ISO 27001 Certified badge by A-LIGNNewsWhalemate is ISO/IEC 27001:2022 certifiedSee Trust Center
Phishing examplesSmishing · SMS

Smishing example: the package on hold text message

A text says a package is on hold because of an unpaid fee and will be returned unless you pay today. The amount is small, so paying feels easier than asking. The link leads to a page that asks for your card.

Simulate this scenario with your teamSmishing service

Whalemate professional service

+1 (202) •••-4821 (Red flag 1)Text message

Today 10:23 AM

DELIVERY: your package is on hold (Red flag 2) at our distribution center due to an unpaid shipping fee of $1.99 (Red flag 3). Pay today (Red flag 4) at parcel-tracking-us.example/pay (Red flag 5) or it will be returned to sender.

Recreation with fictitious data. Each number marks a red flag.
Red flags

Five red flags that give the fake text away

  1. A random mobile number as sender

    Delivery companies usually text from a name or a short code. An ordinary mobile number you do not recognize is a strong red flag.

  2. A package with no details

    The message does not say which package or who sent it. It works on anyone waiting for an order; if you do not have a tracking number, there is nothing to pay.

  3. A small amount

    A tiny fee makes paying feel faster than complaining. They are not after that amount: they want the full card.

  4. The deadline is today

    The threat of returning the package on a short deadline is there so you do not go through the app or website you already know.

  5. A link that is not official

    The domain does not belong to any delivery company you know. To track a package, type the official address yourself or use the tracking number from your order.

Before you respond

What to do if you get one

  1. Do not tap the link or reply to the message.
  2. If you are expecting a delivery, find the tracking number in your order email and check it on the official website.
  3. Block the number and report the message as spam from your phone.
  4. If it reached a phone you use for work, tell security.
If you already fell for it

If you already entered your details

  1. If you entered your card, call the bank on its official number and ask them to block it.
  2. If you gave a code you received by text, mention it on that call: it may have authorized a purchase.
  3. If you installed something from the link, uninstall it and ask IT for help before using that phone for work again.
Other channels

The same trap on other channels

WhatsApp

On WhatsApp

The same notice comes from an account named after a delivery company. Anyone can pick a profile name and photo.

Email

By email

A “failed delivery” email has a button to reschedule. Sometimes it asks for a payment; other times only for details “to confirm your address”.

Voice

With a phone call

After the text, someone “from the distribution center” calls, walks you through the payment and asks for the code that arrives on your phone.

Frequently asked questions

Questions about smishing

What is smishing?
It is phishing by text message or messaging apps. The message copies a known company —a delivery service, a bank, an agency— and leads to a link that asks for data or payment. On a phone it is harder to see where a link goes.
How can I tell if a delivery text is fake?
If it does not say which package, asks for a payment to release it, comes from an ordinary mobile number or links to a domain that is not the company’s official one, it is almost certainly fake. Always check with the tracking number from your order.
Why ask for such a small amount?
Because a small payment does not raise suspicion and is faster than complaining. With the card details, much larger purchases can be made later.
Does it affect the company if it reaches a personal phone?
Yes, when that phone is also used for work: email, authentication or company chats. That is why people should also report what reaches them outside their work inbox.

Definitions in the glossary:SmishingVishing

More examples

Other scams to recognize

Phone call

Bank alert and fake call

A text about a purchase you did not make and a call from the “fraud team” asking for a code.

See the annotated example
QR code

Fake parking QR code

A sticker on the parking meter that leads to a card payment page.

See the annotated example
Email

Fake overdue invoice

An attachment that looks like a PDF and opens a page asking for your password.

See the annotated example

All phishing examples

Would your team pay “the shipping fee”?

At Whalemate, smishing runs as a professional service: our team writes the message with a local pretext like this one, sends it only to numbers with explicit authorization and measures who opens, who taps the link and who hands over data, with a report by team.

Simulate this scenario with your team