Short answer: a genuine parcel tracking SMS comes from a French short code (3xxxx/2xxxx type) or from an alphanumeric sender naming the carrier, it contains your full tracking number and never asks for a payment, bank card details, or an "address confirmation" via a link. A fake delivery SMS most often comes from an 06/07 or a foreign number, demands a few euros in "fees" and points to a domain that isn't the carrier's. If in doubt: don't click, find the tracking from your order, and forward the message to 33700.
Updated 25 October 2026.
An online order no longer generates one text message, but a small series of them. The retailer confirms dispatch. The carrier announces collection. A second message gives a time slot. A third warns that the parcel is at the pickup point. And sometimes a fourth arrives from a last-mile subcontractor you've never heard of.
It is precisely this noisy normality that makes the fake delivery SMS so effective. The scammer doesn't need to know what you ordered: they know that during sales season, French Days or the run-up to the holidays, a good share of French numbers are waiting for a parcel. They send in bulk, and coincidence does the rest.
How many text messages can a single parcel trigger?
Between three and eight, depending on the retailer and the delivery method. Every player in the chain has its own SMS channel, and none of them knows what the others have already sent you.
The typical chain for a purchase delivered to a pickup point:
- the retailer: "Your order is confirmed" then "Your parcel has been dispatched";
- the logistics platform: collection, tracking number;
- the carrier (La Poste/Colissimo, Chronopost, DPD, GLS, UPS, Mondial Relay, etc.): delivery slot, delivery attempt;
- the pickup point or locker: "Your parcel is waiting for you", collection code, deadline;
- the retailer, again: satisfaction survey, then marketing offers if you ticked the box.
The upshot: you can't rely on volume. Receiving one more text is nothing out of the ordinary. What matters is who it comes from and what it asks for.
Which senders do carriers actually use?
Only three forms, and none of them is a personal mobile number.
| Sender format | Example of what you see | What it means |
|---|---|---|
| Five-digit short code | 3xxxx, 2xxxx | A professional channel registered in France, allocated through the operators and coordinated by AF2M. A STOP reply is possible for the advertising portion. |
| Alphanumeric sender | "COLISSIMO", "CHRONOPOST", "MONDIALRELAY" | A name displayed instead of a number. You can't reply to it. Widely imitated by scammers: the name alone proves nothing. |
| French long business number | +33 9 xx, sometimes an 06 from a company fleet | Used by some last-mile couriers to call or write from the field. This is the genuine grey area. |
Short codes and their ranges are described in the Arcep numbering plan, which allocates blocks to operators. If you want to understand the general logic behind these prefixes, we set it out in our guide to decoding a short code or an unknown sender.
The key point: an alphanumeric sender is not proof of identity. Technically, nothing stops a poorly filtered foreign sender from displaying a brand name. It's the same mechanism exploited for banks, explained in our article on sender spoofing.
How do you spot a fake delivery SMS in ten seconds?
Four checks are enough in the vast majority of cases.
1. Is there a demand for money?
This is the most decisive criterion. A French carrier doesn't text you asking for €1.79, €2.49 or €3.20 to "release" a parcel. Real customs charges, where they apply, come via an official notice and an identified procedure, not through a link in a message. We broke down this scenario in our article on the fake customs clearance fee SMS.
The amount is deliberately trivial: it isn't there to steal €2 from you, but to harvest your bank card number and, in the most polished versions, the 3-D Secure validation code you'll receive by text straight afterwards.
2. Does the link point to the real domain?
Read the domain name from right to left, starting at the last dot before the first /. That's the only part that counts.
laposte.fr/outils/suivre-vos-envois→ domainlaposte.fr.suivi-laposte.colis-info.xyz/track→ domaincolis-info.xyz. The word "laposte" is just a decoy placed on the left.
Be wary too of link shorteners (bit.ly, cutt.ly, etc.) and of domains with endless hyphens. A reputable carrier has no reason to hide its own domain name.
3. Is the tracking number complete and consistent?
Genuine texts quote a full identifier (often 13 characters at La Poste, a long alphanumeric format elsewhere). Fakes make do with "your parcel #4821" or no number at all, because the sender doesn't know what you're expecting.
Test it: copy the number and paste it into the carrier's website, opened from your browser, never from the link in the text.
4. Are you really expecting a parcel from that carrier?
Open your customer account with the retailer. The carrier is stated there. If the text mentions DPD when your order was going out with Mondial Relay, the question is settled.
Simple rule: tracking is checked from the order, not from the message. A delivery SMS is never the only route to your parcel.
Why do fake texts sometimes know my name?
Because the information doesn't come from the mobile network, but from a data breach or a purchased contact list.
A fraudulent SMS that shows your first name, your town or the retailer's name is nothing magical: it recycles a database compromised at an e-commerce site, a logistics provider or a third-party service. This is worth understanding, because it defuses the "they know my name, so it must be real" reflex. We devoted a whole article to this mechanism: this delivery SMS knows your name and address — where did the leak come from?
The practical consequence: personalisation is never a criterion of authenticity. Only the sender, the link's domain and the nature of the request are.
What should you do with a text from a courier on an 06 or 07 number?
Don't automatically file it under scams, but never click a link it contains.
Last-mile couriers really do write from work mobiles: "I'm outside your place", "gate locked, I'll come back", "shall I leave it with your neighbour?". These messages are legitimate and, by their very nature, impossible to formally distinguish from any random unknown number.
The dividing line is simple:
- a message with no link and no payment, describing a concrete situation (address, building code, time slot) → plausible, you can reply in plain text;
- a message with a link, an amount to pay, an address form to "confirm" → don't click, however familiar the tone.
For genuinely doubtful cases, the steps for identifying and blocking an unknown mobile number are set out on our 06 and 07 numbers page and in the SMS scams section.
One logistical detail avoids a lot of these exchanges: a secure parcel box installed outside your home eliminates missed delivery attempts, and therefore "new attempt" texts — and with them, the ground on which fake rescheduling messages thrive.
I clicked. What now?
Act in order, and without delay: timing matters more than doing it perfectly.
- You only opened the page, without entering anything. The risk is low. Close the tab, don't go back to it, and obviously don't install any app the page offers.
- You entered your bank details. Call your bank immediately or block the card from the app, then request a new one. The national bank card blocking service can be reached on 0 892 705 705.
- You received a call from the "fraud department" straight afterwards. Hang up. That's the second act of the script, described in our article on the SMS followed by the fake bank adviser's call. No bank ever asks you for a code received by text.
- Report it. Forward the SMS to 33700 (a free service run by the operators and AF2M), file a report on cybermalveillance.gouv.fr and, if you've lost money, make a police complaint. The full process is described in our guide the 72 hours after a booby-trapped text.
- Change the passwords of the retailer account concerned if you entered them on the fake page, starting with any password you also use elsewhere. A password manager, or failing that a password notebook kept out of sight, saves you from reusing the same credentials across ten sites.
How can you cut down the number of delivery texts in future?
By acting on all three sources: the retailer, the carrier and your phone.
With the retailer. Untick the SMS marketing box when you place your order — that's what feeds the promotional messages in the weeks that follow, not the logistics tracking. The applicable rules are those of the French Post and Electronic Communications Code and the GDPR, as set out by the CNIL on commercial prospecting. For the purely advertising side, the STOP keyword works: see our article on how effective replying STOP really is.
With the carrier. Most offer to switch notifications from SMS to email or the app from your account area. That's the best trade-off: a single, authenticated channel, where a fake message is much harder to slip in.
On your phone. Turn on unknown sender filtering (iOS: Settings → Apps → Messages → Filter Unknown Senders; Android/Google Messages: Settings → Spam protection). These filters don't delete fake texts but isolate them in a separate tab, which breaks the element of surprise. Our detailed settings are collected in the guide to securing iOS and Android settings.
And for one-off purchases. Using a secondary number for online orders compartmentalises the noise: retailer texts on one side, friends and family on the other. The method is detailed in our article on a second number dedicated to services. A prepaid SIM card in France is enough for this purpose, in a secondary phone or a dual-SIM slot.
Summary table: genuine tracking SMS or fake?
| Clue | Genuine tracking SMS | Fake delivery SMS |
|---|---|---|
| Sender | 3xxxx/2xxxx short code or the carrier's name | Unknown 06/07, foreign number, approximate name |
| Tracking number | Complete, verifiable on the official site | Missing, truncated or made up |
| Link | Carrier's official domain | Unknown domain, shortener, keyword in a subdomain |
| Request | Time slot, collection code, pickup point | Payment of "fees", address confirmation, bank card |
| Urgency | Neutral information, genuine collection deadline | "Within 24 hrs", "final notice", "return to sender" |
| What follows | Nothing | A call from an "adviser" within the hour |
One habit is worth all the checklists: keeping online purchases grouped on a single retailer account, and noting expected deliveries in a purchase tracking notebook rather than relying on memory. When you know you're not expecting anything, the text falls flat.
Frequently asked questions
Can a short code send a fake parcel text?
It's rare but possible, either by spoofing the displayed name or through a hijacked professional channel. A French short code remains a favourable sign, not a guarantee: the payment request and the link's domain are still the decisive criteria.
Why am I getting parcel texts when I haven't ordered anything?
Because these campaigns are sent in bulk, with no targeting. Your number is on a list, that's all. Don't reply, don't click, forward to 33700 and delete.
Should you reply STOP to a fake delivery SMS?
No. Replying confirms that your number is active and read. STOP only makes sense when facing an identifiable advertiser using a registered short code.
Do customs charges by SMS really exist?
Not in this format. Duties and taxes genuinely owed are notified by the carrier through an official procedure, viewable from your tracking area — never via a payment link sent in an unsolicited text.
My parcel is stuck and I haven't had any text: what should I do?
First check that your SMS notifications aren't being filtered or delayed, then check the tracking on the carrier's website using the number shown in your order. The reasons a text fails to arrive are detailed in our article on undelivered texts and message delivery delays.
Key takeaway: the flow of texts around a parcel is noisy by design, and scammers live off that noise. A single reflex neutralises it — open the tracking from your order, never from the message. To report, the unwanted SMS and 33700 page summarises the procedure.
