"Your parcel could not be delivered on 26/09 as you were out. Redelivery possible within 48h: rescheduling fee EUR 1.95. https://suivi-repriselivraison.com"
The message lands on a Friday evening. You're 250 miles from home, the car is parked outside a holiday rental, and you know perfectly well that you are waiting for something. You're away — that much is factually true. A courier could have come by. And at that precise moment, you have no easy way of checking what's in your letterbox.
That's the whole principle of seasonal smishing: don't invent a situation, slip into a real one. The scammer isn't asking you to believe an improbable story, they're asking you to confirm something you already think is true.
Why your absence is worth gold to a scammer
A fake delivery text sent at random converts very poorly. The same message sent to someone who genuinely is away from home converts far better, for three reasons.
Verification is impossible. At home, the natural reflex is to go and look in the letterbox: no paper delivery card, no story. While travelling, that physical check disappears. All that's left is the text and its promise.
The urgency is real. A parcel going back to the depot, perishable goods, a registered letter with a limited holding period: someone who is away knows they are up against a deadline they don't control.
Mental load is at its peak. On holiday, as on a business trip, you deal with notifications on the move, on a patchy network, often on a low battery. And Cybermalveillance.gouv.fr repeats it in every one of its phishing factsheets: haste is the number one reason a scam succeeds. It isn't the victim's intelligence that's at fault, it's their context.
The trouble is that this context is no longer a secret.
How scammers know (or guess) that you've gone away
There's no register of holidaymakers. But there is an accumulation of signals that makes the information guessable on a large scale.
Real-time posting
The beach photo shared as a story, the airport check-in, the "finally on holiday" caption: these are public or semi-public to hundreds of accounts, some of which have no reason to be well-meaning. Police forces repeat the same advice every summer, as part of France's Opération Tranquillité Vacances holiday-watch scheme: post your photos when you get back, never while you're away.
The calendar, quite simply
They don't need to know you. Waves of fake delivery texts peak at times when the whole country is statistically on the move: school holidays, the May bank-holiday weekends, the week between Christmas and New Year, the back-to-school period. Sending an "attempted delivery while you were out" notice on 15 August means playing the odds on a very high national absence rate.
Commercial data leaks
The most polished campaigns combine the calendar with stolen databases containing names, postal addresses and mobile numbers — often from data breaches at carriers, online retailers or booking platforms. The message no longer says "your parcel" but "your parcel for 12 Rue des Lilas". The CNIL regularly publishes formal notices and penalties following such leaks: every incident feeds the targeted-SMS market for years to come.
The digital neighbourhood
Some scammers operate from the street. An overflowing letterbox, shutters closed for a whole week, lights permanently off: physical reconnaissance still exists, and it now combines with the SMS channel to build a credible scenario.
The four scenarios of the season
1. The fake delivery notice with a rescheduling fee
The great classic, but sharpened. The amount requested is trivial — €1.95, €2.40, €0.99 — which disarms suspicion. The goal is never that micro-payment: it's getting your full card details entered on a cloned payment page, then reused for far heavier charges, or to enrol your card in a mobile wallet.
No French carrier charges a "delivery rescheduling" fee by text message. La Poste states explicitly that it never asks for fees to be paid via a link sent by SMS in order to deliver a parcel or a letter.
2. The fake alarm or camera alert
"Motion detected at your home, 03:14. View the footage: …" The message plays on a holidaymaker's sharpest fear. The link leads to a fake login page for a video-surveillance service, designed to capture usernames and passwords — sometimes those of an account you actually use, if the scammer has guessed the brand from a data leak or simply from a photo of your front wall.
If you really do use a surveillance system, an indoor connected security camera should only ever be checked from its official app, never from a link received in a message. And make sure two-factor authentication is enabled on the associated account before you leave.
3. The fake neighbour, fake caretaker, fake building manager
More low-tech, more dangerous. "Hello, I'm the new caretaker, a water leak has been reported in your flat, could you confirm the entry code / tell me who has your keys?" Here there's no booby-trapped link: the goal is physical information. This kind of message sometimes comes just before a burglary.
4. The fake pet- or plant-sitting service
Niche, but growing. Peer-to-peer platforms (pet sitting, home exchange, holiday lets) generate off-platform conversations where impersonation is trivial. A "I'll pick up the cat tomorrow, confirm the exact address and the code" is an excellent pretext for obtaining access.
The tell-tale signs of a fake text
No single signal is enough on its own, but together they speak volumes.
| Element | Legitimate message | Fraudulent message |
|---|---|---|
| Sender | Short company name or identifiable short code | 06/07 mobile number, foreign number, or spoofed name |
| Link | The brand's official domain | Cobbled-together domain: suivi-colis-repriselivraison.com, .top, .icu, .shop extensions |
| Request | Tracking, information, time slot | Payment, credentials, a code received by SMS, a physical entry code |
| Deadline | Indicative | A 24- or 48-hour countdown |
| Spelling | Accents present | Missing accents ("absence", "etre"), erratic capitalisation |
Beware of a modern trap: missing accents are no longer a given. Today's text generators produce correct French. Conversely, some legitimate texts don't use accents for encoding reasons. Spelling is therefore no more than a secondary clue — the domain name remains the ultimate arbiter.
And above all: a fraudulent text can perfectly well appear in the same conversation thread as a genuine message from the company. The SMS network does not verify the identity of the displayed sender; spoofing the name ("Colissimo", "Chronopost", "Banque") visually groups the fake in with the real ones. An older, authentic message just above guarantees nothing about the next one.
Getting ready to be away: the pre-departure checklist
At home
- Report your absence to the gendarmerie or your local police station through Opération Tranquillité Vacances, a free service, with a form available on service-public.fr.
- Have someone you trust collect your post, or set up mail forwarding or a mail-holding service with La Poste. A full letterbox is a public announcement.
- Simulate presence without overdoing it: a programmable smart plug connected to a living-room lamp remains the simplest and cheapest option.
- Avoid overly chatty out-of-office messages on voicemail and social media.
On your phone
- Update the operating system before you leave: a good share of exploits target versions that haven't been updated.
- Check that your operator's anti-spam protection is switched on. All four French operators offer filtering, and 33700 remains the national reporting service for unwanted texts: forward the message, then the sender's number when the service asks for it.
- Back up your phone. If the device is lost or stolen while you're away, a backup changes everything.
- Take something to avoid running flat: a high-capacity power bank prevents situations where you deal with messages in a rush, screen at 3%, with no way to check anything.
On the money side
- Temporarily lower your card limits from your banking app — most let you reduce them in two taps and raise them again when you get back.
- Turn on real-time payment notifications: they're the best fraud detector there is.
- Favour contactless mobile payments, which never pass your real card number to the merchant.
What to do once the text has already arrived
- Don't click. Not even "just to see". Some pages collect technical information the moment they open.
- Check through the official channel. Open the carrier's app, or type the site address yourself. A genuine tracking number exists in the carrier's system; a made-up one doesn't.
- Call someone you trust if the message concerns your home. A neighbour going to check the letterbox settles the matter in two minutes.
- Report it. Forward it to 33700 (SMS) or report it at signal-spam.fr. Scams can be reported to the French Interior Ministry's THESEE platform.
- Block the number, then delete the message — after reporting it.
If you clicked and entered your details
- Contact your bank immediately and block your card. The French Monetary and Financial Code (article L133-18) requires unauthorised payment transactions to be refunded, except in cases of gross negligence by the account holder; the Banque de France and the ACPR regularly point out that simply having been manipulated does not automatically amount to gross negligence.
- Change the passwords of the accounts involved, starting with your email, which acts as the recovery key to everything else. A password manager stops you reusing the same magic word everywhere.
- File a complaint, including remotely. Keep screenshots, the sender's number and timestamps.
- Monitor your statements for several months: stolen data is sometimes used weeks later.
The blind spot: SMS is not an identity channel
This is the point everything else follows from. SMS was designed in 1992 as a technical signalling service; it never included any mechanism for authenticating the sender. Displaying "Chronopost" instead of a number is a mundane commercial operation, available to anyone who knows which intermediary to approach — including outside Europe, where controls are looser.
Since 2025, Arcep and the Fédération française des télécoms have rolled out a number-authentication mechanism for voice calls, and sender-name registries are gradually tightening up for text messages. That's a genuine improvement, but it removes neither campaigns sent from ordinary SIM cards nor SMS blasters broadcasting locally without going through the operators' networks.
Hence a rule that never gets old:
A text message can inform you. It should never be the basis on which you decide. Any action involving money, credentials or physical access must be confirmed through a channel you have chosen yourself.
What you can do tonight
Take five minutes before your next trip. Check who, among the people around you, will collect your post. Lower your card limit. Turn on payment notifications. Save 33700 in your contacts so you don't have to look it up on the day. And talk about it with the people around you who receive these messages without always knowing what to make of them — a practical guide to digital scams left on the coffee table often does more for a family's vigilance than a long lecture.
The fake delivery notice scam relies on no technical feat whatsoever. It relies on a calendar, an absence and thirty seconds of inattention. The first two you won't change. The third, you can.
