The Canada Post Text Scam: A Growing Threat to Canadians
The Canada Post text scam has emerged as one of the most successful phishing campaigns targeting Canadian consumers. Millions of Canadians receive fake SMS messages claiming to be from Canada Post, the country's national postal service, notifying them that a package delivery has failed or is being held and requires immediate action. These messages contain links to fake Canada Post websites where victims unknowingly enter personal information, payment details, or account credentials, leading to identity theft, financial fraud, and account takeovers. The scam works because Canadians trust Canada Post, regularly expect delivery notifications, and are primed to click when told their package is at risk.
Unlike email phishing, text message phishing (smishing) is harder for most people to scrutinize on a small phone screen, making the scam particularly effective. The psychological leverage is simple and powerful: you're expecting a package, you receive a notification from what appears to be Canada Post, and you're afraid your delivery will be lost, returned, or require payment. The scammer exploits this urgency to trick you into clicking a malicious link before you can think critically about whether the message is real.
How the Canada Post Text Scam Works
The Canada Post scam follows a simple but highly effective script. First, the scammer sends you a text message that appears to come from Canada Post (typically using a spoofed short code or sender ID that mimics "Canada Post" or "CP"). The message states that your package delivery has failed, is on hold, requires payment, or needs you to reschedule. The message includes a link disguised as a tracking URL. When you click the link (often frantically, because you're worried about your package), you're taken to a fake website that looks nearly identical to the real Canada Post tracking page. The fake site prompts you to enter information: your name, address, phone number, and crucially, your credit card number or banking information to "pay the delivery fee" or "reactivate your package." Once you enter this information, the scammers have everything they need to steal your identity, drain your bank account, or make fraudulent charges on your credit card.
The scam is so effective because it requires minimal effort from the scammer and can be sent to millions of people at once. Some recipients won't have recently ordered anything and will ignore the message. But a significant percentage of recipients will be expecting a package, and many of those will panic and click the link before questioning its authenticity. The scammers only need a small percentage success rate to harvest thousands of payment cards and personal information records, which they then sell or use for fraud.
Typical Message Templates and Variations
Canada Post text scams use several message templates, all designed to create urgency and encourage clicking:
"Delivery Failed" - "Canada Post: Your package delivery failed. Click here to reschedule: [link]" or "We were unable to deliver your package. Please confirm your address: [link]."
"Payment Required" - "Canada Post: A delivery fee of $5 is required. Pay now: [link]" or "Your package is being held due to unpaid customs fees. Pay here: [link]."
"Holds or Restrictions" - "Canada Post: Your package has been held. Verify your information to release: [link]" or "Customs hold placed on your package. Update details here: [link]."
"Address Confirmation" - "Canada Post: We need to confirm your address. Click here to verify: [link]" or "Package cannot be delivered. Confirm your location: [link]."
"Redelivery Scheduling" - "Canada Post: Schedule your package redelivery here: [link]" or "Your package couldn't be delivered. Arrange redelivery: [link]."
All of these messages are designed to feel urgent and official. They use the Canada Post branding and terminology that Canadians recognize, which helps them bypass critical scrutiny. The links often use URLs that closely resemble real Canada Post domains or subdomains, making them look legitimate at first glance.
Why Canada Post Is Targeted
Canada Post represents an ideal phishing target for several reasons. First, Canada Post is universally recognized and trusted across Canada. Nearly every Canadian has received packages and knows Canada Post as the legitimate delivery service. Second, delivery notifications are expected and normal. Canadians regularly receive tracking updates and are accustomed to clicking links from Canada Post. Third, the volume of e-commerce has increased dramatically, making the scam more likely to hit people who are actively expecting packages. Fourth, international e-commerce (packages from the US, overseas suppliers, etc.) often goes through Canada Post, and customs notifications are common enough that scammers can leverage those without seeming obviously fake. Fifth, Canada Post is a government entity, which adds credibility and makes people less likely to question the legitimacy of communications claiming to come from them.
What Information Scammers Are Harvesting
When you land on a fake Canada Post website and enter information, scammers are collecting several categories of sensitive data. Personal identifying information such as full name, address, phone number, and email address enables identity theft. These details can be used to open accounts in your name, apply for credit, or pass identity verification processes for financial fraud. Social Insurance Numbers (SIN) are particularly valuable. Some fake Canada Post sites request SIN as verification, and this single piece of information combined with name and address makes someone fully vulnerable to major identity theft. Credit card numbers and payment card information are the most immediately profitable for scammers. They can make fraudulent purchases, sell the card details on underground markets, or test the card with small transactions before attempting larger ones. Banking information including online banking credentials, debit card numbers, and account access details provide direct access to bank accounts and allow wire transfers or fraudulent withdrawals. Security questions and answers like mother's maiden name, first pet, or school attended can be used to reset passwords and take over other accounts.
Lookalike Domains and Sophisticated Phishing
The most convincing Canada Post scams use lookalike domains that appear nearly identical to the real Canada Post website at first glance. Common examples include "track-post.ca," "canadapost-tracking.com," "cp-tracking.org," or "canada-post-delivery.ca." Some use subdomains of legitimate but unrelated sites to appear more official. Others use international domain extensions (.net, .info, .online) instead of the official .ca. When you're on your phone viewing a small screen and in a hurry, these slight variations are easy to miss. The scammers invest in valid SSL certificates for these domains, so the fake sites display a padlock icon and HTTPS, making them appear secure. The website itself may be a pixel-perfect clone of the real Canada Post tracking page, with the same layout, colors, and design. All of these factors combine to create a convincing illusion of legitimacy that deceives many Canadians.
Red Flags and Warning Signs
- 1)Unsolicited text about packages you don't remember ordering: If you receive a text about a package you don't recall ordering, the message is likely a phishing attempt. Real Canada Post notifications are sent about packages you actually have in transit. If you're unsure, contact Canada Post directly or check your email for an order confirmation—don't click the link in the text.
- 2)Requests for payment via text: Canada Post does not send links via text asking you to pay delivery fees. If a delivery fee is owed, Canada Post will inform you during an attempted delivery and allow you to pay in person or through their website after you've logged in yourself. Never click a payment link from an unsolicited text.
- 3)Misspelled or unofficial domain in the link: Hover over or long-press the link to see the actual URL. Does it actually go to canadapost.ca? If the URL contains variations like "canadapost-tracking," "canada-post-delivery," or any non-.ca extension, it's a phishing site. Real Canada Post links use the official canadapost.ca domain.
- 4)Grammar and formatting issues: Many phishing texts contain poor grammar, awkward phrasing, or formatting errors. Real Canada Post messages are professionally written and proofread. Scammer messages sometimes use ALL CAPS, random capitalization, or unclear wording.
- 5)Urgent language and threats: Phishing messages use language designed to trigger panic: "ACT NOW," "URGENT," "Your package will be returned," "You must respond immediately." Real Canada Post communications are professional and don't create artificial urgency.
- 6)Requests for sensitive information: Canada Post will never ask for credit card numbers, banking information, or SIN via text. If a message claiming to be from Canada Post asks for any of this information, it is a scam. Period.
- 7)Unusual sender ID: Real Canada Post notifications typically come from short codes or recognizable numbers. If the sender ID looks random or unusual, it's likely a spoofed number.
How to Verify Real Canada Post Notifications
If you receive a text claiming to be from Canada Post and you're unsure of its authenticity, never click the link in the message. Instead, verify independently. First, go directly to canadapost.ca in your browser by typing the address yourself. Do not use a link from the text message. Once you're on the official site, use their package tracking feature by entering a tracking number you may have received via email when you ordered the package. This will show you the actual status of your delivery. Second, check your email for order confirmation and shipping notifications. Legitimate Canada Post notifications are typically sent via email first, with a tracking number. If you don't have an email with a tracking number, you can search for the tracking number (if you remember it) on the official Canada Post website. Third, call Canada Post directly at 1-800-267-1177 to verify if there are any issues with a package delivery. Real customer service representatives can look up your package and confirm any holds, fees, or delivery issues. Fourth, if you believe you received a phishing text, do not respond or click the link. Instead, forward the message to the Canadian Anti-Fraud Centre (CAFC) by texting it to their fraud reporting number or reporting it through their website at antifraudcentre-centreantifraude.ca.
Links to Similar Scams
The Canada Post text scam is part of a larger ecosystem of delivery service phishing. Similar scams target users of other major carriers and retailers. In the United States, USPS text scams follow nearly identical mechanics, with scammers posing as the US Postal Service to harvest information from Americans. FedEx and UPS users are similarly targeted with phishing messages claiming package delivery issues. Amazon customers receive fake delivery notifications prompting them to confirm account information. Best Buy, Apple, and other major retailers send phishing notifications to customers claiming suspicious orders or account issues. The common thread is that scammers impersonate trusted delivery and retail brands that people expect to hear from regularly. Being able to identify and avoid phishing attacks from one of these organizations helps you protect yourself from all of them.
What to Do If You Already Clicked the Link
If you clicked a link from a suspicious Canada Post text message, the damage depends on what information you entered on the subsequent website. If you simply clicked the link but didn't enter any information before realizing it was a scam, you're likely safe—just delete the text and move on. However, if you entered personal information or payment details on the fake website, you need to take immediate action. First, do not enter any additional information. Close the browser or app. Second, contact your credit card company or bank immediately using the phone number on the back of your card. Do not use any phone number provided on the phishing website. Tell them you may have entered your card details on a fraudulent website. Ask them to monitor your account for unauthorized transactions and to consider issuing you a new card. Third, change your passwords for any accounts that use similar login credentials, particularly your email account. If the scammers have your email, they can use it to reset passwords on other accounts. Use a secure password manager to create new, unique passwords. Fourth, check your credit report for any fraudulent accounts or inquiries. You can access your credit report for free once per year from Equifax Canada or TransUnion Canada. Place a fraud alert if necessary. Fifth, report the phishing text to the Canadian Anti-Fraud Centre at antifraudcentre-centreantifraude.ca or by calling 1-888-495-8501. Provide the phone number the text came from, the message content, and any information about what you entered on the fake website. Sixth, file a report with the CRTC (Canadian Radio-television and Telecommunications Commission) if you wish to formally report the smishing attack. Forward the phishing text to your mobile carrier's spam reporting service as well.
Reporting Canada Post Phishing and Scams
Reporting phishing attacks helps authorities track scammers and warn other Canadians. Forward suspicious texts to the Canadian Anti-Fraud Centre by texting them to 27972 or reporting online at antifraudcentre-centreantifraude.ca. Report the scam to the CRTC at ic3.gc.ca or through their phishing complaint process. Forward the message to your mobile carrier's spam and phishing reporting system (most carriers accept forwarded texts to specific numbers). If you provided payment information, file a report with the Royal Canadian Mounted Police (RCMP) at their cybercrime reporting portal. Report any unauthorized charges to your credit card company and your bank. Canada Post itself should be informed of the scam—you can contact them through their website to report phishing attempts using their branding. The more reports authorities receive, the better they can respond to and mitigate these campaigns.
Long-Term Protection Strategies
- Never click delivery links from unsolicited texts. If you're expecting a package, go directly to the carrier's website by typing the address yourself or use your email confirmation to find a tracking link. Don't click links from text messages.
- Trust your intuition about legitimacy. If something feels off about a message—the grammar, the urgency, the request—it probably is off. Real companies use professional communication. Scammers often have tells if you look for them.
- Verify independently before entering information. Before entering any personal or payment information on a website, verify that you're on the real company's site by going there directly. Never use links from unsolicited messages.
- Enable text message filtering on your phone. Both iOS and Android phones have built-in spam filtering for texts. Enable these features and mark obvious phishing texts as spam so your phone learns to filter similar messages.
- Use a password manager. Password managers help you create unique, complex passwords for each account and autofill them only on legitimate websites. This prevents you from accidentally entering credentials on phishing sites.
- Monitor your accounts regularly. Check your credit card and bank accounts weekly for unauthorized transactions. Set up alerts on your accounts for purchases above a certain threshold. The faster you catch fraud, the faster you can dispute it.
- Keep your phone's operating system updated. Security updates patch vulnerabilities that malware exploits. Keeping your phone current reduces the risk of malware compromising your device.
The Bottom Line
The Canada Post text scam is designed to exploit your trust in a legitimate organization and your natural concern about package deliveries. Remember: Canada Post will never send a text asking you to click a link to enter payment information or personal details. If you receive such a message, delete it. If you're expecting a package and have questions about its status, go directly to canadapost.ca or call Canada Post at 1-800-267-1177. Never click links in unsolicited text messages claiming to be from any delivery service, bank, or government agency. Your caution is your best defense.
Other Scams to Watch For
People researching this scam also check these related pages.
UPS Scam Checker
Detect fake UPS delivery texts and phishing emails.
Check NowFedEx Scam Checker
Identify fraudulent FedEx delivery notifications and scams.
Check NowDHL Scam Checker
Spot fake DHL delivery alerts and smishing messages.
Check NowPurolator Scam Checker
Check suspicious Purolator delivery messages for fraud.
Check NowUSPS Text Scam
Spot fake USPS delivery text messages and postal scams.
Check NowUPS Text Scam
Recognize fake UPS delivery text messages and smishing.
Check NowFedEx Text Scam
Identify fraudulent FedEx text alerts and delivery scams.
Check NowDHL Text Scam
Detect fake DHL SMS messages and package delivery scams.
Check NowCan I check if a Canada Post text is real by looking at the sender number?
Scammers can spoof sender IDs and phone numbers to make them appear legitimate. A real Canada Post sender ID might look official, but a spoofed number can too. The safest approach is to never trust sender information alone. Instead, verify independently by going directly to canadapost.ca or calling Canada Post at 1-800-267-1177. These methods are always reliable because they're under your control.
What if I provided my credit card number on the fake website?
Contact your credit card company immediately using the number on the back of your card. Tell them you entered your card details on a phishing website. They can cancel your card and issue a new one, and monitor your account for fraudulent charges. Most credit cards have fraud protection, so unauthorized charges should be reversed if you report them quickly. Act fast—the quicker you report, the better the outcome.
Can I get a refund for money I sent to a scammer?
Refunds depend on the payment method and how quickly you report the fraud. If you entered a credit card on a phishing site and the scammer made charges, those charges may be disputable under credit card chargeback rules. If you authorized a bank transfer or wire, reversal is much more difficult because you provided the authorization. Contact your bank and credit card company immediately. File police and fraud centre reports as soon as possible, as these are often required for chargebacks. Recovery is possible but depends on specific circumstances and how quickly you act.
How do I know what the real Canada Post website looks like?
The official Canada Post website is canadapost.ca. The tracking page is located at canadapost.ca/track. Real Canada Post pages use the official .ca domain. The page design is professional and has Canada Post's recognizable logo and branding. When you type canadapost.ca directly into your browser, you'll see the legitimate site. Bookmark this page so you can access it directly in the future without relying on links from emails or texts. This is the safest way to track packages or access Canada Post services.
What if I entered my SIN on the phishing site?
If you provided your Social Insurance Number, name, and address to a phishing site, you're at high risk for identity theft. Contact the RCMP's cybercrime reporting center and file a police report. Place a fraud alert with the credit bureaus (Equifax and TransUnion). Consider purchasing identity theft protection services. Monitor your credit report closely and check for any fraudulent accounts or credit inquiries. Consider a credit freeze to prevent accounts from being opened in your name without your knowledge. The SIN combined with your personal information is the most damaging data a scammer can possess, so swift action is critical.