Tell a real order notification apart from a fake one, and know what the delivery code does and doesn't do.
The order, the code, and the sticker
What a real notification asks for
Order messages come in constantly and have long since become background noise. That's where the fake does its work.
A worked example. Text: “Order #70-118342 has arrived at the pickup point, 7 Maple Street. Delivery code: 8123.” This is a real message. It asks you to share nothing, sends you nowhere, and wants no money — it just says where the box is.
The delivery code is the only code you say out loud. But it has one place: the pickup point or the courier, face to face, as you're handed the order. Nobody asks for it over the phone “to confirm the order”: there's nothing to confirm, the order is already placed. You already know the rule for text codes and push notifications from Unit 3.
A fake notification always asks you to act, usually in one of two ways. One is to install an app from a link: “Your carrier: your service plan expires September 12. Renew in the app: hxxps://plan-renewal.app/update.apk.” A link like that downloads a file, and apps come only from the official app store. The other is a payment page that opens after you tap: an extra fee “for storage” or “for delivery.”
A QR code is a link you can't read: a sticker goes over the real one, a fake bill lands in the mailbox. So after scanning, check the domain (right to left, as in Unit 3) and the amount. The FTC has warned about fake QR stickers on parking meters too.
Lesson notes
What a real notification asks for
Order messages come in constantly and have long since become background noise. That's where the fake does its work.
A worked example. Text: “Order #70-118342 has arrived at the pickup point, 7 Maple Street. Delivery code: 8123.” This is a real message. It asks you to share nothing, sends you nowhere, and wants no money — it just says where the box is.
The delivery code is the only code you say out loud. But it has one place: the pickup point or the courier, face to face, as you're handed the order. Nobody asks for it over the phone “to confirm the order”: there's nothing to confirm, the order is already placed. You already know the rule for text codes and push notifications from Unit 3.
A fake notification always asks you to act, usually in one of two ways. One is to install an app from a link: “Your carrier: your service plan expires September 12. Renew in the app: hxxps://plan-renewal.app/update.apk.” A link like that downloads a file, and apps come only from the official app store. The other is a payment page that opens after you tap: an extra fee “for storage” or “for delivery.”
A QR code is a link you can't read: a sticker goes over the real one, a fake bill lands in the mailbox. So after scanning, check the domain (right to left, as in Unit 3) and the amount. The FTC has warned about fake QR stickers on parking meters too.