Billions of packages are shipped during the holiday season.1 So, it’s not surprising that cybercriminals have concocted several schemes related to package deliveries.
A popular scam involves receiving a text or email that asks you to click on a link for a number of reasons, such as to get an update about the delivery date, track the package location, give your payment preferences, provide delivery instructions, or pay a shipping fee. You may also be given a phone number to call for more information about your delivery. Since fraudsters want you to act without thinking, they may convey a sense of urgency in their message.
While some of these communications are obviously fraudulent—perhaps containing multiple misspellings or other errors—many are carefully crafted, even replicating a shipping company’s logo or email format in some cases.
So, it’s easy to get duped, especially during the hectic holidays.
Unfortunately, clicking on the link may infect your phone or computer with malware that enables a cybercriminal to capture your passwords or take control of your device. Or it may direct you to a form that requests personally identifying information, which can be a gateway to identity theft.
Calling the number typically leads you to a friendly-sounding individual who asks you to verify your personal information or provide the credit card number used for your purchase. You might also be asked to pay an additional delivery fee, customs fee or tax for the package.
If you receive any of these communications, it’s best to simply go to the shipper’s website for more information about your alleged delivery using the tracking number provided. (Type the website address directly into your browser because search results may lead you to a fake or phishing site that mimics the authentic one.) Or call the shipper using a verified phone number.
Sometimes scammers take a more aggressive approach and call you pretending to be a representative from a package delivery service. If this happens, don’t provide any personal information—just hang up. If you receive a voicemail with a call-back number, don’t return the call.