Why this window is crowded
Between 20 November and 5 January a household can have a dozen parcels in motion at once. Gifts are ordered from shops you rarely use, sent to different addresses and handed to carriers you never chose. Most people could not say, on any given morning, which parcels are still on the way.
That gap is what a bad parcel message uses. A text that says a delivery failed, a fee is due or an address needs updating lands at a moment when you probably do have something coming. It does not need to be convincing. It only needs to arrive while you are expecting something, and ask for a small action before you have time to look.
The fix is not a sharper eye for spelling. Messages copied from real ones are well written. The fix is to have your evidence in front of you before the message arrives: a short list of what you ordered, and the address the shop uses in your own order emails.
Start with the orders, not the message
The delivery message checker is built around that list. Before you paste anything, it asks for what you expect: a generic label for the shop, the date you ordered, the carrier as the order email spells it, and the tracking format you remember, such as two letters, nine digits and two letters.
None of it needs to be exact. A label like “garden lamp shop” is enough. What matters is that you wrote it down before reading the message, because a message you read first changes what you remember. A list you wrote first can disagree with it.
If you have made no list, leave it blank. The sheet will say plainly that there were no orders to match, which is a useful thing to hold on to: a delivery message about no order at all. If you do have a list, it downloads as a CSV file that opens in any spreadsheet, so you can add to it through the season and keep one copy for the household.
The domain test, letter by letter
The one thing a message cannot easily fake is who owns the address behind its link. So the second part of the worksheet asks for a domain from your own order email: the part after the @ in the sender, or the address in the footer of an earlier email. The checker pulls every link out of the message and lines each one up against that domain, letter by letter.
Several details matter when you do this by hand. The checker handles each of them:
- Only the last part counts. In shop.example.com the owner is example.com. In shop.example.com.evil.test the owner is evil.test, whatever appears on the left. Putting a familiar name in front of a different domain is one of the oldest tricks, and the sheet names it when it sees it.
- Capital letters change nothing. EXAMPLE.COM and example.com lead to the same place, so the sheet notes capitals without treating them as a difference.
- A link with no http at the front is still a link. Phones make text such as track-parcel.test/9X2k tappable, so the sheet finds those too.
- Letters can be swapped for look-alikes. The pair r and n sit together to look like m. A zero looks like an o, and a one looks like a lowercase L. When two domains differ only in a way like that, the sheet says the difference looks alike at a glance.
- Other alphabets. Some letters from other alphabets are drawn exactly like Latin ones. Addresses that use them are stored in a plain-letter form that starts with xn--, called punycode. The sheet decodes that form and lists the letter and its alphabet.
- More than one link. A message with three links is checked three times, each against the same domain.
The result for each link is a row of boxes: your domain on the top, theirs below, with every difference boxed and bold. It reads at a glance and it prints.
Eight more observations about the message itself
The link is only part of it. The rest of the sheet looks at the wording and the details around the link, and lists each one with the reason it is worth a look:
- A link shortener. A shortened link hides where it leads, so you cannot compare it with anything before you open it.
- Extra hyphens or digits. Look-alike addresses often join extra words to a familiar name with hyphens, or slip in numbers.
- A different ending. The same name can be registered under many endings, and each is a different owner.
- A request to pay a small fee. A small amount feels easy to pay. It is also how card details get collected.
- A deadline under 24 hours. A short clock leaves no time to check your own account first.
- A number rather than a name. A name can be checked against the shop. A bare number can be anyone.
- No order reference. A real notice says which order it is about, in a form you can look up.
- An unexpected carrier. A carrier none of your orders use cannot be writing about those orders.
Notice what the sheet does not do. It does not add these up into a score, and it does not tell you a message is one thing or the other. It shows what matches and what does not, and you take that to your order page. The two cases below show why that is the better design.
Worked example one: the redelivery fee
This case is fictional, and so are the shops, the carriers and every address. The household has two orders on the list: a garden lamp from Lampworks, ordered on 2 November and sent by Northway Parcels with a tracking number that starts NW and has twelve characters; and a blanket from Maple and Rye, ordered on 5 November and sent by Harbor Express. The order email from Lampworks came from lampworks.test, and that is the domain typed into the checker. This message arrives:
Northway Parcels: we could not deliver your parcel today. Pay a £1.45 redelivery fee within 12 hours or it will be returned. https://lampworks-redeliver.test/p/7Fq2
The sheet extracts one link, https://lampworks-redeliver.test/p/7Fq2, and lists twelve observations:
| Check | Result | What it shows |
|---|---|---|
| Domain compared with your order email | Worth a look (Differs) | “-redeliver” is added to lampworks.test. |
| Link shortener | Nothing to flag (Not found) | The link shows its own domain. |
| Extra hyphens or digits | Worth a look (Found) | One hyphen more than in the domain typed. |
| Ending differs from your order email | Nothing to flag (Same ending) | Both end in .test. |
| Known name placed in front of another domain | Nothing to flag (Not found) | Nothing placed in front of another domain. |
| Letters from another alphabet | Nothing to flag (Not found) | Plain Latin letters only. |
| Matches an expected order | Nothing to flag (Matches) | The carrier is on the Lampworks line of the list. |
| Order reference in the message | Worth a look (Not found) | No order number or tracking number. |
| Unexpected carrier | Nothing to flag (On your list) | Northway Parcels is a carrier you listed. |
| Request to pay a small fee | Worth a look (Found) | £1.45 together with “Pay”. |
| Deadline under 24 hours | Worth a look (Found) | “within 12 hours”. |
| A number rather than a name | Worth a look (Number) | A phone number, not a name. |
Six of the twelve are worth a look and six show nothing to flag. Look closely at the six that show nothing, because they are the point of the list. The carrier is on the list, and the link is not shortened, and it ends the same way as the domain from the order email. A message built from real details will pass those lines, which is why a clean line is never a reason to stop checking.
The lines that matter are these. The link is the shop’s name with “-redeliver” added, which makes it a different domain, not a page of the shop’s. There is no order number or tracking number, so nothing here can be looked up. It asks for £1.45, with a clock of 12 hours, from a phone number rather than a name. Together they make one pattern: a look-alike link, a small payment, a short deadline and nothing to look up.
The next steps are the ones the sheet prints every time. Do not tap the link, call the number in the message or reply. Open the Lampworks order from your own saved account and see whether it lists a parcel and a fee. Call the number on the shop’s own site. If the account shows nothing about a failed delivery, write that on the sheet.
Worked example two: one pair of letters
The household list is the same. This time the message looks like the one you hoped to get:
Maple and Rye: your order 48213 has shipped with Harbor Express, tracking HX482139907GB. Follow it here: https://www.rnapleandrye.test/orders/48213
The domain typed from the earlier Maple and Rye email is mapleandrye.test. The sheet extracts https://www.rnapleandrye.test/orders/48213 and returns this:
| Check | Result | What it shows |
|---|---|---|
| Domain compared with your order email | Worth a look (Differs) | “m” in the order email against “rn” in the link; the pair looks alike. |
| Link shortener | Nothing to flag (Not found) | The link shows its own domain. |
| Extra hyphens or digits | Nothing to flag (Not found) | No hyphens or digits in the name. |
| Ending differs from your order email | Nothing to flag (Same ending) | Both end in .test. |
| Known name placed in front of another domain | Nothing to flag (Not found) | Only www sits in front. |
| Letters from another alphabet | Nothing to flag (Not found) | Plain Latin letters only. |
| Matches an expected order | Nothing to flag (Matches) | Shop label, carrier and tracking format all appear. |
| Order reference in the message | Nothing to flag (Found) | HX482139907GB fits the format listed. |
| Unexpected carrier | Nothing to flag (On your list) | Harbor Express is a carrier you listed. |
| Request to pay a small fee | Nothing to flag (Not found) | No amount or fee wording. |
| Deadline under 24 hours | Nothing to flag (Not found) | No deadline. |
| A number rather than a name | Nothing to flag (Name) | Shown as a name. |
One item to look at, eleven with nothing to flag. Everything that usually looks wrong is missing. There is no fee and no clock, the sender is a name, the carrier is on the list, and the tracking number HX482139907GB fits the format of two letters, nine digits and two letters. There is even an order number.
The one line that matters is the first. In the boxes, the “m” of mapleandrye sits above an “r” and an “n”. Together those two letters look like an m, so the link reads as the shop at a glance, and only the box layout shows it is not. If the sheet had produced a score, eleven clear lines would have buried this one. Listing every observation keeps the single difference that matters in view.
The sheet does not decide whether this message is real. It tells you that one line needs a closer look before you tap anything, and what to compare it with. Open the Maple and Rye order from your saved account. If the order page shows the tracking number HX482139907GB, you already have what the message was offering, without the link.
After the check: three routes and a report
Whatever the sheet shows, it ends with the same short list: open the order from your own saved account, call the number on the shop’s own site, and do not reply. Those three work for every message in this post, and they do not depend on reading a domain correctly.
If you want to report a message, the reporting checklist names the routes without fixed addresses, because the right one depends on your country. It starts with a screenshot of the message and its sender, then the link copied as text without opening it. After that come your mobile provider’s spam-reporting route, the shop or carrier through its own contact page, your country’s consumer-fraud reporting service, and your bank if you tapped the link or paid.
A household routine for 20 November to 5 January
Keep one orders list for the household and add to it when you order, not when the message arrives. Print the one-page household card and put it where the phone charges, with the shop numbers you would call written in. When something arrives that nobody can place, run it through the delivery message checker and print the evidence sheet if you want to show someone else.
The habit is the whole point: the order you made is the evidence, and a message is a claim to compare with it.