Package delivery SMS scam: spot it before you pay
Last updated:
“Undelivered package” SMS scams are widespread in France and across the EU. The pattern is almost always the same: urgent message, short link, page mimicking La Poste, Chronopost, DHL, or Mondial Relay, then a small fee to “unlock” a parcel that often does not exist.
What the SMS looks like
- Unknown sender or foreign number, sometimes a fake carrier name.
- Urgency: “last day”, “returned parcel”, “action required”.
- Shortened link or a domain that does not belong to the carrier.
- Small amount (often €1.95-2.99) to seem harmless.
Warning signs on the fake page
- Suspicious domain: .top, .shop, .buzz, or a variant of the real name.
- Recent HTTPS certificate : a green padlock does not mean legitimacy.
- Copied logo, poor grammar, card form for “customs” or “redelivery”.
- No matching parcel in the carrier’s official app or site.
What to do if you received the SMS
- Do not click, pay, or call a number in the message.
- Check real parcels on the carrier’s official site (type the URL yourself).
- In France, report SMS fraud to 33700 (free service).
- If you paid: contact your bank immediately and file a report.
Why the browser alone is not always enough
Safe Browsing and blocklists need time to list domains spun up yesterday for a campaign. A page can live for hours with a valid certificate before it is reported. Scammers target that window.
How Resku can help (no magic promises)
Resku analyzes the page in your browser (~200 ms) and shows a 0-100 score with detected signals (young domain, risky TLD, brand mimicry, sensitive forms) before you enter card details. It is not antivirus or a substitute for caution : it is an explicit readout for people who click fast.
Useful sources
- Cybermalveillance.gouv.fr : package scam and smishing guides (French).
- 33700 : SMS and call fraud reporting in France.
- Official carrier pages on current scams.
Frequently asked questions
How do I recognise a fake delivery SMS?
Four signals almost always appear together: an unknown or foreign sender, artificial urgency (“last day”, “parcel returned”), a shortened link or a domain that does not belong to the carrier, and a small fee to pay, often €1.95 or €2.99, low enough to seem harmless.
What should I do if I already paid the fee?
Call your bank immediately to block the card and dispute the charge: the faster you act, the more likely a refund. Then file a police report, and in France forward the message to 33700. Keep screenshots of both the SMS and the payment page as evidence.
Does the padlock icon mean the page is safe?
No. The padlock only means the connection is encrypted, not that the site is legitimate. An HTTPS certificate is free and takes minutes to obtain, including for a domain registered yesterday. Most phishing pages online today display a perfectly valid padlock.
How do I report a package delivery scam?
In France, forward the SMS to 33700, the free reporting service for fraudulent messages. You can also report it on cybermalveillance.gouv.fr, and on internet-signalement.gouv.fr (Pharos) if you lost money. The impersonated carrier usually maintains a “current scams” page too.
Resku scores every page 0-100 before you type anything : useful when an SMS sends you to a fake delivery tracking site.
Add to Chrome