A package delivery scam text lands on your phone. "Hi Sarah, your package to 742 Elm Street cannot be delivered." You are expecting a package, and 742 Elm Street is your actual address. So you almost tap the link.
That text was not a lucky guess. The scammer already had your name, phone number, and home address before hitting send. How do scammers get your address and phone number in the first place? Phishing and smishing are at record levels. The FBI 2025 Internet Crime Report logged over 191,000 phishing complaints with $215.8 million in losses, and delivery-themed texts are a growing piece of that picture. The reason these scams work so well is simple: the scammer already has your personal information before the text ever goes out.
Most articles tell you how to spot a fake delivery text. What they skip is the more important question: how does your home address end up in scam databases in the first place? The answer is a data pipeline, and it starts long before that text hits your phone. Your residential address flows from three main sources into the bulk lists that smishing operations buy. Here is how that pipeline works, how fast it moves, and where you can break it.
Key takeaways
- Your home address enters scam databases through data brokers, e-commerce purchase history, and retail loyalty program breaches
- Data brokers can scrape property records, voter rolls, and USPS change-of-address filings to keep your profile current
- Scammers buy bulk lists of names, addresses, and phone numbers for very little money
- Replacing your real address with a PO box and using unique aliases for each account breaks the pipeline that makes delivery scams personal
How scammers get your address through data broker aggregation
Data brokers are companies that collect personal information from public sources, bundle it into profiles, and sell access to anyone willing to pay. A profile on you might include your name, home address, phone number, email, relatives, and estimated income. You never signed up for any of it, but the data is there because government filings make your address publicly available by default.
USPS change-of-address filings
When you file a change of address with USPS, that information enters the National Change of Address (NCOA) database. USPS licenses the NCOA database to approved vendors so they can keep mailing lists up to date. Many of those licensed vendors also happen to be data aggregators, which means your updated address can flow into commercial databases as brokers refresh their records, sometimes within weeks of your move. Once that happens, scam operations that buy broker lists may end up with your latest address rather than a stale one.
Property records and deed filings
When you buy or sell a home, the transaction is recorded with your county recorder's office. That record includes your name, address, and often the sale price. County records are public in most states, and data brokers can scrape them at scale. After a home purchase, your new address may show up in broker databases within weeks as brokers pull fresh public filings into their systems.
Voter registration rolls
Registering to vote puts your name and residential address into a state-maintained database. Most states prohibit direct commercial use of voter rolls, but the data still reaches brokers indirectly. Commercial data vendors purchase and enhance voter records with other public and commercial sources, creating enriched profiles that end up in the same databases scammers access.
Together, these three public-record sources give brokers a continuously updated view of where you live. According to market.us research, roughly 4,000 data broker companies operate in the United States. People-search sites like Spokeo, Whitepages, and BeenVerified are the consumer-facing end of this industry. A scam operation can buy bulk lists of names, addresses, and phone numbers from broker databases for very little money.
How e-commerce purchase history feeds delivery scam targeting data
Every time you shop online, you hand over your shipping address along with your name, email, and phone number at checkout. You order a pair of shoes from a retailer, enter your address, and move on with your day. But that address does not always stay with the retailer. Many companies share purchase data with marketing partners and data aggregators, and from there, your information can travel through a chain of resellers until it lands in the same bulk lists that scam operations use for delivery-themed texts.
How the resale chain works
The sharing is usually disclosed somewhere in a privacy policy, but few people read those. Once your purchase data leaves the retailer, it enters a chain of downstream buyers that can include list brokers, ad networks, and lead-generation companies. A data aggregator that buys your purchase history from a retailer may resell it to another aggregator, who resells it to a list vendor, who sells bulk contact lists to anyone who pays. Each step adds distance between you and the final buyer, and scam operations sit at the far end of that chain. Nobody needs to hack anything to get your address. A bulk list of names, phone numbers, and confirmed shipping addresses, purchased through a few intermediaries, gives a delivery scam everything it needs to sound real.
Why purchase history makes delivery scams convincing
Purchase history tells a scammer not just where you live, but that you actively order packages. A person who bought something online last week is far more likely to believe a "your package cannot be delivered" text than someone who has not shopped online in months. Knowing that someone actively shops online makes them a better target for a fake delivery text, which is why e-commerce data is especially valuable to smishing operations that specialize in delivery-themed scams. The more personal information exposed online about you, the more convincing a delivery scam becomes.
How breach data from loyalty programs reaches smishing databases
A single data breach at a retail loyalty program can hand attackers a complete profile on every member, including home addresses, phone numbers, and shopping habits. When that stolen data reaches dark web marketplaces, scam operators can buy it and package it into targeted contact lists used for delivery scams.
Why loyalty programs are high-value breach targets
Loyalty accounts are attractive targets because they bundle so much information in one place. Say you signed up for a grocery store rewards program five years ago. You gave them your address, phone number, and email to get a discount card. All of that sits in a single database. When that retailer gets hacked, the attacker does not just get one data point, they get a full profile on every member. And unlike a credit card number that can be canceled, your home address and phone number do not change after a breach.
How breach data reaches scam operators
Stolen loyalty program databases can appear on dark web marketplaces within days to weeks of a breach. Scam operators buy or aggregate these records and package them into targeted contact lists. A list built from a breached grocery chain loyalty program, for example, gives a scammer confirmed home addresses for people who likely receive regular deliveries. Some lists may be segmented by zip code, purchase frequency, or retailer, making the smishing home address scam even easier to personalize.
The cross-referencing problem
A scammer with your address from one breach can cross-reference it against data broker profiles to add your phone number, or match it against a second breach to confirm your email. When a single real address ties together your phone, email, and purchase habits, an attacker can craft a delivery scam so specific it looks like it came from the actual carrier. Monitoring for leaked credentials catches these exposures early, but the address itself cannot be "reset" the way a password can.
The timeline: from address acquisition to first scam text
How fast does your address travel from a public record or a breach into a smishing campaign? No single timeline fits every case, but the general pattern moves faster than most people expect.
- Day 0: You file a change of address, close on a house, or a retailer's loyalty database is breached.
- Days 1-14: Data brokers may update their records from public filings. Stolen credential data can hit dark web marketplaces within 48 hours, according to Constella Intelligence research. Full database dumps from larger breaches may take days to weeks to surface.
- Days 14-30: Broker lists are purchased by downstream aggregators and list vendors. Smishing operators buy or refresh their bulk contact lists on a rolling basis.
- Days 30-60: Your phone may start receiving fake delivery texts referencing your new address or the retailer whose loyalty program was breached.
The window between your address entering the pipeline and the first scam text arriving can be less than two months. The exact timing varies depending on how quickly brokers refresh their data and how recently scam operators purchased new lists.
The structural fix: break the pipeline at the source
Blocking individual scam numbers or reporting texts only treats the symptom. To actually stop these scams from reaching you, you need to cut off the data that makes them personal and convincing in the first place. Here are three steps that address the root cause.
- Replace your real address in e-commerce accounts with a PO box. Your shipping address does not have to be your residential address. Renting a PO box from USPS or a private mailbox from a UPS Store gives you a mailing address that is not tied to where you live. Use the PO box as your shipping and billing address for online purchases. If that address leaks in a breach or gets resold downstream, it points to a PO box, not your front door.
- Use a unique email alias and phone number alias for every account. When every e-commerce account uses the same email and phone number, a single breach or a single broker profile connects everything. A unique alias for each retailer means a scammer who gets one alias from a breach cannot cross-reference it against broker databases to find your real phone number. If one alias is compromised, you disable it and create a new one.
- Remove your real information from data broker sites. Even with a PO box and aliases, your residential address may already sit on dozens of broker profiles from years of public record filings. Searching your name on people-search sites shows what is already exposed. Each site has an opt-out process, but doing it manually across dozens of brokers is time-consuming, and many re-add your data within months. An automated removal service handles ongoing removal, so broker lists stay clean.
How Cloaked helps you shut down the pipeline
Cloaked removes your personal information from 1000+ public websites, starving the pipeline that feeds smishing databases. You can generate unique email and phone aliases for every account with a single click, so a breach at one retailer cannot be cross-referenced to build a full profile on you. Add scam call screening to block unknown callers, Dark Web & SSN Monitoring to catch breach exposures early, and identity theft insurance as a safety net.
Take a safety scan to see how exposed your address and phone number are right now, or contact us to learn more.
FAQs
How do scammers get your home address for delivery scam texts?
Scammers get your home address from three main sources: data broker databases that aggregate public records like property filings and voter registrations, e-commerce purchase history that gets resold through downstream data buyers, and breach data from hacked retail loyalty programs. A bulk list combining addresses and phone numbers costs very little to purchase.
How long does it take for your address to end up in a scam database?
No single timeline applies to every case, but the general pattern can move from address acquisition to first scam text in roughly 30 to 60 days. For breach-sourced data, the window may be shorter because stolen databases can surface on dark web marketplaces within days to weeks. The speed depends on how quickly brokers refresh their lists and how recently scam operators purchased new contact data.
Can a PO box protect you from delivery scams?
Using a PO box as your shipping address for online purchases prevents your residential address from entering e-commerce data pipelines. If that PO box address leaks in a breach or gets resold, scammers get a mailbox location instead of your home. The text loses the personal detail that makes it convincing.
Why do delivery scam texts know your real name and street?
Scammers personalize texts using data purchased from brokers or stolen in breaches. A data broker profile built from public records and purchase history can include your full name, current address, and phone number. Cross-referencing multiple data sources lets scammers match a phone number to a confirmed residential address.
What is the connection between data brokers and smishing?
Data brokers collect and sell personal information that smishing operations can use to build targeted contact lists. A broker profile linking your phone number to your home address and purchase history gives a delivery scam everything it needs to sound real. Removing your data from broker sites cuts off this supply chain.
Do email and phone aliases actually reduce delivery scam texts?
Aliases prevent the cross-referencing that makes delivery scams targeted. When every account uses a different alias, a scammer who gets one from a breach cannot connect it to your real phone number through broker lookups. You can disable a compromised alias and create a new one without changing your real contact information.
