SMS PHISHING

Purolator delivery text scam: is that "package held" notice real?

A fake Purolator text about a held package, a missed delivery, or a small redelivery fee is one of the most reported smishing scams in Canada right now. Purolator has confirmed the campaign and filed a report with the Canadian Anti-Fraud Centre.

SB

SafeBrowz Threat Research Security ResearchJune 30, 20268 min read

What the scam looks like

The text arrives looking routine. A short delivery-issue message, a tracking-style reference, and a link. The message claims your package could not be delivered because nobody was available to sign for it, or that it is held pending a small fee, and it pressures you to act before the parcel is "returned to sender." That deadline is the trap. It exists to make you tap before you think.

The link leads to a page styled to look like the real Purolator site. First it asks you to confirm your name and address, which feels harmless and builds trust. Then it asks for a small payment, usually a "redelivery fee" or "customs charge" of a dollar or two, by credit card. The fee is not the point. The card number, expiry, CVV, and billing address you type into that form are the point. Within hours the card is tested with small charges and then used for larger fraud.

Purolator has publicly warned that these texts are not coming from Purolator and has filed a report with the Canadian Anti-Fraud Centre. One newer wrinkle reported in Ontario in 2026: some of these messages arrive as an image (a screenshot of a fake delivery notice) instead of plain text, specifically to slip past filters that scan for suspicious links in the message body.

The Purolator text variants in active rotation

1. Failed delivery, nobody to sign

"Purolator: We attempted delivery but no one was available to sign. Reschedule or your package returns to sender: [link]"

2. Address confirmation

"Purolator: Your parcel is on hold. We could not verify your address. Confirm details to release: [link]"

3. Small redelivery fee

"Purolator: A redelivery fee of $1.95 is required to schedule your second attempt. Pay here: [link]"

4. Customs or duty charge

"Purolator: Your international shipment is held at customs. Pay $2.40 clearance fee to release: [link]"

5. The image-only message

A screenshot of a fake "delivery exception" notice with the link burned into the picture, sent so message filters cannot read the URL as text. You are told to type the address into your browser or tap the embedded image.

How to spot the fake in 10 seconds

• Were you expecting a Purolator delivery? If not, ignore the text. If yes, do not use the link in the text to check on it.
• The sender. Real Purolator delivery notifications come from a registered short code (a five or six digit number). A regular ten digit mobile number, an out-of-country number, or a message sent as an image is a strong scam signal.
• The fee. Purolator does not charge a redelivery fee by text, and it does not collect customs or duty payments through an SMS link. Any "$1.95 to release your package" text is fake. The tiny amount is deliberate, calibrated to feel too small to question.
• The link. The real site is purolator.com. Scam links use lookalikes such as purolator-redelivery[.]xyz, purolator-ca[.]vip, purolator-parcel[.]top, or a shortened URL that hides the real destination. The brand name sitting on a cheap or unusual domain ending is the giveaway.
• It asks for card or login details. A genuine tracking page shows you status. It does not demand your full card number and CVV to "release" a parcel.
• Pressure and a deadline. "Return to sender in 24 hours" exists to rush you. Real carriers hold undelivered parcels for days and tell you exactly where to pick them up.

The right way to verify a Purolator delivery

1. Do not tap the link in the text. Treat the whole message as untrusted until you confirm it independently.
2. Find your real tracking number from the order confirmation email the retailer sent you, not from the text.
3. Type purolator.com into your browser yourself (or open the Purolator app) and paste the tracking number there. Purolator's own guidance is to confirm the address begins with https:// and is followed by purolator.com.
4. If a parcel really is on hold, the real site or app will tell you the depot or the next steps. There is no card-payment "release fee" hidden behind a text link.
5. If you are unsure, call Purolator customer service at 1-888-744-7123 (1-888-SHIP-123) and ask them to check the tracking number directly.

If you already entered your card or details

1. Lock the card now. Most Canadian bank apps have a one-tap freeze. Use it, then call your bank's fraud line.
2. Order a replacement card with a new number. Update legitimate subscriptions when it arrives.
3. Watch for small test charges ($0.99, $1.05, $2.00) over the next 24 hours. Those are the scammer checking the card is live before larger fraud.
4. Dispute any unauthorized charge with your bank under fraud or unauthorized transaction.
5. Report it to the Canadian Anti-Fraud Centre online at antifraudcentre-centreantifraude.ca or by phone at 1-888-495-8501, and to your local police. Purolator also asks that you report fraudulent messages to your local police agency or the Canadian Anti-Fraud Centre.
6. If you entered an account password that you reuse elsewhere, change it everywhere and turn on two-factor authentication.

Why Purolator is the target in Canada

Purolator is one of Canada's largest courier companies, so on any given day a large share of Canadians genuinely have a Purolator delivery in motion. Scammers do not need to know that. They blast millions of texts to numbers pulled from breach lists and wait for the small percentage who happen to be expecting a parcel right now. To that person, a "we missed you" message feels real, and the urgency does the rest.

The exact same template runs against Canada Post, FedEx, UPS, DHL, and Amazon deliveries. Only the logo and the domain change. The mechanic, a tiny fake fee in front of a card-capture form, is interchangeable. It shares its DNA with the 407 ETR toll text scam and other small-fake-fee texts hitting Ontario phones.

How browser-layer defense catches this earlier

Mobile carriers block some smishing URLs at the message level, but the catch rate is low because the domains rotate constantly and image-based texts hide the link entirely. The reliable defense is at the click destination. When you tap the link and a fake Purolator page tries to load, a browser-layer scanner can recognize that the page is impersonating Purolator and block it before you ever type your card number.

SafeBrowz is a free Chrome, Firefox, and Edge extension, plus a live Android app, that scans every URL before the page renders. Install SafeBrowz free on the device you receive delivery texts on.

Frequently asked questions

Does Purolator ever charge a redelivery fee by text?

No. Purolator does not charge redelivery fees, customs fees, or any other payment through an SMS link. Any text asking you to pay a small fee to "release" or "reschedule" a package is a scam. If a parcel genuinely needs a second attempt, you arrange that for free through purolator.com or the Purolator app.

How do I know if a Purolator text is real?

Real Purolator delivery notifications come from a registered short code, not a regular mobile number, and they never ask for a fee or your card details. The safest check is to ignore the text entirely, type purolator.com into your browser yourself, and search your tracking number there. Purolator's own advice is to confirm the address begins with https:// followed by purolator.com.

The link looks almost exactly like purolator.com. Is it safe?

Look at the part right before the first single slash. The real site ends in purolator.com. Scam links add words or use a different ending, like purolator-redelivery on a .xyz or .vip domain, or hide everything behind a link shortener. The brand name appearing on an unusual domain ending is the tell. When in doubt, do not tap it, and paste it into the checker on this page first.

I got the Purolator text as a picture, not as a normal message. Why?

Some 2026 campaigns reported in Ontario send the fake notice as an image so that filters which scan message text for bad links cannot read the URL. You are told to type the address into your browser or tap the picture. Treat an image-based delivery notice with a web address in it as a strong scam signal and verify only at purolator.com.

I paid the small fee with my card. What now?

The few dollars is not the real loss. The scammer now has your card details and will try larger fraud. Lock the card through your bank app's freeze feature right away, call your bank's fraud line, order a replacement card, and watch for tiny test charges over the next day. Dispute any unauthorized charge and report it to the Canadian Anti-Fraud Centre.

Where do I report a fake Purolator text in Canada?

Report it to the Canadian Anti-Fraud Centre at antifraudcentre-centreantifraude.ca or 1-888-495-8501, and to your local police. You can also delete the message and block the sender. Purolator asks customers to report fraudulent emails and texts to their local police agency or the Canadian Anti-Fraud Centre.

Related reading

• DHL package tracking text scam - the same playbook on a global carrier
• 407 ETR toll text scam (Ontario) - sister small-fake-fee text scam
• Temu order and reward text scam - the shopping-delivery bait variant
• Text message scams: the complete 2026 guide
• How to tell if a website is a scam

Bottom line: The Purolator text scam is the Canadian cousin of the DHL and Canada Post delivery scams. Same trick, different logo. Purolator does send delivery updates, but it never charges a fee by text. Never tap the link. Verify by going to purolator.com or the app yourself, and put SafeBrowz on your browser so the fake redelivery page never loads in the first place.

How SafeBrowz blocks this threat

SafeBrowz runs a 3-layer detection architecture: Local + APIs + AI.

• Layer 1 - Local detection: 60+ URL patterns plus 550+ brand-specific signatures run inside the extension before the page renders. When "Purolator" appears on a domain that is not Purolator's own, the lookalike-domain check flags it. A page on purolator-redelivery[.]xyz carrying the Purolator name is exactly the brand-on-non-official-domain signal this layer is built to catch, instantly, without any per-user browsing data.
• Layer 2 - API checks: cross-references Google Safe Browsing, PhishTank, URLhaus, and known-bad domain feeds, plus a list of cheap and abused TLDs that delivery-scam pages favour.
• Layer 3 - AI content analysis (Premium): through our proxy, the page text is read for impersonation and credential-harvest patterns, so a brand-new lookalike with a domain nobody has reported yet still gets caught.

Honest scope: SafeBrowz flags the fake page before you type anything into it. It cannot undo a card number you already submitted, which is why the recovery steps above still matter.

Detection signatures come from threat-intelligence research and our internal brand database, not from user browsing data. SafeBrowz does not store per-user browsing history.

Install SafeBrowz free

Add the browser extension, or the SafeBrowz Android app, that runs every check in this article automatically, on every page, before it renders. Free forever.

Add to Chrome Add to Firefox Add to Edge Get on Android