A text about a package you did not order.
A short message says a delivery is waiting and asks you to tap a link. The link is the scam. Here is what the message is doing and what to do.
How it works
The text looks ordinary. It names a carrier, says a package is held or a fee is due, and includes a link. The page it opens asks for a card number, or for a password. Sometimes it says the delivery address needs confirming.
The message is not from the carrier. The link is there to collect a card number or a password.
What to do
Do not tap the link. If you are expecting a package, open the carrier’s app, or type the carrier’s address yourself.
If you already entered a card number, call the bank on the number printed on the card and ask them to watch it. If you entered a password, change it from the real site, and turn on a second sign-in step if the account offers one.