Lorraine Williamson
A simple text message claiming a delivery problem is catching thousands of people off guard in Spain. Cybersecurity experts warn that a growing wave of fake delivery text scams is designed to steal personal and bank card details in minutes.
The alert comes from Spain’s cybersecurity authorities, who say the timing is no accident. With online shopping at peak levels and parcels arriving daily, fraudsters are exploiting habits many of us barely think twice about.
How the scam works
The message usually looks routine. It claims a courier could not deliver a package because the house number is missing or incomplete. A link is included to “fix” the problem.
Once clicked, the link leads to a convincing fake website. Victims are asked to select a new delivery time and update personal details. Moments later, they are prompted to enter bank card information to pay a small “redelivery fee”.
An error message often appears at the end. By then, the damage is done. The criminals already have the data they wanted.
Why these messages are so effective
Smishing scams work because they tap into urgency and expectation. Many people are waiting for deliveries, especially at this time of year. The messages appear brief, practical and harmless.
Cybersecurity specialists say this type of fraud has increased sharply as criminals shift away from email scams and focus on SMS, which people tend to trust more and open faster.
What to do if you receive one of these texts
If you receive a delivery message you were not expecting, do not click the link. Delete the message and block the sender. If you are unsure whether a parcel is genuine, check directly on the official website of the courier company. Never rely on links sent by text. You can also report the message to Spain’s cybersecurity incident reporting services to help prevent others from being targeted.
If you clicked the link or entered your details
Anyone who has already provided personal or bank information should act immediately. Contact your bank straight away to block cards and monitor suspicious movements. Save screenshots, links, and any messages received as evidence.
It is also recommended to monitor your online presence over the coming months and request the removal of personal data if it appears on suspicious websites. Filing a police report with the collected evidence can help protect you and others.
A wider warning for digital life in Spain
Authorities stress that this campaign is part of a broader rise in everyday digital fraud. Text messages, WhatsApp links, and emails are increasingly used to impersonate trusted companies.
The advice remains consistent: slow down, verify independently, and treat unexpected messages with caution. Convenience is exactly what these scams rely on.