Detect Delivery-Photo Text Scams That Try to Steal Your Pickup Codes

Those quick texts that say “Here’s the delivery photo” or “We need your pickup code to complete delivery” can feel routine—until a package goes missing. A growing scam uses fake delivery-photo messages to trick you into sharing the one-time pickup code (OTP) for a parcel locker or store counter. With that code, a scammer can collect your package instantly. This guide explains exactly how the scheme works, how to spot it, and what to do to protect your deliveries and your personal information.

What This Scam Looks Like

Fraudsters impersonate couriers, parcel lockers, or retailers. They send a text (SMS), WhatsApp, or in-app message with language like:

• “Delivery attempt failed. See photo: short link. Reply with your pickup code to reschedule.”
• “Your package is at Locker 12. Confirm the code to unlock: reply with 123456.”
• “We’re verifying your address. Please provide the 6-digit pickup code we just sent.”
• “Agent at your door. We need your code to release the parcel. Call back now.”

The message may include a shortened link, a blurred “photo” thumbnail, or an urgent timer warning. The goal is simple: make you share or enter your pickup code somewhere the scammer controls.

Why Pickup Codes Are So Valuable

Pickup codes are one-time keys. Anyone who has the code can:

• Open a parcel locker and remove your package.
• Convince a store clerk to hand over a shipment held under your name or phone number.
• Bypass delivery preferences and re-route or confirm receipt.

These codes are designed to eliminate the need to show ID at lockers or retail counters. That convenience is what criminals exploit.

How the “Delivery-Photo” Angle Tricks You

The delivery-photo lure creates urgency and legitimacy. Real couriers sometimes text photos after delivery, so scammers mimic that practice. Common tactics include:

• Fake photo links: Clicking leads to a lookalike page where you’re asked to “verify” or “confirm” the pickup code.
• Two-message trap: Message 1 claims a failed delivery; Message 2 sends a code “for verification.” The scammer simultaneously requests a real code from the locker service by pretending to be you, then waits for you to forward it.
• Live callback: A call center agent pressures you to read the code aloud “so we can release the driver.”

Legitimate vs. Scam: Quick Rules

• Legitimate couriers never ask you to read back a pickup code they sent. The code is proof of control, not something to “confirm.”
• Real links use the official courier domain, not link shorteners. When in doubt, don’t click—navigate to the courier’s app or official website directly.
• No courier needs both your password and your pickup code. Requests for passwords, SSN, or card details alongside a code are red flags.
• Urgent time limits are pressure tactics. Real services allow rescheduling inside the official app or account without sharing codes via text.

Common Variations to Watch

• Locker reroute scam: You receive a “reschedule” link. After logging in on a fake page, you’re told to provide the pickup code to move the parcel to a different locker. The scammer then collects it at the new location.
• Retail counter impersonation: A text claims the store needs your code to “release” the package before closing. The scammer is physically at the counter hoping to get your code in time.
• Account verification hoax: The message pretends to be from your courier account security team asking for the code to “verify your phone” or “stop a hijack.”
• Delivery-photo malware: The link tries to install a malicious app that intercepts one-time codes and notifications.

How Scammers Get Your Number and Order Details

Attackers combine publicly available information with data exposure sources:

• Leaked order notices in email inboxes compromised by weak passwords or reused credentials.
• Data broker profiles that map phone numbers to addresses and shopping behaviors.
• Previous parcel label photos shared online (e.g., marketplace posts) that expose names and tracking hints.
• Phishing of retailer or courier accounts that reveals active shipments.

Even when scammers guess, broad delivery windows (holidays, sales seasons) make their messages feel timely and plausible.

Exact Steps to Verify a Delivery Message Safely

1. Do not click the link. Open the official courier app or type the known website address manually.
2. Check your account or tracking page. Look for any delivery attempts, pickup-ready status, or codes issued.
3. Contact support inside the official app. If there’s no matching event, the message is almost certainly fake.
4. Never share codes by text, call, or email. Codes are entered by you only in the official app, locker keypad, or at the counter.
5. If pressured by phone, hang up and call the official number. Numbers in suspicious texts may connect to the fraudster.

What To Do If You Already Shared a Pickup Code

• Act immediately: Use the courier’s app or hotline to cancel the pickup, change the code, or freeze the delivery. Many services can invalidate an unused code instantly.
• Update the delivery location: Reroute to a staffed counter that requires ID—avoid lockers until the issue is resolved.
• Check for account compromise: Change your courier, retailer, and email account passwords; turn on multi-factor authentication (MFA).
• Watch for follow-on fraud: Scammers who obtained your phone and address may try additional phishing, refunds fraud, or account takeovers.
• Report the incident: Forward scam texts to your carrier’s spam short code (e.g., 7726 in many regions) and notify the courier’s fraud team.

Practical Prevention Tips

• Lock down delivery accounts: Use unique passwords and app-based MFA. Avoid SMS-only MFA where possible.
• Control notifications: Opt into push notifications in official apps; consider disabling SMS notifications that can be spoofed.
• Set pickup preferences: Require ID for counter pickups when the option exists, even if you typically use lockers.
• Create delivery aliases: Where supported, use an alternate pickup name or code phrase that only you know.
• Harden your phone: Keep the OS updated, restrict app installs to official stores, and review notification permissions to reduce code interception risks.
• Redact labels: When sharing photos of packages online, blur or crop names, addresses, and barcodes.
• Reduce data exposure: Opt out of data broker sites that list your phone and address together—this pairing fuels targeted smishing.

How This Fits Into Identity and Privacy Risks

While a stolen package is a tangible loss, the bigger privacy risk is normalization of reading one-time codes to strangers. If scammers train you to share a locker code today, you may share bank or account login codes tomorrow. Treat every one-time code—delivery or financial—as a secret credential. Protecting your delivery codes reinforces secure habits that also help prevent account takeover, new-account fraud, and synthetic identity misuse.

Red Flags You Can Memorize

• Any request to read back, text, or confirm a pickup code.
• Shortened or misspelled links, or links that don’t match the courier’s official domain.
• Requests to combine a pickup code with payment, password, or personal data.
• Threats of immediate return-to-sender unless you send the code now.
• Messages received on an app you never authorized for courier updates.

If You Keep Getting These Messages

• Filter aggressively: Enable spam filtering on your phone. On many carriers, forwarding the message to 7726 helps train network-level filters.
• Silence unknown senders: Route first-time numbers to a separate inbox so pressure tactics are less effective.
• Use official channels: For active shipments, rely on the courier app’s in-app chat and notifications only.
• Change your public contact trail: Remove your phone number from social profiles, classifieds, and marketplace listings where feasible.

When Financial Monitoring Helps

Delivery-code scams often travel with broader phishing that targets your passwords, payment methods, and identity details. If you clicked a suspicious link or entered information, consider ongoing monitoring for unusual credit or identity activity. Proactive monitoring can alert you early to new-account fraud, hard inquiries, or changes linked to your identity. Learn more about tools that combine privacy, credit monitoring, and identity alerts here: SmartCredit for privacy, credit monitoring, and identity protection.

Build a Personal Delivery-Security Routine

1. Only trust the app: Track shipments and codes inside official courier or retailer apps.
2. Never share codes: Enter them only at the locker, in the app, or at the counter yourself.
3. Use ID-required pickups for high-value items: Opt for staffed counters with ID checks.
4. Quarantine suspicious messages: Do not click. Verify independently.
5. Review account security monthly: Passwords, MFA, recovery emails, and login history.

FAQ

Can a scammer get my code without contacting me?

Sometimes. If your email or courier account is compromised, an attacker may generate or view codes directly. That’s why strong passwords and MFA are essential.

What if the courier actually calls me?

Hang up and call the official number from the website or app. Real agents accept callbacks through published channels and will not insist on you reading a code over the phone.

Are image attachments safe?

Images can be harmless, but links or prompts to install an app are not. Avoid opening attachments from unknown numbers and never install apps from links in messages.

Is it safe to share a pickup code with a family member?

Only if you initiated it and trust the person, and only through a private channel. Remember that anyone with the code can take the package immediately.

Conclusion

Delivery-photo texts that ask for your pickup code are not routine—they are a direct attempt to unlock your package and test your willingness to share one-time codes. Treat pickup codes like keys, verify messages only through official apps and websites, and never read codes back to anyone. If you slip, act fast to invalidate the code and secure your accounts. These habits protect your parcels today and strengthen your defenses against broader identity and account fraud tomorrow.