How to recognize and prevent FedEx scams

You’re expecting a delivery when a message from “FedEx” appears in your inbox. It looks like a routine delivery update, but if it’s fake, clicking it could put your personal information at risk.

Scammers can copy FedEx’s logo, tone, and messaging style to gain your trust and steal data or install malware on your device. With online shopping on the rise, these fake delivery alerts have become more convincing and easier to mistake for real ones.

Understanding how scammers impersonate delivery companies is the first step to staying safe. This guide shows how to spot FedEx scams, report them safely, and protect your data.

What are FedEx scams and why are they increasing?

FedEx scams are phishing scams in which criminals impersonate the company to steal personal or financial information.

These scams work by playing on trust and urgency. Most of us expect delivery updates, so a suspicious shipping alert about a missed delivery or problem can seem routine. Scammers count on that split-second reaction, hoping you’ll act before thinking.

Why FedEx is a popular target for scammers

Scammers target FedEx not because of weak security, but because it’s a global brand people trust. The company delivers an average of 16 million packages every day, serving 220 countries worldwide. With such a large user base, it’s easy for fake alerts sent at random to reach someone who’s actually expecting a package.

The role of text messages, emails, and fake links

Scammers spread fake FedEx messages through text messages (SMS phishing, or smishing) and emails that look like real delivery updates. They may use the official logo, familiar layouts, and even tracking numbers to make them appear genuine.

These messages typically include a link to “track” or “confirm” a package and might come with an urgent tone or subject line. Clicking the link often leads to a fake webpage that asks for personal or payment details. Some emails include attachments disguised as invoices or shipping labels that quietly install malware once opened.

In some cases, scammers even call directly (vishing), pretending to be FedEx reps or customs officers claiming there's an issue with your package.

Keep in mind that FedEx never asks for personal information through unsolicited emails, texts, or calls. The company also warns against emails asking you to open attachments to view invoices or delivery details, as these are usually scams. If a message feels suspicious, avoid clicking links or replying, and check your delivery status directly through the official FedEx channels.

Most common types of FedEx scams

Most scams reuse the same playbook: a missed package alert, a surprise fee, or a request to confirm delivery details. Here’s a quick overview of the most common FedEx scams to be aware of.

Fake delivery failure notifications

A common FedEx scam begins with a text or email saying your package couldn’t be delivered. It might mention a wrong address, a missed drop-off attempt, or an unpaid fee. The message looks official, often including a spoofed tracking number and a link to reschedule or confirm your shipment.

For example, it might ask you to reschedule or pay a “redelivery” fee on a website. Once you enter your login credentials or payment details, scammers may be able to capture that information and use it for fraud or even identity theft.

Update your “delivery preferences" fraud

You might get an email or text with a fake code and link claiming there’s a problem with your delivery address or that you need to update your delivery preferences to avoid a return. Clicking on the link takes you to a fake FedEx login page designed to capture your credentials or other personal information.

Customs or “package held” scams

People expecting international deliveries are a frequent target of this scam. Fraudsters often exploit customs-related messages to create panic and pressure, claiming your package is being held due to unpaid duties, restricted items, or customs checks.

You might be told that your parcel can’t be released or will be destroyed or returned unless you pay a small fee or confirm your personal information.

Bank draft or check scams

Scammers sometimes pose as former business partners, a lottery board, or a generous benefactor, claiming they’re sending a certified check or bank draft through FedEx as part of a prize, payout, or inheritance.

The message may claim that your package includes a large payment but then ask for a small “security” or “clearance” fee before it can be delivered. They may also request personal or banking details under the pretense of verifying your identity or completing the transfer. However, once you send the fee or share your details, the scammer disappears, and the package never arrives.

ATM card delivery scams

Some fraudsters take a different approach by claiming that a valuable shipment, such as an ATM card, credit card, or bank draft, is waiting to be delivered through FedEx. The message or call usually says the delivery can’t proceed until you verify your identity or make a payment to deliver it.

They might ask for a “delivery” or “holding” fee or ask you to share your personal details, such as your full name, address, date of birth, or even ID copies to confirm it’s really you.

Red flags that signal a FedEx scam

Even the most convincing scams share small details that give them away. Watch out for these warning signs of a phishing attempt:

Urgent language and threats about missed delivery

Scammers often try to create panic by claiming your package will be delayed, returned, or destroyed unless you act immediately. Alarmist phrases like “Your parcel will be returned within 24 hours” are meant to push you to act before checking the details.

Shortened or unusual URLs

Scammers often hide fake tracking pages behind shortened URLs like bit.ly or tinyurl to make them look legitimate. Always hover over the link before clicking to see where it actually leads. If the address doesn’t begin with HTTPS (indicating a secure connection) and an official fedex.com domain, it’s likely a phishing attempt.

Spelling mistakes or generic greetings

The tone and writing style of a message can also reveal a scam. Awkward phrasing, spelling mistakes, or sentences that don’t quite sound professional often mean the message didn’t come from FedEx.

It’s also worth checking how the message addresses you. Generic openings like “Dear Customer” or “Sir/Madam” are common in scams, while legitimate FedEx emails usually include your name or business details.

Messages from unknown numbers or emails

Always double-check who a message is really from. Real FedEx emails come from the official domain, ending in @fedex.com. Messages sent from personal accounts, like @gmail.com or @yahoo.com, or from misspelled domains, such as @fed-ex.com, are almost certainly fake.

Unexpected fees

Be cautious of any unexpected payment requests like “redelivery” fees or unwarranted duty tax, even if they’re minor charges. Fraudsters can use small fees to steal your card details if you make the payment through a malicious link.

How to report a FedEx scam

If you suspect a message or call is a scam, reporting it helps protect not only you but also others who might be targeted. FedEx provides several ways to report fake texts, emails, and calls so its security team can investigate and take them down.

Steps to take immediately after receiving a suspicious message

Acting fast helps minimize the damage. If you suspect a fraudulent message or call:

• Stop all contact: Don’t reply, click links, or share any of your information with the sender.
• Save all evidence: Keep copies of any emails, texts, physical letters, or call logs tied to the scam, along with screenshots of messages, links, or fake websites. For emails, save the full header if possible, as it helps trace where the message came from.
• Report it right away through official channels: Share the information with FedEx and the proper authorities so they can investigate and help prevent further scams.

How to forward emails and texts to FedEx

Sharing the message helps FedEx strengthen ongoing investigations and prevent similar ones from spreading. That extra step may also prompt the fraud team to keep a closer eye on your account and offer further guidance. To report a scam, forward the entire text or email, including headers, to abuse@fedex.com.

You can also forward spam text messages to 7726 to report them to your mobile service provider, helping them identify and block similar messages in the future.

How to report FedEx scams to federal agencies

In addition to reporting to FedEx, reporting scams to government agencies helps uncover wider fraud networks. These reports give investigators the data they need to trace cybercriminals and warn the public about new threats.

If you’re outside the U.S., you can contact your local consumer protection agency or law enforcement authority.

Report online scams to the FBI (IC3)

The Internet Crime Complaint Center (IC3), operated by the FBI, handles reports of phishing, online fraud, and other cyber-enabled scams. You can file a complaint directly at ic3.gov.

Report fraud or identity theft to the FTC

The Federal Trade Commission (FTC) is the primary U.S. agency for consumer fraud and identity theft. You can report fraud and scams at ReportFraud.ftc.gov or IdentityTheft.gov, while consumer.ftc.gov offers additional guidance and resources.

Report mail-related scams to the U.S. Postal Inspection Service (USPIS)

If the fraud involved physical mail, such as fake checks, documents, or packages, report it to the U.S. Postal Inspection Service. You can file a complaint at USPIS.gov/report.

What to do if you’ve fallen for a FedEx scam

If you clicked a link or shared information, stay calm and act fast to protect your accounts and prevent further damage.

Secure your accounts and personal information

Start by changing passwords for any accounts that might’ve been exposed. Then, turn on two-factor authentication (2FA) or multi-factor authentication (MFA) to add an extra layer of protection and make it harder for fraudulent actors to misuse your data.

Contact your bank or credit card provider

It’s also a good idea to reach out to your bank’s fraud department using the official number on the back of your card or on the bank’s website. Let them know you were targeted by a phishing scam so they can cancel your card, block unauthorized transactions, or reverse any fraudulent charges.

Most banks have measures to limit losses if fraud is reported quickly, so acting fast can make all the difference. Additionally, monitor your account closely over the next few weeks and report any suspicious activity immediately.

Scan your devices for malware

If you’ve clicked on a suspicious link or opened an attachment, it’s important to make sure your device is clean. Run a full system scan using trusted, up-to-date antivirus software. Once it’s done, follow any instructions given to quarantine threats, if found.

After checking for malware, it’s also a good idea to update your device and apps. Security updates often patch vulnerabilities that malware can exploit.

Monitor for identity theft or unauthorized activity

If a scammer successfully obtains any of your information, they may be able to use your stolen details to open new accounts or make purchases in your name.

Here’s how to stay on top of your information and catch anything suspicious early:

• Track your personal information: Consider using a dark web monitoring service to check if your information is being sold or shared.
• Check your bank statements and credit reports: Even small, unexplained charges can be early warning signs of fraud.
• Consider a credit freeze: If you suspect your financial information is at risk, you may want to freeze your credit to stop anyone from creating new lines of credit under your name.
• Use identity protection tools: ExpressVPN’s Identity Defender (available to U.S. users on select subscriptions) offers credit monitoring, dark web monitoring, and identity restoration support, alerting you to new credit activity and guiding you through recovery if your information is ever misused.

Learn more about protecting your information in our guide to identity theft prevention.

How to prevent FedEx scams

Avoiding FedEx scams starts with a little skepticism. Treat every unexpected delivery message with caution, especially if it sounds urgent or asks for money.

How to verify legitimate FedEx messages

When you get a FedEx alert, always verify it yourself instead of clicking any link:

• Check directly on FedEx’s official site or app: Copy the tracking number and enter it on fedex.com or in the FedEx mobile app. If it’s real, you’ll see the shipment details and any relevant notifications there.
• Only trust messages you’ve requested: FedEx sends updates only when you or a merchant have opted in, such as through FedEx Delivery Manager. Any message about a shipment you weren’t expecting is likely fake.

Simple tips for staying safe online

The next few steps can help you stay aware and protect your personal information.

Inspect links without clicking

Never open links in unexpected emails or text messages. If you’re unsure about a FedEx alert, here’s how to safely check where a link really leads before interacting with it:

• On desktop: Hover your cursor over the link to see its full address in the corner of your browser. Look closely for misspellings or domains that aren’t part of fedex.com.
• On mobile: Press and hold the link to preview its destination. If you see unusual characters or shortened links, it’s best not to continue.
• Extra check: You can copy the link (without clicking) and paste it into a trusted URL checker to confirm if it’s safe.

Learn more in our guide on how to check if a website is safe.

Use spam filters and anti-phishing software

Here are some security tools that can add an extra layer of protection against scam messages:

• Spam filters: You can reduce the spam emails you receive by activating your email provider's spam filters, which can automatically flag and quarantine suspicious messages.
• Enable call and text blocking: Most phones have built-in tools to block or report spam numbers. Check your settings for options like Silence Unknown Callers (iPhone) or Block Spam Calls (Android).
• Use spam-filtering apps: Some third-party apps maintain large databases of known spam numbers and can automatically flag or block suspicious calls and messages.
• Enable browser protections: Make sure your browser’s built-in security features are enabled and consider adding a trusted anti-phishing or web protection extension to block malicious sites.

Best practices for handling unexpected deliveries

Scams don’t always stay online; sometimes they show up right at your doorstep. Unsolicited deliveries may be part of a brushing scam, where sellers send items to random addresses so they can post fake positive reviews under the recipient’s name.

Avoid paying any fees or contacting the sender. According to the FTC, you should be able to keep the item, but it’s still a good idea to report it to the retailer so they can stop any misuse of your name.

Can a VPN help you avoid FedEx scams?

A virtual private network (VPN) helps you stay safer online, but it isn’t a complete safeguard against scams that exploit human error. FedEx scams typically rely on deception to make victims click or share personal details, not on compromising network security.

How VPNs enhance privacy and security

A VPN encrypts your internet traffic and masks your IP address, making it much harder for anyone to track what you do online.

This extra layer of protection is especially helpful on public Wi-Fi, where networks are often unsecured and make it easy for others to intercept your information. While most sites, including the official FedEx site, are encrypted with HTTPS to protect your information, an unencrypted site could leave your data exposed.

Using a VPN adds an extra layer of security by creating an encrypted “tunnel” between your device and the VPN server, ensuring your data stays protected as it travels to the internet.

Can VPNs block malicious links or phishing domains?

Most VPNs don’t inherently block malicious links or phishing domains by default. However, some VPN providers offer additional security features like malware blocking or ad blocking.

ExpressVPN’s Threat Manager can block access to known malicious domains and trackers, helping prevent you from opening dangerous sites by mistake.