How to spot fake texts and delivery scams
The “pay the customs fee” message that arrives while you are waiting for a parcel is no coincidence but a calculated trap. Fake texts work by blending into the rush of your day; recognising them takes only a few seconds of checking.
Short answer
Fake texts generally try to get you clicking a link on the pretext of a small payment (customs, a delivery fee, a fine) or an information update. Genuine delivery firms and institutions do not ask for card details through a link in a text. Always verify through the company's official app or with the real tracking number on its site.
Why a delivery message?
The reason fraudsters like the delivery scenario is simple: online shopping is widespread, and at any given moment a substantial share of the population really is waiting for a parcel. When thousands of randomly sent messages land on someone expecting a delivery, credibility creates itself.
The same logic drives the other scenarios: an unpaid bill, a traffic fine, a government portal notice, a bank alert, even “you have won” messages. What they share is that they steer you towards clicking a link and entering information there.
The volume of these messages also rises and falls with the calendar: big sale periods, the shopping weeks before public holidays and any stretch when delivery traffic increases are harvest time for fake messages too. A fake message arriving on days when everyone is expecting a parcel can catch even the most careful person; raising your guard a notch in busy periods is well placed.
The classic scenarios
The most frequently seen patterns are these. The small payment trap: messages such as “Your parcel is at customs, pay 26.50 TL” take you to a fake payment page asking for card details; the goal is not that small sum but the card itself. Address update: “Your address details are incomplete, update them for delivery” collects identity and card details. Failed delivery: “Delivery could not be made, reschedule” sends you to a fake sign-in page through a link.
In the bank-themed versions, a message about “your account has been suspended” or “suspicious transaction” leads to a fake banking login page.
The signs that give a fake away
The first place to look is the link: mangled spellings of the real company name, unrelated domain endings and shortened addresses are strong warning signs. The second is the request: any message with no tracking number, no mention of what you ordered, but a demand for payment or personal details, is suspect.
The third is context: if you are not expecting a delivery, a delivery message carries its own answer. Even if you are, check whether the company named is the one you actually bought from. The language of urgency (“last day”, “will be returned”) plays a leading role here too; the general workings of that language are set out in the phishing guide.
Note this as well: genuine delivery notifications usually name the company you ordered from, your tracking number, or at least some concrete detail that concerns you. Entirely faceless messages such as “Dear customer, your parcel is on hold” are the loop of a net cast over thousands of numbers at once; that they contain no personal detail is no accident.
The right way to verify
There is one rule: take the message out of the equation. If you are wondering about your parcel, open the order page on the site you bought from, or type the genuine tracking number you already have into the delivery company's official app. For notices concerning public bodies, open the government services portal app yourself rather than the link in the text. In Turkey that portal is e-Devlet, and it has its own official app.
If a genuine payment is required (which can occasionally happen with customs procedures), that request will also appear through the official channel. There is no legitimate reason to enter card details on a payment page reached from a link in a text message.
If you clicked, or entered details
If you only clicked and left, there is most likely no problem; still, if something downloaded, do not open it and scan your device. If you entered card details, call your bank at once to have the card cancelled and check your recent transactions. If you entered sign-in details for an account, change the password immediately and follow the steps in the hacked account guide.
Report the message as spam, block the number, and use your operator's unwanted-message reporting channel if there is one. Sharing what happened with the people around you is a quiet contribution that protects others.
Take one step for those around you as well: these traps catch most easily the people meeting digital fraud for the first time. Teach the basic rule to older relatives: no clicking links that arrive by message, no entering card details on a payment page, and always ask you or the bank whenever there is any doubt. A single conversation can prevent a large loss later.
Checklist
- Make it a rule not to click links inside text messages
- Track deliveries only through the official app or website
- Watch for spelling tricks in the link address
- Never enter card details on a payment page reached from a text
- Block the suspicious number and report the message as spam
Frequently asked questions
The message came in the name of a real delivery company; can it still be fake?
Yes; sender names can be imitated. Look not at the displayed name but at the link's real address and at what is being asked. If payment or personal details are wanted, your default assumption should be that it is fake.
I paid a small amount; what should I do?
The problem is not the sum you paid but the card details you shared. Call your bank to have the card stopped, request a new one, and watch your account activity closely for a while. Start a dispute through the bank if necessary.
Where do these messages get my number?
Numbers mostly come from data breaches, from records left on various sites, or from randomly generated lists. Receiving one does not mean you were specifically targeted; the same message goes to thousands of people.
Where can I report a fake message?
You can use your phone's spam reporting feature, block the number, and pass it to your operator's unwanted-message channel. Telling the genuine customer services of the imitated company is also a common route.
This guide draws on the publicly issued fraud warnings of the delivery and banking sectors and on the guidance published by national cyber security bodies.