The holiday delivery season creates many legitimate notifications, which makes an unexpected package message feel plausible. Plausibility is not enough to justify entering card details or an account password.
The FTC describes phishing messages that invent problems or request information. Use an independent verification route before acting on a delivery claim.
Find the real order
Open the retailer account or confirmation you already trust. Check whether an order exists and which carrier is associated with it. If someone may have sent you a gift, ask them through your existing contact route.
Do not search using a phone number or URL contained in the suspicious message and treat that as independent verification. Use the retailer’s app, a known bookmark, or the carrier’s published website.
Match the requested action
A request for a small redelivery fee can still expose payment details. A request to correct an address can gather personal information. Identify what you would be disclosing before deciding that the task seems harmless.
Avoid entering codes or installing an application simply because the message says delivery depends on it. Read the carrier’s own instructions for the actual shipment.
Respond to real exposure
If you entered a password, open the legitimate account and follow its security guidance. If you provided payment information, contact the relevant financial institution through a trusted channel.
Save the message and timing for reporting, but avoid forwarding active links without explanation. Do not rely on an AI message classifier as your only protection.
Our suspicious-link workflow gives the general decision sequence. Before holiday trips, also review backup-code access so a lost phone does not turn a delivery or travel problem into an account lockout.
