How fake delivery texts and tracking pages steal card details and one-time codes, why they work so well in Türkiye, and how consumers and brands should respond.
“Your parcel could not be delivered because the address is incomplete. Update it here.” Almost everyone with a mobile phone has received a message like this. Parcel-delivery smishing (SMS phishing) is one of the most persistent scams in Türkiye, where it is widely known as the fake “kargo” message, and it targets delivery companies, online retailers and banks alike. Here is how it works and what both consumers and brands can do about it.
Anatomy of a fake delivery message
The scam usually follows a predictable script:
- The SMS. A short message claims a parcel is held at a depot, needs an address update or owes a small customs or redelivery fee. It includes a link, often shortened or on a domain that combines a courier-style word with “takip” (tracking) or “teslimat” (delivery).
- The tracking page. The link opens a convincing copy of a courier’s or retailer’s tracking page, sometimes with a realistic tracking number and a “parcel status” bar.
- The data capture. The victim is asked to confirm name, address and phone number, then to pay a small amount by card.
- The one-time code. A fake 3D Secure screen asks for the SMS code sent by the bank. With that code, the criminals can approve a much larger transaction or add the card to a digital wallet.
Some variants instead ask the victim to install an “app” to schedule delivery. On Android, such apps installed from outside the official store can read incoming SMS messages, including banking codes.
Why it works so well
Online shopping is part of daily life, so many people are expecting a parcel at any given moment. The amounts requested are small enough to seem harmless, and the message arrives on the same channel that genuine couriers use. Phishing kits also hide from investigators: many tracking pages only open on mobile devices or for visitors with Turkish IP addresses, and show a blank page to everyone else.
For consumers: what to do
- Never use the link in the SMS. Check the parcel status in the official app or by typing the courier’s or store’s address yourself, using the tracking number from your order confirmation.
- Be wary of fees. If you are genuinely expecting an international parcel that may owe duties, verify the charge through the official site you open yourself, never through a link in a message.
- Never share a bank SMS code on a page you reached from a message. Read the bank SMS carefully: it often states the real amount and merchant.
- If you entered card details, call your bank immediately using the number on your card, have the card blocked and dispute any transactions.
- Report it. Report the link to USOM, forward the SMS to your mobile operator’s spam channel if one is offered, and file a complaint with the police or public prosecutor if you lost money.
For brands: delivery companies, retailers and banks
Brands cannot stop criminals from sending SMS, but they can make the scam harder to run and shorter-lived.
Make the genuine experience easy to recognize
Publish the official sender names and domains you use for delivery notifications, keep all tracking on a single, consistent domain, and say clearly that you will never ask for card details or bank codes via an SMS link. Consistency is a security feature: the more predictable your real messages are, the more the fakes stand out.
Monitor and act quickly
Watch for newly registered domains that combine your brand with words such as “kargo”, “takip”, “teslimat” or “gumruk”, and for cloned versions of your tracking page. Our guide to typosquatting and homoglyph domains explains the patterns. When a page goes live, report it in parallel to browser blocklists, USOM, the hosting provider, the registrar and, where a link shortener is used, the shortener’s abuse team.
Close the loop with fraud teams
Share confirmed phishing domains with your fraud, call center and social media teams so they can warn affected customers quickly and recognize related complaints.
The legal backdrop in Türkiye
Alongside technical takedowns, Türkiye has legal mechanisms for restricting access to content, including access-blocking decisions under Law No. 5651. These routes involve formal procedures and are best pursued with legal counsel. For day-to-day campaigns, fast reporting to USOM, blocklists and providers usually remains the most practical first response.
Shrink the window
Every hour a fake tracking page stays online means more card numbers and codes lost. Phishvoid monitors for delivery-themed lookalikes of your brand and handles takedowns end to end, with unlimited takedowns in one subscription. Book a free exposure scan, or report a phishing site right now.
Is someone impersonating your brand?
We find lookalike domains and cloned pages and take them down. Start with a free exposure scan.