You're likely expecting holiday packages, which means you're probably tracking deliveries more than usual right now. Scammers are taking advantage of this very fact. They've launched thousands of fake delivery service websites designed to steal your passwords and payment information. According to data collected from NordVPN's Threat Protection Pro security software, the number of malicious websites impersonating the U.S. Postal Service and private shippers like DHL and DPD has surged by 86% over the past month.
Read more:Phony Amazon Deal Links Are Everywhere Right Now
DHL was already the most-impersonated brand, and fake DHL sites increased 206% month over month. But the United States Postal Service experienced the most dramatic surge. Over the last month, fake USPS sites jumped by a whopping 850%. That's likely because millions of Americans are waiting for Postal Service packages right now.
How Scammers Get You to Visit These Fake Sites
Scammers use texts, phishing emails, fake social media posts, and even fake search engine ads to direct you to these fraudulent websites. Text messages are particularly effective because they bypass email filters and go to your phone, where people tend to be less cautious. Text message open rates reach up to 98%, and according to the Federal Trade Commission, people lost $470 million to text message scams in 2024. That figure is five times more than in 2020. Both Apple and Google have been adding new spam filters to their text apps, but it appears that a lot of scams are getting through.
Read more: Google Fights $1B Text Scam Surge With New Anti-Phishing Protections
The scammers have come up with some new tricks to bait you into clicking these fake sites, too. Scam messages now claim packages are "on hold" due to unpaid tariffs or customs fees. The message prompts you to click a link and pay the fees to release your package. It creates urgency and fear to make people panic and click without thinking twice, eventually giving the crooks payment information when they try to pay the fees.
Tips on How to Stay Safe
Fortunately, there is a proven set of precautions you can take to avoid these phishing scams.
- Don't click links in delivery texts or emails. Type the tracking number into the official carrier app or website instead.
- Avoid search engine ads for carrier names. Scammers buy those placements.
- Check URLs carefully. Look for misspellings or extra characters.
- Be suspicious of payment requests. Legitimate carriers don't ask for customs fees through random links.
You can also help fight these crooks by reporting suspicious messages. Forward scam texts to 7726 and report them to the FTC.
Bottom Line
With an 850% increase in fake USPS sites alone, delivery scams are worse than ever this holiday season. The new "customs fee" angle makes these messages and sites even more convincing. You don't need to become a cybersecurity expert to stay safe. Just slow down, verify everything twice, and take the extra steps to ensure you're not using a scam website. It's a lot easier than dealing with identity theft during the holidays.
[Image credits: Generated with Google Gemini Nano Banana Pro, composited by Palash Volvoikar/Techlicious]
