Smishing and Phishing: Fake Delivery Texts in the Holiday Rush

"Your parcel could not be delivered. Pay the £1.45 redelivery fee here." It arrives the same week you ordered gifts, a winter coat and a charger for the trip home. You tap it.

That is exactly why fake delivery texts peak in November and December. This guide explains the difference between smishing and phishing, shows the delivery scams that spike in the holiday rush, and gives you a two-minute way to check any text before you tap.

College Life, the global club for young internationals, is working with Bitdefender to help moved-abroad 18 to 35s keep their devices, data, money and identity safe while they live their whole lives online in a new country. In line with this mission, Bitdefender is providing College Life Club members with 50% off the first year for young professionals and graduates, and a free-trial option for students. Become a member of College Life Club (free) to get this benefit right now.

Key Takeaways

• Smishing is phishing by text message; the goal is the same, to get your card, login or personal details.
• Fake delivery texts rise in the holiday season because so many real parcels are on the move.
• The small fee is bait; the real target is the card details you type in to pay it.
• Check any delivery text with the tracking number from the shop you ordered from, in the courier's official app.
• If you already paid, call your bank first, then report the text by forwarding it to 7726 in the UK.

Smishing and Phishing: What Is the Difference?

Phishing is any message that pretends to come from someone you trust to get your money, login or personal details. Smishing is the same trick sent by SMS, the standard text message, rather than by email. On a phone, Bitdefender's scam protection is built for this channel: it detects scams and harmful links in SMS messages in real time on Android and iOS.

So does the name matter? Only a little. What matters is that texts feel more personal and more urgent than email, which makes them easier to fall for.

Phishing in one line

• A message that pretends to be a bank, shop, courier or government office to make you act fast.
• It usually contains a link, a phone number or an attachment that leads to a fake page or a scam call.
• It arrives by email, social media, chat apps or text.

Smishing in one line

• Phishing delivered by text message, sometimes also called SMS phishing.
• It is short, often with a shortened link, and written to make you tap before you think.
• On a phone screen, it is harder to see where the link really goes.

Why texts work so well

• Most people read texts quickly, and texts feel personal because most of them come from people you know.
• Texts arrive without the spam folder most email accounts have, so fakes land right next to real messages.
• The UK's National Cyber Security Centre says the purpose of a scam text is often to get you to click a link to a site that steals passwords or personal information, in its guide to reporting texts.

Knowing what smishing is helps. Knowing why it spikes in the holidays helps more.

Why Fake Delivery Texts Peak in the Holiday Rush

From November to the new year, more parcels move than at any other time. That gives scammers perfect cover: almost everyone is expecting something.

So why does a tiny fee work so well? Because it feels like a normal hassle, not a threat. Paying £1.45 to get a gift delivered does not set off alarm bells, and that is the point.

More parcels, more cover

• Black Friday, Cyber Monday and holiday gift orders mean many people have several parcels on the way at once.
• If you are expecting a delivery, a text about "your parcel" sounds plausible, whatever the courier name.
• The NCSC warns that criminals exploit specific times of year to make a scam seem more relevant, in its guide to spotting scams.

Small fees, big targets

• The fee is deliberately tiny, so you pay without checking.
• The real prize is the card number, expiry date, security code and often your full name and address.
• Those details can be used for larger payments later or sold on.

Breaches feed the lists

• Data breaches leak phone numbers and names, which scammers use to send texts that feel targeted.
• The NCSC lists "missed deliveries" among the official-sounding messages criminals send after breaches, in its breach guidance.
• If your number has leaked, expect more of these texts, not fewer, during busy shopping weeks.

Internationals as easy targets

• When you live abroad, you are less sure what a real courier text looks like in your new country.
• You may also be waiting on parcels from home with customs involved, which makes a "customs fee" text believable.
• A scam protection layer that flags harmful links in your texts helps most in exactly this situation, when the real and fake look alike to you.

Now that you know why they work, here is what the most common ones look like this season.

Smishing and Phishing Examples This Season

These are the delivery scams that come round every holiday. Each one has a tell, if you know where to look.

So what do they have in common? An unexpected message, a small payment or a "confirm your details" request, and a link that is not the courier's real website.

The customs fee text

• "Your parcel is held at customs. Pay the import fee to release it."
• Real customs charges usually show in the courier's official tracking with a breakdown, not in a text with a payment link.
• The tell is the link and the urgency: "pay within 24 hours or the parcel is returned".
• If you are expecting a parcel from home, ask the sender which courier they used and check that courier's tracking directly.

The missed delivery card

• "We tried to deliver your parcel. Reschedule here."
• If you are not expecting anything, that is your first warning sign.
• If you are, use the courier's own app or website, where real redelivery options live.
• Couriers rarely ask for full card details just to rebook a delivery, so a payment form here is a strong warning sign.

The address confirmation

• "We could not deliver due to an incomplete address. Update your details."
• The form asks for your full address, date of birth and card, which is far more than a courier needs.
• A real courier already has your address from the shop; it does not need your date of birth at all.
• Our guide to spotting fake sites shows the quick checks for a page like this.

The parcel on hold email

• The email version of the same trick, often with a courier logo and a "track your parcel" button.
• The sender address is usually a free email account or a domain that is one letter off.
• Hover over the button on a laptop, or press and hold on a phone, to see where it really goes.
• On a laptop, the web protection in that antivirus warns you about pages carrying phishing or fraudulent content before you type in a card.

The cancelled order refund

• "Your order was cancelled. Claim your refund here."
• It plays on worry about a gift not arriving, and asks for bank details to "send" the refund.
• Real refunds go back to the card you paid with, automatically, without you entering anything.
• If you are worried an order really was cancelled, check the order status in the shop's own app or account.

These five cover most of what you will see between November and January. New versions appear every year, but they all lean on the same pressure: a small fee, a short deadline and a link. The next step is a simple way to check any of them.

How to Check a Delivery Text Safely

You do not need to become an expert in fake texts. You need one habit: never act inside the message.

So what is the two-minute check? Find your real order, open the courier yourself, and only then decide.

Start from your order

• Open the shop's email or app where you placed the order and find the tracking number.
• Check which courier the shop is actually using; it is often not the one named in the text.
• If the shop says the parcel is on its way with no problems, the text is fake.

Open the courier yourself

• Type the courier's address into your browser or open its official app.
• Enter the tracking number from the shop, not anything from the text.
• Real fees, delays and redelivery options will show there if they exist.
• Many couriers also let you set delivery preferences, such as a safe place or a pickup point, which cuts down the real texts you need to act on.

Preview the link first

• Press and hold the link on your phone to preview the address without opening it.
• Shortened links, extra words before the brand name and odd endings are all warning signs.
• If you cannot tell where it goes, treat that as a reason not to go.
• Never reply to the text, even with "STOP"; a reply tells the sender the number is active.

Get a second opinion

• If you are still unsure, paste the text into a scam checker before you do anything.
• Scamio, a free chatbot from Bitdefender that works on the web and in WhatsApp, lets you send a suspicious text, link or screenshot and get a quick view on whether it is a scam.
• Ask a friend or flatmate too; scams often look obvious to someone who did not receive them.
• If several flatmates get the same text on the same day, that is a strong sign it is a mass scam.

Protect the accounts behind it

• Many delivery scams aim to steal email logins as well as cards.
• Two-step login means a stolen password alone is not enough to get in.
• Our guide to a second login check on email shows how to set it up in a few minutes.

With this habit, a fake delivery text becomes a ten-second delete. But if you already tapped or paid, here is what to do.

If You Already Tapped or Paid

Do not panic, and do not be embarrassed. Delivery smishing is designed to catch busy people, and acting quickly limits the damage.

So what comes first? Your money. Then your accounts. Then reporting.

Call your bank first

• Use the number on the back of your card or in your banking app, never a number from the text.
• Ask the bank to block the card and check for pending payments.
• Watch your statement for small test payments over the next few weeks, which often come before bigger ones.
• Ask whether the bank can issue a new card number, since the old one is now in someone else's hands.

Change any password you typed

• If the fake page asked you to log in, change that password from a different device straight away.
• Change it anywhere else you used the same password.
• Turn on two-step login on that account if it is not already on.
• Check the account's recent activity and signed-in devices, and sign out any you do not recognise.

Report the text

• In the UK, forward the text to 7726, the free number most phone providers use to investigate and block scam senders.
• The NCSC says the 7726 service had helped remove 40.9 thousand scams across 93.3 thousand web addresses by July 2026.
• You can also send a screenshot to [email protected].

Watch for follow-up calls

• Scammers who got your card often call back pretending to be your bank's fraud team.
• A real bank will never ask you to move money or read out a code.
• If you are unsure, hang up and call the number on your card.
• Expect more scam texts for a while too; once a number responds, it often ends up on more lists.

Report any stolen money

• Tell the police where you live if money was taken, after you have spoken to your bank.
• Keep the text, screenshots and bank statements as evidence.
• Write down the date and time you tapped the link and what you entered, while you still remember.
• Our guide to report it properly explains which country to file in when your life spans two.

Most people who act within the first hour lose little or nothing. Speed matters more than anything else here, so save your bank's fraud number in your contacts today, before you need it.

Conclusion

Smishing and phishing are the same trick through different channels, and fake delivery texts are their favourite holiday costume. The fee is small, the real target is your card, and the timing is chosen to catch you while you are expecting parcels.

The fix is one habit: start from your real order and open the courier yourself, never through the text. Report what you receive, and call your bank fast if you paid. Share the routine with your flatmates and family too, especially anyone new to online shopping, because the same texts reach everyone in the busy weeks before the holidays. The purpose of this guide was to help you keep your devices, data, money and identity safe while you live your whole life online in a new country. To help you on this journey, College Life has partnered with Bitdefender to make your life easier. Join College Life Club for free and start taking advantage of this today.

FAQ

What is the difference between smishing and phishing?

Phishing is any message that pretends to be someone you trust to steal money or details. Smishing is phishing sent by text message. The aim is the same; the channel is different.

How do I know if a delivery text is fake?

Check the tracking number from the shop you ordered from in the courier's official app or website. If there is no fee or problem there, the text is fake. Small fees, urgency and links that are not the courier's real address are the main signs.

What happens if I click a smishing link but do not enter anything?

Usually little, especially on an updated phone. Close the page, do not enter anything, and watch your accounts. Clear the page from your browser history so you do not reopen it by accident, and report the text so the link can be taken down. If you typed a password or card details, change the password and call your bank straight away.

Where do I report a scam text?

In the UK, forward it to 7726, which is free on most networks, or send a screenshot to [email protected]. In other countries, check your mobile network's reporting service and your national fraud reporting site.

Why do I get so many delivery texts in December?

Because more real parcels are moving, scammers send more fake delivery texts to blend in. Leaked phone numbers from data breaches also feed their lists. Expect more of them in the holiday rush and check each one through your real order.

Do couriers ever ask for fees by text?

Some couriers do send texts about real customs charges, but the safest approach is to treat every fee text as unconfirmed. Check the charge in the courier's official app with your real tracking number before you pay anything.