Package delivery SMS scam: spot it before you pay

“Undelivered package” SMS scams are widespread in France and across the EU. The pattern is almost always the same: urgent message, short link, page mimicking La Poste, Chronopost, DHL, or Mondial Relay, then a small fee to “unlock” a parcel that often does not exist.

What the SMS looks like

• Unknown sender or foreign number, sometimes a fake carrier name.
• Urgency: “last day”, “returned parcel”, “action required”.
• Shortened link or a domain that does not belong to the carrier.
• Small amount (often €1.95–2.99) to seem harmless.

Warning signs on the fake page

• Suspicious domain: .top, .shop, .buzz, or a variant of the real name.
• Recent HTTPS certificate : a green padlock does not mean legitimacy.
• Copied logo, poor grammar, card form for “customs” or “redelivery”.
• No matching parcel in the carrier’s official app or site.

What to do if you received the SMS

• Do not click, pay, or call a number in the message.
• Check real parcels on the carrier’s official site (type the URL yourself).
• In France, report SMS fraud to 33700 (free service).
• If you paid: contact your bank immediately and file a report.

Why the browser alone is not always enough

Safe Browsing and blocklists need time to list domains spun up yesterday for a campaign. A page can live for hours with a valid certificate before it is reported. Scammers target that window.

How Resku can help (no magic promises)

Resku analyzes the page in your browser (~200 ms) and shows a 0–100 score with detected signals (young domain, risky TLD, brand mimicry, sensitive forms) before you enter card details. It is not antivirus or a substitute for caution : it is an explicit readout for people who click fast.

Useful sources

• Cybermalveillance.gouv.fr : package scam and smishing guides (French).
• 33700 : SMS and call fraud reporting in France.
• Official carrier pages on current scams.