The Delivery Text Is Not From the Delivery Company

By NorwegianSpark Editorial · Published August 8, 2026 — written with AI assistance and reviewed by the NorwegianSpark SA editorial team.

A parcel could not be delivered. A small customs fee is outstanding. Your account has been suspended. There is a link.

Text-message phishing — smishing — has become one of the most productive scams running, and not because the messages are clever. They work on timing and volume. Send enough delivery notifications and a large share will land on someone who genuinely is waiting for a parcel.

Why texts work better than emails

Email clients have spent two decades building spam filtering, sender authentication and warning banners. Text messages have almost none of that.

A text arrives in the same thread-based interface as messages from real people, stripped of formatting cues. There is no sender address to inspect, no hover-to-preview on the link, and the link itself is usually shortened, so it reveals nothing. On a small screen, a convincing fake login page is much harder to distinguish from the real one.

Sender IDs can also be spoofed, which produces the most damaging version: a fraudulent message appearing inside the same conversation thread as genuine messages from your bank, because the phone groups them by the displayed name.

The recurring patterns

Almost all of these fall into a handful of shapes:

• The undeliverable parcel with a small fee to release it. The amount is deliberately trivial — small enough not to warrant a second thought, and the real goal is your card details.
• The bank security alert asking you to confirm a transaction you do not recognise, which conveniently requires logging in.
• The tax refund or fine. Refunds exploit greed, fines exploit fear, and fear converts better.
• The wrong number that becomes a conversation. A friendly opener with no link at all, which over days or weeks turns into an investment opportunity. Patient and lucrative.
• The family member with a new number who urgently needs money. Emotional pressure plus urgency plus a plausible story.

The habit that defeats nearly all of it

Never act inside the message.

If a text says there is a problem with your bank account, do not tap the link — open your banking app or type the address yourself. If a parcel is held, go to the courier's own site and enter the tracking number. If a relative texts from a new number asking for money, call the number you already have for them.

This single rule works because it does not depend on you spotting a fake. It removes the link from the equation entirely. You never have to correctly judge whether a message is genuine, which is exactly the judgement these scams are designed to defeat.

Practical extras

• Never enter a card number reached from a text. No legitimate delivery fee needs to be paid that way.
• Report the message. Many countries have a spam-forwarding number; in the UK and several others, forwarding to 7726 (which spells SPAM) is free and feeds carrier-level blocking.
• Delete and block. Do not reply, not even "STOP" — a reply to a scam confirms the number is live and reaches a real person.
• Be sceptical of urgency. Every one of these messages needs you to act now. Genuine organisations are comfortable with you calling back.

If you already tapped

Do not panic, but move quickly. If you entered card details, call your bank and cancel the card. If you entered a password, change it everywhere you used it, starting with email. If you installed anything, treat the device as compromised — remove the app, run a scan, and change passwords from a different device.

Tapping a link and entering nothing is usually not a disaster. The information you typed is what matters.