Why you keep getting text messages about packages you never ordered
The delivery text is the most effective phishing message currently in circulation, and the reason is timing. Most people are waiting for something. The message arrives and it fits.
I have spent the last decade watching the same scams come back in new clothes, and this one works because it does not have to be clever.
How they reach you
Your number was in a breach. It does not have to be a dramatic one. Numbers are collected, combined and sold in enormous lists, and once yours is on a list it is on it permanently.
Numbers are also generated sequentially and blasted out. A campaign sending to a million numbers does not care that most are wrong.
Replying, including replying STOP, confirms the number is live and attached to a person who reads messages. To a legitimate marketer, STOP is a legal obligation they will honour. To a criminal it is a signal. Do not reply to messages from unknown numbers.
What they want
Most of these lead to a page asking for a small redelivery fee. The fee is not the point. The card details are.
Some lead to a page that asks you to sign in to a delivery account, or to your email, and harvest the password.
Some ask you to install a tracking application, which on Android can mean installing malware directly.
And some, increasingly, lead to a conversation. You reply, a person responds, and what starts as a parcel query becomes a longer manipulation. Those are the ones that cost people the most money.
How to tell, in five seconds
Look at the link, not the message.
Real delivery companies use their own domain. The address in a scam message is usually a lookalike with extra words, a hyphenated variation, an unusual country ending, or a shortened link that hides the destination entirely.
Real companies almost never ask for payment by text message link.
Real tracking numbers correspond to something you ordered. If you cannot name the parcel, there is no parcel.
And the grammar is often wrong, though I would not rely on that any more. It used to be a reliable signal and it no longer is.
What to do
Do not tap the link. Not to see what it is, not out of curiosity.
If you think there might be a genuine delivery, open the courier's own app, or type the address yourself, and check the tracking number there.
Report the message. On both major phone platforms you can report a message as junk, and forwarding to 7726, which spells SPAM, reports it to carriers in the United States. That number is free and it does help.
Then delete it and block the number, understanding that they will use a different number tomorrow.
If you already tapped
Tapping a link alone is usually survivable. The damage comes from what you did next.
If you entered card details, ring your bank immediately and have the card cancelled. Not tomorrow.
If you entered a password, change it on that service right now, and change it anywhere else you used the same one, which is the real problem and the reason I keep going on about password reuse.
If you installed anything, uninstall it, and on Android check the accessibility settings and device administrator list for anything you do not recognise.
Turn on two factor authentication everywhere that offers it. If a password is stolen and there is a second factor, the password alone is not enough.
Why this will not stop
Sending a million text messages costs almost nothing. If two hundred people enter a card number, the campaign is profitable.
The economics guarantee it continues, so the defence is a habit rather than a solution. Treat every unexpected message with a link as hostile until you have verified it through a route you chose yourself.
That single rule handles this scam, and the bank one, and the tax one, and whatever version arrives next year.
