Fake Shipping Notifications: FedEx, UPS, DHL Scam Emails
At any given moment, there are approximately 340 million packages in transit across the United States alone. That's 340 million people who might be expecting a delivery notification. For phishing campaigns, the math is irresistible — send a fake shipping notification, and there's a high probability the recipient actually has a package coming. Even if they don't, curiosity about an "unexpected delivery" drives clicks.
The Three Most Common Variants
The delivery failure notice.
"FedEx: We attempted to deliver your package today but no one was available to sign. Your package is being held at our facility. Schedule a redelivery or pick up by clicking below.
Tracking Number: 7849102836491
[Schedule Redelivery]"
This plays on fear of missing a package. The link leads to a phishing page that asks for personal information to "schedule redelivery," or it downloads malware disguised as a "delivery scheduling tool."
The customs/fee notification.
"UPS: Your international shipment requires a customs clearance fee of $6.99. Pay the fee to release your package for delivery.
[Pay Fee and Schedule Delivery]"
The small dollar amount makes it seem legitimate and not worth questioning. The payment page harvests credit card details.
The tracking update with malware.
"DHL: Your package delivery status has changed. View the updated tracking information in the attached document.
[Attachment: DHL_Tracking_Update.pdf.exe]"
The attachment is malware. The double file extension (.pdf.exe) disguises the executable as a PDF on Windows systems where file extensions are hidden by default.
Got a suspicious email?
Paste it here for an instant analysis.
Free · No signup required · Cmd+Enter to scan
Why Shipping Scams Are So Effective
E-commerce volume has grown every year for a decade. The average American receives 21 packages per month. Package tracking has become a daily habit — people check tracking numbers compulsively. This constant engagement with shipping notifications creates muscle memory: see a delivery email, click it, check the status. Scammers ride this autopilot behavior.
Shipping scams also benefit from brand trust. FedEx, UPS, and DHL are legitimate, trusted companies. An email that appears to come from them inherits that trust automatically. And because real shipping notifications sometimes do ask you to take action (reschedule delivery, update address, pay customs), the requests in phishing emails don't seem unusual.
How to Spot Fake Shipping Notifications
Check the sender address. FedEx sends from @fedex.com. UPS sends from @ups.com. DHL sends from @dhl.com. Phishing emails use domains like @fedex-delivery.com, @ups-tracking.net, or @dhl-notification.com.
Verify the tracking number independently. Copy the tracking number from the email and paste it into the carrier's official website — fedex.com/tracking, ups.com/track, or dhl.com/tracking. If the tracking number is invalid, the email is fake.
Real carriers don't send attachments. FedEx, UPS, and DHL do not send tracking updates as email attachments. If an email contains an attached file (especially .zip, .exe, .iso, or macro-enabled documents), it's malware.
Legitimate carriers won't ask for payment via email link. Real customs fees and delivery charges are handled through the carrier's official website or app, or collected by the driver at delivery. A one-off email with a "Pay Now" button is always a scam.
Look for your actual address. Real shipping notifications from carriers you've used before typically include your delivery address. Scam emails often omit the address entirely or use a vague reference like "your registered address."
The SMS Version
Shipping scams have migrated heavily to text messages (smishing). You receive: "USPS: Your package cannot be delivered due to an incomplete address. Update your information: [shortened URL]." These are particularly dangerous on mobile devices, where it's harder to inspect URLs and easier to tap links accidentally.
USPS, FedEx, and UPS all have official apps. If you want to check a delivery status, use the app or go to the website directly. Never click links in text messages about deliveries.
Protecting Yourself
Use the carrier's official tracking tools rather than email links. Sign up for carrier accounts (FedEx Delivery Manager, UPS My Choice, USPS Informed Delivery) that provide authenticated tracking through their platforms. Be especially suspicious during the holiday shopping season, when shipping scam volume increases by 400-500%.
If you clicked a link in a suspicious shipping notification and entered information, take action immediately: change passwords if you entered credentials, contact your bank if you entered payment details, and run a malware scan if you downloaded any files.
Received something suspicious? Check it now for free →