A logistics website costs an afternoon: a stock template, a hero image of a container ship, a paragraph about decades of world-class service, and a form that accepts any number you type. What it cannot fake is a scan trail, because a real one is produced by physical handling at named facilities. That is where you look.
Do not use the link. Close it, open the carrier's own site by typing the address yourself, and paste the tracking number there. A message that arrives before you requested tracking, and contains a link, is the pattern postal inspectors specifically warn about.
Every major carrier publishes the shape of its own tracking numbers.
Tracking numbers are not arbitrary. Each carrier documents the formats it issues, and a number that matches none of them was invented by whoever sent you the message.
UPS publishes its formats openly: the familiar one begins 1Z followed by sixteen characters. It also accepts several other identifier types running from seven to twenty characters — delivery order numbers for less-than-truckload freight, house air waybills for air movements, house bills of lading for ocean freight, PRO numbers for surface freight. A postal delivery confirmation number handed to it through its mail-innovations service runs 22 to 34 digits.
That range sounds permissive, and it is, which is why format alone never proves a number is genuine. It does the opposite job well: a fifteen-character string of mixed letters that fits no published scheme is a strong negative, and it takes ten seconds to establish.
Look up the format on the carrier's own support pages, reached by typing the carrier's address into your browser. Not through a search result, and never through a link in the message that gave you the number.
Scans happen where a person or a machine handled the parcel.
Each event in a genuine trail exists because the parcel physically passed a scanner: an origin facility, a sort hub, a linehaul departure, an arrival, a vehicle load, a delivery attempt. Every one carries a place and a timestamp, because the scanner knew both.
Fabricated trails are vague in a specific way. They give you a status without a location — "in transit", "processing", "customs clearance" — repeated for days with no named facility anywhere. Nothing physical produced those lines; a script wrote them on a schedule.
| Event as shown | What it should carry | Concern if missing |
|---|---|---|
| Origin scan / shipment received | Facility name and city | High — this is the first physical touch |
| Departed / arrived facility | Two different named locations over time | High — a route needs places |
| Out for delivery | Local delivery station, same-day date | Medium — some carriers name only the city |
| Customs clearance | Country of entry | High if the shipment never crossed a border |
| Delivered | Time, and often a location description | High — see check 05 |
Compare the trail on the page that contacted you with the same number entered on the carrier's own site. Two different stories about one parcel settles the question immediately.
Fabricated routes fail basic geography and basic time.
When the events do name locations, read them as a journey. A parcel moves through a hub structure: local pickup, regional sort, longer haul, destination sort, local delivery. It does not ping between distant cities in an order no network would use, and it does not cross an ocean in two hours.
Long gaps between scans are normal, especially on ground services and over weekends. A parcel can sit unscanned in a trailer for two days and still be fine. Silence is not the same as fabrication — absence of events is weak evidence, while impossible events are strong evidence.
This is the check that matters most, and it needs no expertise.
The point of a fake tracking page is almost never the tracking. It is the small fee: a redelivery charge, a customs duty, an address correction, a storage or security-keeping fee. The trail exists to make the request feel procedural.
The pattern is old and remarkably stable. Fraudulent courier emails collected and published by carriers themselves follow one script — a package is held, it contains something valuable, everything else has been paid for, and all that remains is a modest fee before release. The amounts stay small precisely because a small amount gets paid without a phone call.
Contact your bank or card issuer straight away — that is the step that limits the damage, and it works better the sooner it happens. Postal inspectors ask you to notify your financial institution even if you filled a form in and did not submit it.
Suspicious postal texts can be reported by email to the Postal Inspection Service, and forwarding the message to the short code 7726 helps carriers block the sending number. Report it without clicking anything in it.
Usually not fraud. Usually not a lie either.
This is where an honest page has to separate itself from a scam page, because the most common cause is mundane. Drivers place parcels out of plain sight deliberately. UPS's own guidance is to check exterior doors, the porch, the back patio, the garage, and to ask anyone nearby who might have taken it in.
Timing confuses people too. UPS delivers as late as 9 p.m. and later in the holiday season, and ground parcels arrive anywhere in a window from 9 a.m. to 9 p.m. rather than at a promised hour. A parcel marked out for delivery in the morning and absent at six in the evening is not late yet.
The shipping contract is usually between the seller and the carrier, not you and the carrier. Going to the seller first is not being passed around — it is going to the party with standing to file.
One genuine fraud does use this status: a parcel marked delivered to your address that you never ordered, sent to make a fake review look verified. Unrequested deliveries are worth reporting rather than ignoring, because your details are already being used somewhere.