The Delivery SMS That Stole My Card Details (Part 1)
July 27, 2026
Com 0
By Jackson Godwin. Cybersecurity Analyst & Penetration Tester
The Delivery SMS That Stole My Card Details
Disclaimer:This story is fictional but inspired by real parcel delivery phishing scams reported around the world. It is written to educate readers about SMS phishing (“smishing”) attacks and how to recognise fraudulent delivery messages.
I Was Actually Waiting for a Parcel
Unlike many scams, this one arrived at the perfect time.
A few days earlier, I had ordered a computer accessory online.
The seller had already confirmed it had been shipped.
I expected it to arrive sometime that week.
So when my phone vibrated with a new text message, I didn’t immediately think “scam.”
I thought,
“My package is finally here.”
The Message Looked Genuine
The SMS read:
“Delivery Attempt Failed. Your parcel could not be delivered because your address information requires confirmation.”
Below the message was a link.
The sender’s name even appeared as a delivery company rather than an ordinary phone number.
Everything looked professional.
There were no obvious spelling mistakes.
No strange wording.
Nothing immediately raised my suspicion.
It Asked for One Small Payment
After opening the message, I noticed another sentence.
It explained that I needed to pay a small redelivery fee before another delivery attempt could be scheduled.
The amount was tiny.
Just enough that most people probably wouldn’t think twice.
I told myself,
“It’s only a small delivery charge.”
That thought almost became my biggest mistake.
The Website Looked Real
I tapped the link.
A professional-looking website opened immediately.
It displayed:
A courier company logo.
Parcel tracking information.
Delivery status.
My town.
A button labelled:
“Schedule Redelivery”
The website looked exactly like something a real courier company would use.
I didn’t see flashing advertisements.
I didn’t see poor design.
Everything appeared completely legitimate.
The Form Was Simple
The website asked me to confirm:
My name.
My address.
My phone number.
Since I was expecting a parcel, none of those questions seemed unusual.
Then I clicked Continue.
That’s when the page changed.
The Final Step
A payment page appeared.
The explanation seemed reasonable.
It said the small delivery charge needed to be paid before my package could be released.
The form asked for:
My card number.
Expiry date.
Security code (CVV).
For a moment, I didn’t question it.
Many legitimate websites ask for card details during online payments.
But something about this page felt different.
One Small Detail Didn’t Make Sense
I looked back at the tracking information.
There was no parcel number.
No order number.
No sender’s name.
No information about what I had supposedly ordered.
The website knew almost nothing about the delivery.
Yet it was asking for my payment card.
That didn’t feel right.
I Closed the Browser
Instead of entering my card details, I closed the website.
Then I visited the courier company’s official website by typing the address directly into my browser.
I entered my real tracking number.
The result surprised me.
According to the courier…
My parcel was still travelling normally.
There had never been a failed delivery attempt.
The SMS was completely fake.
It Could Have Cost Me More Than a Delivery Fee
That fake website wasn’t interested in collecting a small delivery payment.
It was interested in collecting something much more valuable.
My bank card details.
If I had entered them, the criminals might have attempted to use them for fraudulent purchases or other financial crimes.
One small SMS.
One convincing website.
One careless moment.
That was all it could have taken.
(Continue in Part 2, where I’ll explain how fake delivery SMS messages trick thousands of people every year, reveal the warning signs I almost missed, and show how criminals copy trusted courier companies to steal financial information.)
