Why Delivery Scams Are So Widespread
As online shopping has become routine, parcel delivery volumes in Japan run to roughly 5 billion packages a year. Fraudsters exploit the fact that many people are waiting for a package at any given time, and scam calls and SMS messages impersonating delivery companies are reported again and again. Many people have likely received an SMS reading "We attempted delivery but you were not home."
What makes this tactic so effective is that many people are actually expecting packages, so they click links or call back without suspicion. The source numbers often include 080 and 090 mobile numbers, 050 IP phone numbers, and spoofed numbers made to look like legitimate delivery companies. This type of fraud tends to spike during year-end holidays and sale periods when online shopping increases.
SMS-Based Scam Tactics
Redirecting to Phishing Sites
A representative tactic is directing victims from a fake missed-delivery SMS to a phishing site. The SMS reads something like "We attempted delivery but you were not home. To reschedule, click here" with a URL. The linked site closely mimics a major delivery company's official website and requests personal information and credit card details under the guise of rescheduling.
The fake site URLs differ subtly from the real ones: a letter "o" swapped for the digit "0", an extra hyphen or word bolted onto a legitimate domain name, or a different top-level domain at the end. Shortened URLs are also used to hide the real destination. The surest check is to compare the domain in your address bar, character by character, against the official app or a bookmark you saved yourself. For more identification tips, see How to Spot SMS Scam Messages.
Malicious App Installation
On Android smartphones, victims may be prompted to install a "delivery tracking app" from the fake site. Installing this app not only steals personal data including contacts, SMS messages, and photos, but also causes the victim's phone to send scam SMS messages automatically, creating secondary damage. Large volumes of messages can go out without the owner noticing, running up a steep phone bill.
iPhones restrict app installation from outside the App Store, so malicious app damage is less common. Instead, iPhone users are redirected to phishing pages requesting Apple ID and password entry. If an Apple ID is stolen, the attacker gains access to photos and contacts stored in iCloud, and can even misuse credit cards registered with Apple Pay.
Phone-Based Delivery Scam Tactics
Calls Impersonating Delivery Drivers
In this tactic, someone calls claiming to be a delivery driver: "We have a package for you, but the delivery address is unclear. Could you confirm your name and address?" When asked about the sender or contents, they give vague answers and persistently request only personal information. A legitimate driver can identify the delivery address from the shipping label and would not need to confirm it by phone.
Cash-on-Delivery Fraud
This involves sending unordered items via cash-on-delivery (COD) and collecting payment upon receipt. A prior phone call states "You have a delivery. It is COD for 3,980 yen," making it seem like a legitimate order. In households with multiple members, someone may assume another family member placed the order and pay. What arrives is typically a trinket worth a fraction of the amount collected, or an empty box.
Customs and Fee Scams
In this tactic, the caller claims "Your international package has customs duties. We cannot deliver unless you pay." They then request payment via convenience store electronic money or bank transfer. Actual customs duties are paid to the delivery driver upon receipt or billed formally by a customs broker - never requested by phone via electronic money. This tactic trades on how ordinary international online shopping has become.
Representative Cases
Case 1: Personal Information Stolen via SMS
Ms. H, a woman in her 30s, received an SMS saying "Your package was undeliverable" the day after ordering something online. Since she was expecting a delivery, she accessed the URL without suspicion and entered her credit card information on a "rescheduling form." The following month, approximately 150,000 yen in unauthorized charges appeared on her card statement. "The timing was perfect, so I never doubted it was real," she reflected.
Case 2: Secondary Damage from a Malicious App
Mr. I, a man in his 50s, installed a "delivery tracking app" from a link in a fake delivery SMS. His smartphone then automatically sent approximately 5,000 scam SMS messages per day, running up communication charges of about 300,000 yen. His contact information was also leaked, causing similar scam messages to be sent to his acquaintances. He explained the situation to his carrier and asked how the charges would be handled, but the leaked personal data could not be recovered.
Case 3: Cash-on-Delivery Fraud
Mr. J, a man in his 40s, received a phone call about a delivery and accepted a COD package, paying 5,000 yen. Inside was a cheap trinket worth about 100 yen. No one in his family had placed the order. "The delivery driver was wearing a legitimate uniform, so I did not suspect anything," he said. In fact, the fraud group had used a legitimate delivery service to send the package, so the driver was indeed real.
How to Spot Delivery Scams
- Do not casually click URLs in SMS messages - You cannot tell a genuine notice from its wording or sender number. Rather than following the link, open the delivery company official website or app yourself and reschedule there
- Check the tracking number - Genuine notices, whether a paper slip or an official app alert, show a tracking number. Treat a notice with no number, or one that does not match your order history, as a scam
- Be wary of phone requests for personal information - Legitimate delivery drivers do not normally call to confirm your address or name
- Refuse unrecognized COD packages - Verify the sender and contents before accepting. If suspicious, refuse delivery
- Use official apps - Install the official apps from Yamato Transport, Sagawa Express, and Japan Post, and always check delivery status through them
- Do not install suspicious apps - If a page you reached from an SMS urges you to install an app, treat it as a scam. Always get apps from the official store
From the perspective of phone number privacy protection, careful handling of shipping labels is important. Enabling automatic SMS filtering in your smartphone privacy settings is also an effective countermeasure.
What to Do If You Are a Victim
If You Entered Information on a Phishing Site
- If you entered credit card information, immediately contact your card company to request a freeze and reissue
- If you entered IDs and passwords, promptly change the passwords for those services
- Also change passwords for any other services where you reuse the same credentials
- If unauthorized charges are confirmed, file a chargeback request with your card company
If You Installed a Malicious App
- Switch to airplane mode to cut off communication
- Uninstall the malicious app
- Factory reset your smartphone and restore from a backup made before the app was installed
- Contact your carrier to discuss charges from unauthorized SMS transmissions
- Notify contacts in your address book that they may receive scam SMS messages
In any case, please file a report with the police following the phone scam reporting guide. Reporting to the Anti-Phishing Council also helps prevent similar damage from spreading.
Summary
Delivery impersonation scams exploit the everyday act of receiving packages, meaning anyone can become a victim. By following three principles - never click URLs in SMS messages and use official apps instead, never share personal information over the phone, and refuse packages you did not order - you can prevent damage before it occurs. Make it a habit to always check delivery status through official apps and websites.