Leave the message and check the order independently
Open the retailer's app or website yourself, or use the tracking details from the original order confirmation. Compare the carrier and tracking number with the new message. If there is a genuine delivery problem, investigate it from that established account or the carrier's official site.
Do not use the phone number or link supplied in the suspicious message as your verification method. A message can imitate the wording and logo of a real carrier while directing you somewhere else. The FTC identifies fake package-delivery notifications as a common form of text-message scam.
A request for a small payment can be designed to collect card details rather than the fee itself. Likewise, an address-correction form may ask for more personal information than the delivery needs. Do not let a modest amount make the request feel automatically harmless.
Look at the request, not only the spelling
Poor spelling can be a clue, but polished language is not proof of authenticity. Look at whether the message creates urgency, asks for credentials, or tells you to install software. A familiar-looking sender name can also be misleading.
If you have several deliveries pending, match the message to a specific order. A vague reference to your parcel is easy to fit to something you happen to be expecting. If you cannot identify the order independently, leave the request unfulfilled while checking with the retailer.
Use the messaging app's reporting and blocking controls where appropriate, and follow your carrier's current reporting guidance. Keep a screenshot if you need to document what happened, but avoid forwarding a live link to someone else without explanation.
If you already interacted with it
Separate what happened: opening a page, entering a password, submitting payment details, downloading a file, or installing an app are different situations. Note the time and what information you provided so you can take the relevant next step.
If you entered account credentials, reach the real service through its official site and follow its account-security guidance. Change a reused password on other affected accounts as well. If payment information was submitted, contact the card issuer through the number on the card or its official app and explain the situation.
If an app or file was installed, stop following the message's instructions and use the device maker's official security guidance. Do not grant additional permissions to a supposed support person who contacts you afterward.
The useful habit is independent verification. You do not need to decide from the text alone whether every message is genuine; you need a way to check the shipment that does not depend on trusting that message.
