UPS or FedEx Delivery Notification Email You Didn't Expect — Is It a Scam?
An email from UPS or FedEx says a package is waiting for you or a delivery attempt failed. You don't recall ordering anything. These fake delivery notifications contain links that steal your personal information or install malware.
Think this email is a scam?
Forward it to us and get a free risk assessment in under 60 seconds.
How This Scam Works
High Risk — Shipping Impersonation
Legitimate UPS and FedEx emails link only to ups.com or fedex.com. Any delivery email with links to other domains is a phishing attempt.
You receive an email appearing to be from UPS or FedEx about a package delivery. The email may say a delivery attempt failed, a package is being held at a facility, or that you need to confirm delivery details. You don't recall ordering anything or expecting a package.
Clicking the link takes you to a fake website designed to steal your personal and financial information. Some versions contain attachments labeled as "shipping labels" or "delivery receipts" that actually install malware on your computer. Other variants ask for a small "customs" or "delivery" fee, capturing your credit card details.
According to the Anti-Phishing Working Group (APWG), shipping and logistics companies are among the top five most impersonated sectors in phishing campaigns. The holiday season sees a significant spike in fake shipping emails, but they are common year-round.
Red Flags
- Delivery notification for a package you don't recall ordering
- Sender address is not from @ups.com or @fedex.com
- Contains a suspicious attachment (PDF, ZIP, or EXE file)
- Link does not point to ups.com or fedex.com
- Asks for payment to release or redeliver a package
Both UPS and FedEx provide free tracking through their official websites. They never ask for payment through email to deliver a package.
What You Should Do
What To Do
- Do not click any links or open any attachments
- If there's a tracking number, verify it directly at ups.com/track or fedex.com/tracking
- Do not pay any fees through email links
- Report the email to UPS or FedEx through their official fraud pages at ups.com or fedex.com
- Delete the email
How to Verify Legitimately
Copy any tracking number from the email and paste it directly into the tracking tool at ups.com or fedex.com. If the tracking number is invalid or doesn't exist, the email is fake. If you're expecting a delivery, check your order confirmation from the retailer for the real tracking number.
Sources
- Anti-Phishing Working Group (APWG) — Phishing Activity Trends Reports — Phishing Activity Trends Report 2023
- UPS — Fraud Prevention — UPS fraud prevention guidance
- FedEx — Trust Center — FedEx fraud prevention