Focus on the action the message wants.
A request to fix an address, release a held parcel or pay a small amount can push you to act before checking. Identify the request first: does it ask you to follow a link, enter account details, provide card information or download something? Familiar delivery wording is not enough to establish the sender.
The US Postal Inspection Service describes parcel-text smishing as messages that impersonate a trusted organisation to obtain information. Its warning specifically addresses unsolicited USPS-style tracking messages and unfamiliar links. That is a USPS-focused source, not a description of every carrier’s notification system.
DHL’s fraud-awareness page lists shortened links and generic sender names among indicators to examine. It also warns that an apparently legitimate email sender can be spoofed. Treat an indicator as a reason to verify independently, rather than trying to approve a message because its logo or wording looks right.
Expecting a parcel does not confirm that a message is about it. Start with the shipment record you already have, then check whether the request appears in the carrier’s or purchasing service’s own channel.
Verify through a separate route.
The FTC’s phishing guidance recommends contacting a company through a website or number you know is genuine, rather than the information in the incoming message. Use that separation to check the request:
- Leave the message link unopened. Use the service’s app or a trusted address you already know instead of treating the incoming link as your route to support.
- Identify the carrier from your existing order record. A sender calling itself “Delivery” does not identify who handles your parcel.
- Check the request in that independent channel. Compare the shipment and any invoice or address issue with the information there.
- Ask the service if the records do not match. Use contact details from the verified account or official site, not the unexpected message.
For Hipobuy Spreadsheet readers, this means separating the product-discovery site from the services handling the order and delivery. This blog cannot see a private account, confirm an invoice or accept a parcel payment. A search result or community comment is not an account record either.
Do not turn this check into the rule that every request for a delivery-related payment is fraudulent. A charge can be genuine and still need confirmation. What matters here is establishing the request and recipient independently before sharing information or making a decision.
Keep the useful details private.
Record the sender, date and exact request if you need to ask the real service about it. A screenshot can preserve what appeared, but avoid posting an unredacted address, tracking label, order number or account screen in a public thread. Keep the full version for the private support or reporting channel that actually needs it.
If the service confirms an impersonation attempt, use its current reporting instructions. USPIS and DHL publish their own reporting guidance on the linked pages; the appropriate route depends on who is being impersonated and where you are. This article does not submit a report for you.
If you have already entered sensitive information, describe that promptly to the actual account provider or payment provider through a trusted channel and follow its recovery process. A message asking for further payment to “recover” a parcel is another request to verify, not evidence that it will solve the problem.
The practical result is small but useful: act on a request you confirmed through an independent channel, rather than one that merely arrived at a plausible time.
A real shipping cost still needs independent verification. Compare the request with the fields in our shipping-cost guide, not with the message alone.
Sources & scope.
Sources checked . Verify an incoming delivery message; no tracking-status or shipping-price tutorial. This article explains published information and an editorial method; it is not a report of our own purchase or a finding about a particular buyer.
- USPIS: Package Tracking Text Scams
- DHL US: Fraud Awareness
- FTC: Recognize and Avoid Phishing Scams
USPIS and DHL describe impersonation indicators and reporting; the FTC supports independent contact and publishes further recovery guidance. These sources do not establish Hipobuy’s fees, delivery times or whether a particular message is fraudulent.