Delivery SMS Scams in Japan: How to Spot Fake Redelivery Notifications

Japan's convenience culture has a dark side. The country's high volume of home deliveries -- combined with the cultural expectation of prompt redelivery -- has created a perfect target for smishing (SMS phishing) attacks. Fake delivery notifications from Japan Post, Sagawa Express, Yamato Transport, Amazon, and Uber Eats flood Japanese phones daily.

How the Scam Works

The pattern is remarkably consistent:

1. You receive an SMS: "We attempted delivery but you were not home. Please schedule redelivery here: [URL]"
2. The URL looks similar to the real carrier's website but is a fake
3. Clicking leads to either a phishing page requesting your login credentials, credit card details, or Apple/Google account -- or triggers a malware APK download on Android devices
4. Your information is stolen, or your device is compromised

Common Fake SMS Examples

Impersonated Service	Typical Message
Japan Post (日本郵便)	お荷物のお届けに伺いましたが不在でした。再配達→[URL]
Sagawa Express (佐川急便)	佐川急便よりお荷物のお届けに上がりましたが不在の為持ち帰りました→[URL]
Yamato Transport (ヤマト運輸)	ヤマト運輸より荷物のお届けに参りましたが不在でした→[URL]
Amazon	Amazonからの荷物の配送に問題があります→[URL]
Uber Eats	配達が完了しました。確認→[URL]

Why Japan Is Uniquely Vulnerable

Several factors make Japan a prime target for delivery SMS scams:

• High delivery volume: Japan processes billions of parcels annually
• Redelivery culture (再配達): Japanese carriers offer free redelivery, so people expect and respond to redelivery notifications
• Trust in carriers: Japanese delivery services are extremely reliable, so people trust messages that appear to come from them
• Politeness culture: People feel obligated to respond to missed delivery notices promptly
• Smartphone penetration: Nearly universal smartphone usage means SMS reaches virtually everyone

How to Identify Fake SMS

Red Flags

1. The URL does not match the official domain

   • Japan Post: japanpost.jp
   • Sagawa: sagawa-exp.co.jp
   • Yamato: kuronekoyamato.co.jp
   • Amazon: amazon.co.jp

2. Shortened URLs: Legitimate carriers do not use URL shorteners like bit.ly

3. Generic messages: Real notifications typically include your tracking number

4. Urgency language: "Your package will be returned" or "Action required within 24 hours"

5. Requests for personal information: Carriers never ask for credit card details or passwords via SMS

What Real Notifications Look Like

Legitimate delivery notifications from Japanese carriers:

• Come from a recognized sender name or number
• Include a tracking number
• Direct you to the official app or website
• Never ask for payment information
• Never require you to install an app from an SMS link

What to Do Instead

Check Delivery Status Safely

• Yamato: Use the Kuroneko Yamato app or visit kuronekoyamato.co.jp with your tracking number
• Sagawa: Use the Sagawa tracking page at sagawa-exp.co.jp
• Japan Post: Track at japanpost.jp/trackings
• Amazon: Check your Amazon app order history

If You Already Clicked

1. Do NOT enter any information on the page
2. Close the browser immediately
3. If you downloaded an APK file, do NOT install it. Delete it immediately
4. If you entered credentials, change your password immediately on the real website
5. If you entered credit card info, contact your card company immediately to freeze the card
6. Run a security scan on your device
7. Report the scam to the carrier and to the Anti-Phishing Council (フィッシング対策協議会)

Beyond Delivery Scams: The Bigger Picture

Delivery SMS scams are just one type of smishing. Similar tactics are used for:

• Banking notifications ("unusual login detected")
• Tax refund notifications
• Carrier account alerts ("your au/docomo account needs verification")
• E-commerce notifications ("your order has a problem")

The defense is the same: never click links in SMS messages. Always go directly to the official app or website.

Sharing Tracking Links Safely

If you need to share a real tracking link with someone -- perhaps a family member expecting a delivery or a colleague waiting for a business shipment -- using an SMS or messaging app creates a problem. The recipient has been trained to distrust links in messages.

Instead, you can share tracking information through LOCK.PUB. Create a password-protected link containing the tracking URL and carrier information. Share the LOCK.PUB link and password separately. The recipient knows the link is intentional and verified, not a random phishing attempt.

Reporting

If you receive a suspicious SMS:

• Police: 110 (emergency) or #9110 (consultation)
• Anti-Phishing Council (フィッシング対策協議会): Report at antiphishing.jp
• Carrier: Report to your mobile carrier (docomo, au, SoftBank)
• Platform: Report the sender on your phone's messaging app

Prevention Tips

1. Never click SMS links -- always navigate to apps or websites directly
2. Enable SMS filtering on your phone (available on both iPhone and Android)
3. Install official carrier apps for tracking deliveries
4. Register your delivery preferences with carriers to reduce redelivery situations
5. Use delivery boxes (宅配ボックス) if your building has them
6. Set up designated delivery locations through carrier apps

Conclusion

Delivery SMS scams exploit Japan's efficient delivery infrastructure and cultural trust. The simplest protection is a habit: never click links in SMS messages. Use official apps for tracking, verify suspicious messages through official channels, and share real tracking links safely using encrypted services like LOCK.PUB.

Report every suspicious SMS you receive. Each report helps authorities identify and shut down phishing operations faster.