What to do
What you paste stays on your phone
The check runs on your own phone or computer, inside this page. The page’s security setting (a Content Security Policy, a rule the browser enforces) blocks it from connecting to any server after it has loaded, so what you paste stays on your device.
- No account, no sign-up and no cookies.
- Press Clear or close the tab, and what you pasted is gone.
- You can test it: switch the internet off once the page has loaded, and it still works.
What the check looks for
- A link that does not belong to the company named. The part of a web address that decides where it goes is the name just before the first single slash, such as usps.com. In usps.com-track.help, the real website is com-track.help. The check compares every link with the table below.
- A request for money. A redelivery fee, customs charge, unpaid toll, balance or late fee.
- A request for card details, codes or passwords. A courier does not need these to deliver a parcel.
- Pressure. A deadline, a final notice, or a warning that the parcel will be returned.
- Disguised links. Shortened links, links made of numbers, links with an @ sign, and links written in look-alike letters from another alphabet.
- “Reply Y to activate the link”. Phones often switch links off in texts from unknown senders, and a reply switches them back on.
Why delivery and toll texts are so common
The Federal Trade Commission, the United States consumer protection agency, found that fake package delivery texts were the most reported text scam of 2024, a year in which people reported US$470 million lost to text scams overall (Federal Trade Commission, 14 April 2025). In the United Kingdom, people sent 89.8 million reports of scam texts to 7726 between May 2024 and March 2025 (Ofcom, the United Kingdom’s communications regulator, 29 October 2025). In a lawsuit filed on 12 November 2025, Google estimated that one text-message kit sold to criminals had reached more than 1 million people in 120 countries, with texts posing as the United States Postal Service and toll operators (an estimate in a court filing, reported by BleepingComputer).
What this check cannot do
It reads the words and web addresses in the text. It does not open any link, so it cannot see where a shortened link ends up, and it cannot tell whether a parcel really exists. A genuine company can add a new web address that is not yet in the table. So the safest step is always the same: open the company’s own app, or type its web address yourself, and check the parcel or charge there.
The web addresses this check knows
Each company’s real address, as used by the check. Any address that ends in one of these, such as www.royalmail.com or tools.usps.com, belongs to that company. List compiled 23 October 2026. If an address is missing or has changed, please write to support@utilforge.org.
| Company | Where | Real web address |
|---|---|---|
| United States Postal Service (USPS) | United States | usps.com (also usps.gov, and uspis.gov for the Postal Inspection Service) |
| UPS | Worldwide | ups.com |
| FedEx | Worldwide | fedex.com |
| DHL | Worldwide | dhl.com, and DHL’s country sites such as dhl.de, dhl.co.uk and dhl.nl |
| Royal Mail | United Kingdom | royalmail.com |
| Parcelforce Worldwide | United Kingdom | parcelforce.com |
| Evri (formerly Hermes) | United Kingdom | evri.com |
| Australia Post | Australia | auspost.com.au |
| Canada Post | Canada | canadapost-postescanada.ca (canadapost.ca also leads there) |
| PostNL | Netherlands | postnl.nl |
| South African Post Office | South Africa | postoffice.co.za |
| The Courier Guy | South Africa | thecourierguy.co.za |
| Aramex | Middle East, Africa and Asia | aramex.com, aramex.co.za |
| India Post | India | indiapost.gov.in |
| Singapore Post (SingPost) | Singapore | singpost.com |
| E-ZPass and other toll operators | United States, United Kingdom, Australia | E-ZPass: e-zpassiag.com, e-zpassny.com, ezpassnj.com. SunPass: sunpass.com. FasTrak (San Francisco Bay Area): bayareafastrak.org. The Toll Roads (Orange County, California): thetollroads.com. TxTag (Texas): txtag.org. Illinois Tollway: illinoistollway.com. Peach Pass (Georgia): peachpass.com. NC Quick Pass (North Carolina): ncquickpass.com. Linkt (Australia): linkt.com.au. Dart Charge (Dartford Crossing, United Kingdom): gov.uk |
Questions and answers
Is this parcel delivery text a scam?
Treat any text that asks you to pay a redelivery fee or customs charge through a link as unverified, and check the parcel in the retailer’s app or on the courier’s own website, typed in yourself. Paste the text into the check above to see whether its link belongs to the courier it names.
Is the unpaid toll text real?
Toll texts that link to a payment page are sent in very large numbers by criminal text kits, so type the toll operator’s web address yourself or open its app, and check your account there instead of using the link.
The link has the courier’s name in it. Does that make it real?
No. Anyone can put a company’s name at the start of a web address. What counts is the name just before the first single slash: in royalmail.com-redelivery.info, the website is com-redelivery.info, not Royal Mail.
I already paid the fee or typed my card details. What now?
Call your bank or card company now, on the number on the back of your card, and ask them to block the card and dispute the payment. The first-hour guide puts the next steps in order for your country.
Where do I report a scam delivery text?
In the United States, the United Kingdom and Canada, forward the text to 7726. In Australia, forward it to the Australian Communications and Media Authority on 0429 999 888. Other countries are on the official help page.