Between late November and Christmas, one message finally matches everyone’s reality: "your parcel is on its way — there’s a problem." When you genuinely have four deliveries in transit, a fake courier text stops being obviously fake. That’s why delivery scams spike harder in December than any other lure, across every carrier and every country.
2.7 million
Emails carrying QR codes observed per day in late 2024–early 2025 — fake "delivery fee" QR codes ride the holiday parcel wave. Source: Mimecast, in APWG Q1 2025.
The December delivery playbook
- The held-parcel fee. "Your package is held pending a small customs/redelivery fee." The €1.99 is bait; the card details are the prize. The full mechanics: fake delivery scams, explained.
- The missed-delivery text. A tracking link to a cloned courier page — USPS, Royal Mail, DHL, NZ Post, Australia Post; the brand simply matches your country — asking you to "confirm your details."
- The QR code slip. Emails and even physical cards with a QR code to "rebook delivery." The code hides the destination and moves the attack to your phone — quishing, in its holiday costume.
- The customs email for gifts from abroad. Fake duty invoices timed to international gift-buying, complete with attachment "receipts" that carry the real payload.
- Marketplace non-delivery. Items bought from pop-up sellers that never ship — the December edition of shopping scams.
How to handle any delivery message in December
- Track in the app, not the message. Every courier has an official app or site — type it, open it, and paste the tracking number there. If the "problem" is real, it will show.
- Real couriers rarely ask for money by text. Small "fees" requested by SMS link are the single most reliable scam tell of the season.
- Don’t scan QR codes to pay for anything. If a code claims a fee is due, verify in the courier’s app first.
- Check the sender’s domain, not the logo. The logo is copied; the domain can’t be. Read it right to left.
- Give your phone a safety net. Cloned courier pages appear and vanish in hours — real-time protection on mobile Safari, Edge and Firefox checks the page the moment it loads, before you type.
Sent money or details already?
Call your bank to block the card and dispute the charge, change any password you entered, and report the message — forward scam texts to your carrier’s reporting number (7726 in many countries) and the site to our report page. Expect a follow-up attempt; being on a "paid once" list is why the calls keep coming.