A fake package-delivery text is impersonating your business: how to respond to smishing

Do not trust the text because you expect a package

Scammers exploit the fact that nearly every person or business expects deliveries. A message may claim the address is incomplete, delivery failed, postage is due, or the package will be returned. The FTC reported that fake package-delivery problems were the most commonly reported text scam type in 2024. A familiar company name or coincidental timing does not authenticate it.

Do not reply, click, or call the number provided. Manually open the retailer’s app or website and check tracking there. To reach the carrier, type its official domain or use contact details from a verified record. The FTC recommends verifying deliveries independently rather than using information from the message.

Preserve the complete screenshot, sender, date, time, wording, and visible URL without visiting it. If others received the campaign, retain representative examples without collecting unnecessary phone numbers. Separate the text, domain, payment page, phone, profile, and advertisement; each may need its own report.

• Complete screenshot and text
• Sender number or identifier
• URL without opening
• Real order and official tracking
• Requested data, payment, or download

Separate smishing from a legitimate notice

Smishing is phishing delivered by text. USPIS explains that deceptive messages seek personal or financial information and that official USPS text tracking must be initiated by the customer with a specific tracking number; it does not contain an unexpected link. Other carriers have different procedures, so verify on their own websites.

Warnings include urgency, misspelled domains, short links, small redelivery fees, card or identity requests, passwords, authentication codes, and copied carrier pages. A small fee remains dangerous because it exposes card and address data. Correct spelling does not prove authenticity.

For an impersonated company, determine whether the campaign only uses the name or whether a corporate account, SMS provider, or website was compromised. Review access, campaigns, domains, DNS, email, and vendors. Do not blame a competitor, employee, or platform without evidence.

What to do after clicking or paying

If you opened the page but entered nothing, close it, avoid downloads, and obtain security help if you granted permissions. If you entered a password, change it from a clean device, review sessions and reuse, and enable additional authentication. An installed app or profile needs device-specific review.

If you entered card details or paid, contact the bank or provider immediately through a verified number. Preserve the amount, time, merchant, and reference and follow instructions on blocking, replacement, disputes, and monitoring. Recovery depends on method, institution, country, evidence, and speed; no responsible agency can guarantee it.

Report the text as spam on the phone. In the United States, the FTC mentions forwarding it to 7726 and reporting through ReportFraud.ftc.gov; USPIS provides postal-impersonation channels. In Spain, INCIBE offers 017 and smishing guidance. Use equivalent channels elsewhere.

How the impersonated company should warn people

Publish a dated notice on the website, social accounts, and customer-service channels stating that the text is unauthorized, listing authentic domains, and explaining how to verify deliveries. Do not reproduce the active link or a clickable image. State that the company will not request passwords, codes, or financial details through an unexpected link.

Report the domain to the relevant registrar, host, browser, or provider and the number or campaign to the carrier where appropriate. Coordinate with genuinely affected retailers and delivery companies. Keep a timeline of warnings, removals, and reappearances and never promise that blocking one domain stops every message.

ReputationGeo.ai can organize evidence, map assets, prepare bilingual reports and warnings, and monitor new campaigns. Carriers, hosts, registrars, banks, platforms, and authorities decide independently. We do not guarantee removal, identification, recovery, or timing. This is general information, not technical, financial, or legal advice.

How to turn this guidance into a responsible plan

Begin with evidence, not assumptions. Save the exact URLs, screenshots, publication dates, search phrases, review profiles and AI answers that are creating concern. Record where each item appears, who controls the source and whether the information is inaccurate, outdated, private, misleading or simply unfavorable. These distinctions matter because removal, correction, response, suppression and monitoring are different remedies. A credible adviser should explain those differences before recommending work or discussing timing.

Next, define the audience and the decision at risk. A result seen by prospective clients in Spain may require different language, sources and local signals from a result affecting investors in the United States. Decide which names, brands, locations and search questions matter most. Prioritization prevents a campaign from becoming a vague attempt to control the internet and turns it into a measurable program focused on accuracy, trust and discoverability.

Evidence, people and measurements to prepare

Create a baseline before changes begin. It can include the first two pages of Google for agreed searches, ratings and review volume, visibility of owned pages, recurring themes in AI answers and the status of platform or publisher requests. Keep personal data to the minimum necessary and share sensitive documents only through an agreed secure process. If a legal right may apply, involve qualified counsel in the relevant jurisdiction; reputation strategy does not replace legal advice.

Assign an owner for approvals, factual verification and customer responses. Review progress consistently, but do not judge the program by one daily ranking. Useful measures include corrected or removed items, response completion, the share of credible owned and independent sources, search-result composition, branded query trends and whether public information answers real questions. The objective is a more accurate and resilient digital record, not an artificial promise that criticism will disappear.

Keep a decision record, not just a list of links

For every material item, record the exact source, the factual concern, the person responsible for verification, the proposed route and the reason that route is proportionate. Include the date of any request, response deadline, platform reference number and next review date. This record prevents duplicate or contradictory reports and helps a new decision-maker understand why an item was corrected, challenged, answered, monitored or left alone.

A sound record also separates confirmed facts from interpretations. Label legal questions for qualified counsel, service failures for operational owners and public explanations for communications review. If an item changes, preserve the before-and-after evidence without collecting more personal data than necessary. This discipline is especially important when search engines and AI systems update unpredictably: it shows what actually changed and avoids claiming credit for movements that may have several causes.

• Source, URL, date and affected search or prompt
• Verified facts, disputed claims and supporting evidence
• Chosen route, owner, status and next review date
• Privacy, amplification and escalation risks