Before You Tap That Delivery Text: A 2026 Holiday Scam Inspection Routine

The text looks ordinary enough. A package is delayed. A link says reschedule delivery. Maybe it uses a carrier logo, a tracking number, and a fee of $1.99. During Black Friday and Cyber Monday, these messages multiply because real deliveries multiply too. The scam works because it arrives in the middle of a hundred other shipping notices. You are not being careless. You are being busy.

Why holiday delivery scams spike now

From late November through December, Americans order more packages, check tracking pages more often, and expect more texts from carriers and retailers. Scammers know this. They send fake delivery notices that look like the real thing, then push you toward a page that asks for a login, a card number, or a small redelivery fee. The amount is often low on purpose. A $2 charge feels less suspicious than a $200 one.

The fake pages can be convincing. They may copy a carrier's colors, use a tracking number that looks plausible, and include a countdown or an urgent warning. The link may go to a domain that is close to the real one but not quite right. Sometimes it is a shortened link that hides the destination. Sometimes the page asks you to sign in with your email password, which is a much bigger prize than a fake shipping fee.

Verify the notice without using the link

The safest first move is to ignore the link and go to the source you already trust. If the text says it is from a carrier, open the carrier's official app or type the carrier's known website into your browser. If it says it is from a retailer, open the retailer's app or website and check your order history. You are looking for the same package in the same place you would normally track it. If the notice is real, the information will be there. If it is not, you have lost nothing.

Do not use the phone number in the text. Do not reply with personal information. Do not call a number just because the message says a delivery is on hold. Use the contact information from the official website if you need to speak with someone. For SMS spam, the Federal Trade Commission recommends forwarding the message to 7726, a short code used by US carriers to report unwanted texts. You can also report the message to the carrier named in the text.

Inspect the link before you open it

If you want to see where a link goes without tapping it on your everyday phone, you have options. On a desktop browser, hover over the link to preview the destination. On a phone, press and hold the link to see the address, but do not open it. Look at the domain, not the whole URL. The important part is the part just before the first slash. A link that starts with a long string of letters and ends in a strange domain is not a carrier.

A plain browser proxy can also help with inspection. You paste the link into a proxy service and let it fetch the page from a separate server. That can show you the page without loading it directly in your main browser session. It is a useful way to preview a suspicious link, but it is not a malware sandbox. Do not log in, enter a card number, or download anything from a page you reached through a free proxy. If the page asks for credentials, close it. The goal is to inspect, not to interact.

An isolated browser session is another option. Some browsers and security tools offer a disposable tab or container that keeps cookies and site data separate from your normal profile. That can reduce the chance that a shady page hangs around in your main session. It does not make a scam page safe. Treat every unexpected delivery link as hostile until you have verified it through an official channel.

Red flags that should stop you

• A message about a package you did not order.
• A small redelivery fee, especially one that asks for a card.
• A link that uses a lookalike domain or a shortener.
• A page that asks you to sign in with your email password.
• Urgency: your package will be returned today, your account will be locked, your address is incomplete.
• A sender address or phone number that does not match the carrier.
• A request for your Social Security number, full card details, or a photo of your ID.

None of these flags is proof by itself. Together, they are a strong reason to stop. Real carriers may ask for a payment for certain services, but they will not pressure you through a random text link to enter your banking password. Real retailers may send tracking updates, but you can always check the order inside your account.

A simple holiday routine

When a delivery text arrives, do three things. First, pause. Second, open the official app or type the official website. Third, check your order history. If the package is real, you will find it. If it is not, delete and report the message. If you already tapped a link, do not panic. Close the page, do not enter anything, and run a security scan if you downloaded a file. If you entered a password, change it and turn on two-factor authentication. If you entered card details, call your bank.

The holiday season is busy enough without a fake tracking page in the middle of it. A browser proxy or an isolated session can help you look before you leap, but the real protection is a habit: verify through the channel you trust, not the one that just texted you. Your packages will still arrive. The scams do not have to.