# Fake delivery notification emails: how to spot and report parcel scams

URL: https://iblockspam.com/blog/fake-delivery-notification-emails
Last updated: 2026-10-10
Published: 2026-10-10
Topic: Phishing & threats
Author: iBlockSpam Team

> How fake USPS, UPS, FedEx and DHL delivery and customs fee emails work, how to check a parcel safely, and each carrier's real address for reporting scams.

## Short answer

A fake delivery email claims a parcel couldn't be delivered or owes a small fee, and links to a page that steals card details or logins. Don't click. Check tracking on the retailer's or carrier's own website, then report the email: spam@uspis.gov, fraud@ups.com, abuse@fedex.com or phishing@dhl.com.

"We couldn't deliver your parcel. Pay a $1.99 redelivery fee to reschedule." It's one of the oldest phishing lures, and it keeps working because everybody is expecting something. This guide shows how fake USPS, UPS, FedEx and DHL emails work, how to check a parcel without clicking, and where each carrier wants scams reported.

## What do fake delivery emails look like?

The FTC describes the basic version: "You get an email or text and it says you missed the delivery. Or it might say your item can't be delivered because you need to update your street address or zip code." Scammers often add urgency, threatening to return the package if you don't respond right away ([FTC, December 2024](https://consumer.ftc.gov/consumer-alerts/2024/12/scammers-are-delivering-phishing-messages-holiday-season)).

The common variants:

| Lure | What the email says | What it's after |
|---|---|---|
| Missed delivery | "Delivery attempt failed. Reschedule now." | Card details or personal data |
| Address problem | "Incomplete address. Update to release your parcel." | Personal data, then card details |
| Redelivery or customs fee | "Pay $2.99 in duties to release your shipment." | Card details, often for repeated charges |
| Shipping invoice | "Your invoice for shipment #..." with an attachment | Malware or a fake sign-in page |
| Tracking "document" | "See attached shipping label" | Malware in an HTML, archive or script file |

The U.S. Postal Inspection Service has described fake USPS emails with the subject line "Delivery Failure Notification" that ask recipients to confirm details through a button or attachment, which can install a virus ([USPIS](https://www.uspis.gov/news/scam-article/fake-usps-emails)). Attachments in these emails deserve particular suspicion. See [HTML attachment phishing and HTML smuggling](https://iblockspam.com/blog/html-attachment-phishing-html-smuggling) and [dangerous email attachment types](https://iblockspam.com/blog/dangerous-email-attachment-types).

### Why the fee is so small

A $1.99 fee feels too small to be worth a scam, so people pay without much thought. But the goal is the card number, the security code and often your name and address, which are worth far more than the fee. The [FTC](https://consumer.ftc.gov/consumer-alerts/2023/12/fake-shipping-notification-emails-text-messages-what-you-need-know-holiday-season) warns that a fake site will "capture all the information you enter," and that stolen logins can be used to "steal your identity and open new accounts in your name."

## What do the carriers say they never do?

Each carrier publishes its own warning. These are the details that help you judge a message:

| Carrier | What the carrier says | Report fake emails to |
|---|---|---|
| USPS | The Postal Service "does not notify customers of package delivery attempts, or request personal information, via email" | spam@uspis.gov |
| UPS | Doesn't request payments, personal or financial information, account numbers, IDs, passwords or copies of invoices in an unsolicited way | fraud@ups.com (include full headers) |
| FedEx | Doesn't request account credentials or identity information by unsolicited mail, email or text, or payment to release a package; for international parcels it may send a secure link to pay duties and taxes | abuse@fedex.com |
| DHL | "The only payments DHL requests via email or SMS are for customs duties and taxes", with a one-time passcode sent to the consignee first | phishing@dhl.com (as an attachment) |

Sources: [USPIS](https://www.uspis.gov/news/scam-article/fake-usps-emails), [UPS](https://www.ups.com/us/en/support/shipping-support/legal-terms-conditions/fight-fraud) (the reporting address is on [UPS Canada's version](https://www.ups.com/ca/en/support/shipping-support/legal-terms-conditions/fight-fraud)), [FedEx](https://www.fedex.com/en-us/report-fraud.html) and [DHL](https://www.dhl.com/us-en/home/footer/fraud-awareness.html). Carrier pages change, so check the current page before relying on a detail.

Note the customs exception. DHL and FedEx both say a genuine email or text can ask you to pay duties and taxes, so "it asks for a fee" isn't proof of a scam on its own. What matters is whether you can confirm the shipment and the charge on the carrier's site without using the link in the email.

## How do you check a delivery without clicking?

The FTC's advice works for every carrier: "Don't click on links in messages about an unexpected delivery," and "Don't use the information in the message." Instead:

1. **Ask whether you're expecting anything.** If you haven't ordered anything or been told a parcel is coming, the message is almost certainly fake.
2. **Go to where you bought it.** Open the retailer's site or app from a bookmark or by typing the address, and check the order status and tracking there.
3. **Type the tracking number into the carrier's site yourself.** If the email shows a tracking number, copy the number (not the link) into the search box on usps.com, ups.com, fedex.com or dhl.com. If the carrier has no record of it, you have your answer.
4. **Contact the carrier using a number or website you already know.** Not the phone number in the email.
5. **Pay fees only on the carrier's own site** after you've confirmed the shipment there.

### Clues in the email itself

- **The sender's domain.** DHL lists dhl.com and its subdomains, dpdhl.com, dhl-news.com and country DHL domains, and says it never sends email from free providers such as Gmail or Yahoo. Remember that display names are easy to fake; see [display name spoofing](https://iblockspam.com/blog/display-name-spoofing).
- **The link destination.** Hover over the button or long-press it on a phone. If the domain isn't the carrier's, don't go further. DHL says it never links to sites outside its own domains.
- **Generic greetings and no order details.** A real notice usually mentions the sender, the retailer or a reference you recognize.
- **Headers.** If you're still unsure, paste the headers into the [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer) to see the real sending server and whether SPF, DKIM and DMARC passed for the claimed domain. A failed check is a strong sign; a pass only proves the sender controls that domain, which may be a lookalike.

For a broader checklist, see [how to spot a phishing email](https://iblockspam.com/blog/how-to-spot-a-phishing-email).

## How do you report a fake delivery email?

Report to the carrier, because they can get the fake sites taken down. Then report it inside your mail app so your filter learns.

- **USPS:** forward the email to **spam@uspis.gov**, then delete it. For texts, the USPIS asks you to copy the message (without clicking the link) into a new email to the same address and include a screenshot showing the sender's number and the date ([USPIS smishing guidance](https://www.uspis.gov/news/scam-article/smishing-package-tracking-text-scams)).
- **UPS:** email **fraud@ups.com**, the address UPS gives for reporting anyone fraudulently claiming to be UPS, and include the full Internet headers, which UPS says reveal the true sender. Then delete it.
- **FedEx:** forward phishing emails to **abuse@fedex.com**.
- **DHL:** send the email **as an attachment** to **phishing@dhl.com**. DHL explains that it needs the complete mail headers, which a normal forward doesn't include.
- **FTC:** in the US, you can also report the scam at [ReportFraud.ftc.gov](https://reportfraud.ftc.gov/), and forward scam texts to 7726 (SPAM).

Our guide to [reporting phishing emails](https://iblockspam.com/blog/report-phishing-email) shows how to send a message as an attachment in Outlook, Gmail and Apple Mail.

## What if you already clicked or paid?

Move quickly, but don't panic. What you do depends on what you entered.

1. **Card details:** call your card issuer using the number on the back of the card. Ask it to block the card and watch for fraudulent charges.
2. **Clicked but didn't submit anything:** the USPIS still advises you to notify your financial institution if you interacted with the link, even without selecting "submit".
3. **A password:** change it from the real sign-in page, and anywhere else you reused it. If it was a work account, tell IT so it can sign you out everywhere and check for forwarding rules.
4. **Opened an attachment or downloaded a file:** disconnect the device from the network and call IT before doing anything else.
5. **Report it** to the carrier and the FTC, as above, so the fake site can be taken down.

## Why do businesses need to worry about parcel scams?

At home, a fake delivery email costs one person some money. At work it can cost more. In 2020 the FTC warned that a package text scam "could target your mail room staff, receptionist, or other employees," and was "designed to get people to turn over their account information – or your company credit card number" ([FTC Business Blog](https://www.ftc.gov/business-guidance/blog/2020/02/text-message-package-scam-delivers-more-your-business-bargained)).

Businesses are an easy fit for the lure:

- **Parcels arrive every day.** Purchasing, reception and warehouse staff can't remember every order, so a delivery notice looks plausible.
- **Shared inboxes get everything.** Addresses like `orders@`, `info@` and `accounts@` are published and receive large volumes of mail.
- **Company cards are close at hand.** A small fee paid on a corporate card can go unnoticed for a month.
- **Logins are the bigger prize.** Some fake "shipping documents" lead to a fake Microsoft 365 sign-in page rather than a payment page. If someone enters a work password, follow [what to do after clicking a phishing link](https://iblockspam.com/blog/what-to-do-after-clicking-phishing-link).

### A simple rule for staff

Agree on one rule and tell everyone: **we never pay delivery, redelivery or customs fees from a link in an email or text.** Whoever handles purchasing checks the order in the supplier's or carrier's account, and pays any genuine duties there. That removes the guesswork for reception and the mail room.

Then add a few supporting controls:

1. Keep a list of the carriers and suppliers you actually use, and their genuine sending domains.
2. Ask suppliers to send tracking through their own portal or order confirmations, so staff have somewhere trustworthy to check.
3. Quarantine risky attachments such as HTML, SVG and password-protected archives at the gateway.
4. Make reporting easy, and thank people who report. Fake delivery emails come in waves, so one report can protect the rest of the team.

## Next steps

- Share the carrier table above with reception, purchasing and anyone who handles deliveries.
- Bookmark the real tracking pages for the carriers you use.
- Check that your mail filter quarantines HTML attachments and archives; [what is email quarantine](https://iblockspam.com/blog/what-is-email-quarantine) explains how releases work.
- Run an [Email Health Check](https://iblockspam.com/tools/email-health-check) on your own domain to make sure scammers can't easily send mail as you.
- iBlockSpam filters phishing and malware before it reaches every mailbox on your domain, with personal quarantines and digests. See [how it works](https://iblockspam.com/how-it-works).

Browse our other [phishing and threat guides](https://iblockspam.com/blog/topic/threats).

## Frequently asked questions

### Does USPS send emails about missed deliveries?

The U.S. Postal Inspection Service says the Postal Service does not notify customers of package delivery attempts, or request personal information, by email. If you didn't sign up for tracking on a specific package, an email or text claiming to be a USPS delivery notice is a scam. Forward it to spam@uspis.gov and delete it.

### Is a customs fee email from DHL always fake?

Not always. DHL says the only payments it requests by email or SMS are for customs duties and taxes, and that a one-time passcode goes to the consignee's registered contact before payment. Check the shipment by typing the tracking number into the DHL site yourself rather than following the link, and be suspicious of any fee for a parcel you weren't expecting.

### How do I report a fake UPS email?

UPS says not to respond to a suspicious email, and lists fraud@ups.com for reporting anyone fraudulently claiming to be UPS. Its fraud page explains that the true sender shows only in the full Internet headers, so include them, then delete the message. You can also report it through your mail app's report button so your filter learns.

### I entered my card details on a fake delivery page. What now?

Call your card issuer straight away using the number on the back of your card, and ask it to block the card and watch for fraud. If you also typed a password, change it everywhere you use it. Report the scam to the carrier and at ReportFraud.ftc.gov. The USPIS advises notifying your bank even if you only opened the link.

### Why do businesses get so many fake delivery emails?

Businesses receive parcels every day, so a delivery notice looks routine to reception, the mail room or purchasing. The FTC has warned that package scams can target mail room staff and receptionists to get account details or a company credit card number. Shared inboxes such as info@ or orders@ are common targets.

## Sources

- [FTC Consumer Alert: Scammers are delivering phishing messages this holiday season (December 2024)](https://consumer.ftc.gov/consumer-alerts/2024/12/scammers-are-delivering-phishing-messages-holiday-season)
- [FTC Business Blog: Text message package scam delivers more than your business bargained for (February 2020)](https://www.ftc.gov/business-guidance/blog/2020/02/text-message-package-scam-delivers-more-your-business-bargained)
- [U.S. Postal Inspection Service: Fake USPS emails](https://www.uspis.gov/news/scam-article/fake-usps-emails)
- [U.S. Postal Inspection Service: Smishing](https://www.uspis.gov/news/scam-article/smishing-package-tracking-text-scams)
- [UPS: Protect yourself from fraud and scams](https://www.ups.com/us/en/support/shipping-support/legal-terms-conditions/fight-fraud)
- [FedEx: How to recognize and help prevent fraud and scams](https://www.fedex.com/en-us/report-fraud.html)
- [DHL: Fraud awareness](https://www.dhl.com/us-en/home/footer/fraud-awareness.html)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.

---

Source: iBlockSpam, https://iblockspam.com/blog/fake-delivery-notification-emails (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt