Holiday package scams are on the rise with fake delivery letters targeting shoppers

As we approach the final stretch of December (and last-minute gift shopping), your doorstep may be busier than ever. And if you’re like me, you’re also probably juggling shipping updates, tracking numbers, and “delivery” alerts from half a dozen retailers.

Unfortunately, scammers know this too, and have likely been preparing for it all year. Like clockwork, I’m already starting to see the usual wave of fake tracking text messages arriving on people’s phones. They look legitimate, show up right when you’re expecting a package, and are based on one inescapable fact: During the holiday rush, most of us are too immersed to notice that something is wrong.

Don’t panic, though. You can still get out before the scammers. I’ll show you what to look for and how you can prevent being targeted in the first place.

Sign up for my free CyberGuy report
Get the best tech tips, breaking security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – for free when you join my site CYBERGUY.COM Newsletter.

Fake Refund Scam: Why Scammers Love Holiday Shoppers

What do fake text messages look like?

Most of these fake shipping texts include a “tracking link” that looks close enough to the real thing that you might click on it without thinking twice about it. In some cases, as one woman in Maryland discovered, you may even receive Fake deliveries using QR code Which works in a similar way.

These links usually lead to a fake tracking page that looks almost identical to the real one. You will be asked to ‘confirm’ your login or enter your delivery details. The moment you write anything, scammers pick it up and use it to access your real accounts.

Worse still, the “tracking link” may contain information Malware or Spywareleading to silent installations that can steal passwords, monitor keystrokes, or give fraudsters remote access to your device.

Red flags that detect fake shipping and tracking messages

So how can you tell the difference between a legitimate message about the delivery you’re actually waiting for and one of these scams? Here are the red flags I look for:

• URLs are strange or slightly changed. Scammers use domains that look almost correct. Except there’s usually one extra character, a swapped character, or a completely unfamiliar extension.
• Additional payment requests. Real carriers don’t ask you to pay a “small fee” to issue a package. This is an instant giveaway.
• A package you wouldn’t expect. If the text is ambiguous or you can’t match it to a recent request, pause before clicking anything.
• Delivery attempts at odd hours. “Missed delivery at 6:12 AM” or “Attempted late night” messages are usually fake. Moving companies don’t usually work this way.
• Updates that don’t match what you see in the retailer’s app or email. If Amazon says your package will arrive tomorrow, but a random text says it’s late or stuck, trust Amazon, not the text.
• Language that is designed to rush you. Anything that screams “requires immediate action!” It’s designed to make you stop thinking and start clicking.

If a text raises any of these things, I delete it immediately. When in doubt, Always check directly with the delivery service provider First before opening any links.

Why your holiday shopping data needs a cleanup now

How scammers know your address, phone number and shopping habits

Scammers don’t magically know where you live or what you ordered, they buy that information. There is actually an entire industry of data brokers based on collecting and selling personal data. This can include the following:

• Phone number
• Home address
• Email
• Purchase date
• Browsing patterns
• Retail accounts and applications
• Loyalty programs
• Even preferred delivery times.

These data brokers can sell profiles containing hundreds of your data points. And they’re not always discriminating about who they sell to. In fact, some of them have been caught intentionally selling data to scammers.

Once the scammers have these details, creating a convincing delivery scam will not be a problem.

But scammers can’t target what they can’t find

I’ve been very vocal about the importance of keeping personal information under lock and key. This is just one of the reasons.

Criminals rely on your personal information to target you with these types of scams. They also need at least a phone number or email address to reach you in the first place.

So your best bet for avoiding delivery scams (and, frankly, most other scams throughout the year) is to remove your information from data brokers and people search sites. Doing this will keep your details out of online circulation and out of the wrong hands.

FBI warns email users as holiday scams increase

How to remove your personal information from scammers

You can start by researching yourself online. Searching for different combinations of your name, address, email, and phone number should bring up a bunch of people search sites. Simply visit the “Opt Out” page on each site to request removal of your data.

Private database data brokers are a bit more complex. They sell data in bulk, usually to marketers and other third parties. So you won’t be able to check if they have your information. But if you look at the data brokers that operate in your area, you can just send opt-out requests to all of them. There’s a good chance they will get your information.

You can also resort to a data removal service. They completely take the headache out of this process and automatically keep your personal information away from data broker sites. If, like me, you don’t have the time to keep checking data broker sites manually and submit removal requests every few months (because your data will keep coming back), a personal data removal service is the perfect solution.

While no service can guarantee complete removal of your data from the Internet, a data removal service is truly a smart choice. It’s not cheap, and neither is your privacy. These services do all the work for you by systematically monitoring and scraping your personal information from hundreds of websites. This gives me peace of mind and has proven to be the most effective way to clear your personal data from the Internet. By limiting the information available, you reduce the risk of fraudsters cross-referencing data from breaches to information they might find on the dark web, making it harder for them to target you.

Check out my top picks for data removal services and get a free check to see if your personal information really exists on the web by visiting Cyberguy.com.

Get a free check to see if your personal information is already on the web: Cyberguy.com.

Key takeaways for Kurt

Holiday delivery scams work because they blend perfectly with the chaos of December shopping. A timely text and a familiar tracking link is often all it takes to lower your guard. By slowing down, checking messages directly with retailers, and reducing the amount of your personal data circulating online, you can eliminate the advantage that scammers rely on. A little caution now can save you a big headache later.

Have you received a suspicious delivery text or tracking message this holiday season? If so, let us know what it looked like and how you dealt with it by writing to us at Cyberguy.com.

Click here to download the FOX NEWS app

Sign up for my free CyberGuy report
Get the best tech tips, breaking security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – for free when you join my site CYBERGUY.COM Newsletter.

Copyright 2025 CyberGuy.com. All rights reserved.