDF using your browser menu.
Common questions
Should I reply to the message?
You do not need to reply in order to check a shipment. Use a separate contact route you already know.
Does a text without my name have to be fake?
No. A generic greeting alone proves little. What matters is whether the claimed shipment can be confirmed independently.
Can I delete it immediately?
If no harm occurred, you can delete it after any report you wish to make. If an account or payment was affected, save the relevant evidence first.
Sources and further information
Primary sources from public authorities, consumer organisations and providers. A source may be in another language; follow the guidance that applies to your service and where you live.
- FTC: Paketnachrichten unabhängig prüfenSource review date:
- BACS: Phishing, Vishing und SmishingSource review date:
- FTC: Unerwünschte Textnachrichten erkennen und meldenSource review date:
