Christmas deliveries and fake tracking messages: how scammers track you

As we head into the last stretch of December (and last-minute gift shopping), your front door is probably busier than ever. And if you’re like me, you’re probably also juggling shipping updates, tracking numbers, and “available for delivery” alerts from half a dozen retailers.

Unfortunately, scammers know this too and have probably been preparing for it all year. Like clockwork, I’ve already started seeing the usual wave of fake follow-up text messages hitting people’s phones. They look legit, they show up just when you’re waiting for a package, and they’re based on one inescapable truth: During the holiday rush, most of us are too overwhelmed to notice when something feels off.

But there is no need to panic. You can still get ahead of scammers. I’ll show you what to watch out for and how you can avoid being a target in the first place.

Sign up to receive my FREE CyberGuy report
Get my best tech tips, urgent security alerts, and exclusive offers delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Guide to Surviving Scams, free when you join me CYBERGUY.COM information sheet.

THE FAKE REFUND SCAM: WHY SCAMMERS LOVE VACATION BUYERS

What Fake Delivery Text Messages Look Like

Most of these fake shipping text messages include a “tracking link” that looks close enough to the real item that you can tap it without a second thought. In some cases, as one Maryland woman discovered, you may even receive fake deliveries with a QR code which works similarly.

These links usually lead to a fake tracking page that looks almost identical to the real one. It will ask you to “confirm” your login or enter your delivery details. The moment you type something, scammers capture it and use it to access your real accounts.

Even worse, the “tracking link” may contain malware either spywaretriggering silent installations that can steal passwords, monitor keystrokes, or give scammers remote access to your device.

Red Flags Revealing Fake Shipping and Tracking Messages

So how can you tell the difference between a legitimate message for a delivery you’re actually expecting and one of these scams? Here are the red flags I look for:

• Strange or slightly altered URLs. Scammers use domains that look almost correct. Except there’s usually an extra letter, a swapped character, or a completely unknown extension.
• Additional Payment Requests. Real carriers don’t ask you to pay a “small fee” to release a package. That’s an instant gift.
• A package you didn’t expect. If the text is vague or you can’t relate it to a recent request, pause before touching anything.
• Delivery attempts at odd hours. “Missed delivery at 6:12 am” or “night attempt” messages are usually fake. Carriers don’t normally operate like this.
• Updates that don’t match what you see in the app or email from the retailer. If Amazon says your package will arrive tomorrow, but a random text says it’s delayed or stuck, trust Amazon, not the text.
• Language designed to rush you. Anything that screams “immediate action required!” It’s designed to get you to stop thinking and start tapping.

If a text triggers any of these, I delete it on the spot. If in doubt, always check directly with the delivery service provider first before opening any link.

WHY YOUR HOLIDAY SHOPPING DATA NEEDS A CLEANUP NOW

How scammers know your address, phone number and purchasing habits

Scammers don’t magically know where you live or what you’ve ordered – they buy that information. In fact, there is an entire industry of data brokers based on the collection and sale of personal data. This may include your:

• Phone number
• home address
• Email
• Purchase history
• Navigation patterns
• Retail accounts and applications
• Loyalty programs
• Even preferred delivery times.

These data brokers can sell profiles that contain hundreds of data points about you. And they are not always aware of who they sell to. In fact, some of them have been caught intentionally selling data to scammers.

Once scammers have those details, creating a convincing delivery scam won’t be a problem.

But scammers can’t target what they can’t find

I’ve been very vocal about the importance of keeping personal information under lock and key. And this is just one of the reasons.

Criminals rely on your personal information to target you with these types of scams. They also need at least a phone number or email address to contact you first.

Therefore, your best bet to avoid delivery scams (and, honestly, most other scams all year round) is to remove your information from data brokers and people search sites. Doing this will keep your data out of circulation online and out of the wrong hands.

FBI warns email users as holiday scams rise

How to remove your personal information from scammers

You can start by searching yourself online. Searching for different combinations of your name, address, email, and phone number should generate many people search sites. Simply visit the “opt-out” page on each site to request deletion of your data.

Private database data brokers are a little more complicated. They sell data wholesale, usually to marketers and other third parties. So you won’t be able to check if they have your information. But if you research which data brokers operate in your area, you can send opt-out requests to all of them. It is very likely that they have your information.

You can also use a data deletion service. They completely take the headache out of this process and automatically keep your personal information off of data broker sites. If, like me, you don’t have time to keep manually checking data broker sites and submitting deletion requests every few months (because your data will still appear), a personal data deletion service is the way to go.

While no service can guarantee complete removal of your data from the Internet, a data deletion service is truly a smart choice. They are not cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically deleting your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to delete your personal data from the Internet. By limiting the information available, you reduce the risk of scammers cross-referencing leak data with information they can find on the dark web, making it harder for them to target you.

Check out my top picks for data removal services and get a free scan to find out if your personal information is already available on the web by visiting Cyberguy.com.

Get a free scan to find out if your personal information is already available on the web: Cyberguy.com.

Kurt’s Key Takeaways

Holiday delivery scams work because they blend seamlessly into the chaos of December shopping. A well-timed text message and a family tracking link are often all it takes to let your guard down. By slowing down, verifying messages directly with retailers, and reducing the amount of personal data circulating online, you can eliminate the leverage scammers rely on. A little caution now can save you a big headache later.

Have you received a suspicious delivery or tracking text message this holiday season? If so, tell us how you thought it and how you handled it by writing to us at Cyberguy.com.

CLICK HERE TO DOWNLOAD THE News APP

Sign up to receive my FREE CyberGuy report
Get my best tech tips, urgent security alerts, and exclusive offers delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Guide to Surviving Scams, free when you join me CYBERGUY.COM information sheet.

Copyright 2025 CyberGuy.com. All rights reserved.