Messages about missed deliveries and order problems are a favorite disguise for phishing. The US FTC describes what these messages look like and what to do.

This guide is based on the public sources listed at the end. We have not tested the products or services mentioned.

This is a short reference page. The full guide is Safe Online Shopping: Scams, Fake Reviews, Fake Goods and the Checks That Work.

Signs of a phishing message

  • It arrives unexpectedly and imitates a bank, card firm, utility, carrier or shop.
  • It warns of a problem or hold, asks you to confirm details, pay an unfamiliar invoice or claim a refund.
  • It uses a generic greeting, logos and a link to "update" payment details.

The FTC says legitimate companies do not ask you to update payment details through a link in an email or text.

What to do

  1. Do not click links or open attachments.
  2. Go to the shop's own site or app and look up the order status.
  3. If unsure, contact the company using a phone number or website you already know.
  4. If you clicked, update your security software and scan the device. If you entered a password, change it. If you gave other information, visit IdentityTheft.gov (US).

Protect yourself

Use security software with automatic updates, multi-factor authentication and regular backups.

Report

The FTC lists: forward phishing emails to reportphishing@apwg.org, send texts to 7726 (SPAM), and report at ReportFraud.ftc.gov even if no money was lost.

UK readers can also report suspicious messages: the NCSC lists a Suspicious Email Reporting Service and 7726 for texts. See our UK account safety checklist.

Last checked: 15 October 2026. Sources: US FTC, how to recognize and avoid phishing scams; UK NCSC, shopping online securely.