If you live in or visit Japan, you will probably get a text that says a parcel could not be delivered and asks you to confirm your address through a link. Most of these are phishing: the link leads to a fake site designed to steal your login, card number, or to make you install a malicious app. Many arrive in Japanese, but the pattern is the same in English.
The anatomy of a fake delivery text
- You were not expecting a parcel. Scammers send these in bulk to random numbers. Even if you do expect something, treat the text as suspect.
- The link is not an official domain. Real carriers use their own domains:
japanpost.jp,sagawa-exp.co.jp,kuronekoyamato.co.jp. A lookalike with extra words, odd endings, or a shortened link is a red flag. - It pressures you. "Within 24 hours" and "will be returned" push you to act without thinking.
- It asks for something. A login, a card number, a small "redelivery fee", or an app to install. A real carrier does not need your card details by text link.
How to check a real delivery safely
- Open the carrier's official app, or type its official address into the browser yourself.
- Enter your tracking number or the number on the notification slip left in your mailbox.
- If you are unsure, do nothing. A real missed delivery leaves a paper slip with a contact number.
If you already tapped the link
You only opened the page. Close it and do not tap anything else. Delete the message and block the sender. Usually nothing more is needed.
You typed a password or card number. Act quickly:
- Change the password for that account, and any other account where you reused it.
- Call your card issuer, tell them the card number may be exposed, and ask to freeze or replace it.
- Turn on two-step verification wherever it is available.
- Watch your statements for several weeks.
You installed an app or profile. Treat the phone as compromised. Remove the app, switch on airplane mode, change your key passwords from a different device, and consider a factory reset. On Android, do not enable installing apps from unknown sources for a link in a text; legitimate delivery companies do not ask you to install an app this way.
Reduce the risk
- Use the built-in spam filters for unknown senders on your phone.
- Turn on two-step verification for your email and payment accounts.
- Do not store card details in sites you reached through a text link.
- Tell family and friends; these messages rely on people acting quickly.
Where to get help in Japan
You can call the police consultation line #9110 for advice on online scams, and report phishing sites to the Council of Anti-Phishing Japan. Your card company's lost-or-stolen line is the fastest option if a card is exposed.
Quick checklist
- Unexpected delivery text with a link? Do not tap.
- Check deliveries through the carrier's app or by typing its address.
- Typed card details? Call the card issuer now.
- Installed an app? Treat the phone as compromised.