It is a Tuesday in mid-December and you are in line for coffee when your phone buzzes. An email from the carrier: "We couldn't deliver your package. Confirm your address to reschedule." You have two orders on the way, so you tap the link.
The page looks right. You type your email and password, and the page says "We're verifying your details" and spins.
Your phone buzzes again, this time a text with a six-digit code you didn't ask for. Then it rings. A friendly voice says she is from the delivery desk, the verification did not go through, and could you read out the code you just received. You read it out.
That is a real code for a real login. While you typed into the fake page, the caller was typing the same details into the real one: your bank, your Apple or Google account, or your work single sign-on. If it was work SSO, she is now in your email, Slack, payroll direct deposit settings, cloud consoles and customer data.
Now picture that the person in the coffee line works for you. The phone in their hand holds their work apps, and the code they just read out was for their work login. The same sequence of message, fake login and one-time code was used in 2022 against more than 130 companies. In that campaign the fake page relayed the code on its own; here the caller does it by voice.
How big is the holiday delivery scam problem?
The FTC's April 2025 Data Spotlight says fake package-delivery problem messages were the most reported text scam of 2024. People reported $470 million in losses to scams that started with a text, more than five times the 2020 number.
Why should employers care about a consumer delivery scam?
Because attackers send the same messages to anyone with a phone number, whatever their employer. The 0ktapus campaign began with text messages to employees that linked to fake Okta login pages. The pages captured usernames, passwords and one-time codes. Group-IB, as reported by BleepingComputer, counted 9,931 user credentials across more than 130 organizations.
Cloudflare was hit the same way: at least 76 employees received the texts in under a minute, on personal and work phones, and three entered their credentials. Its FIDO2 hardware security keys stopped the attacker from logging in. FIDO2 keys do not hand the attacker a code to relay.
In Verizon's 2025 breach report, 46% of compromised systems that held corporate logins were non-managed devices that also held personal credentials, so a personal phone or laptop can hold the work login the attacker wants. Awareness programs that only simulate email never test this part of the chain.
What can employers do to prepare their workforce?
Scam texts will reach employees' phones whatever you do, so give them a rehearsal first.
- Simulate every channel the attacker uses. Email, SMS and voice each need their own scenario.
- Test the read-back as well as the click. Include a fake login that asks for a verification code, and a call that asks for it. Use an inert code that unlocks nothing.
- Decide who gets the call. Call everyone, or only the people who failed the email. Calling everyone shows whether people who ignored the email would still help a polite caller.
- Give people a way to report a text or a call. Name one route (a Slack channel, a security phone line or mailbox) before launch, and brief the help desk, or the report rate for those channels will read zero.
- Get consent and disclosure right. Decide whether you will contact corporate or personal numbers, and get HR and legal sign-off (and works council review where relevant) before you load a number. Open every call by saying it is an awareness exercise, and never contact anyone who opted out.
- Teach the rule and fix the root. Nobody legitimate needs a code read aloud: hang up, report it, and call back on a number you already trust. Move your highest-risk staff to phishing-resistant authentication such as hardware keys, and give a short lesson while the failure is fresh.
How do you know it's working?
Pick measures before you launch and compare them across channels. Run the same scenario before and after training and judge the change. Treat the first run as your baseline.
- Report rate. The share of recipients who reported the message.
- Median time to report, and time to first report. The first report is what lets your team act while the attack is live.
- Answer rate and read-back rate on calls, measured against calls placed rather than everyone targeted, because unanswered calls would flatter the number.
The ones people forget:
- Whether anyone reported the text or the call. Most dashboards count email reports only.
- Who failed on one channel but not another. It shows where the program has a blind spot.
- Repeat failures across channels. These are the people to move to hardware keys first.
- Opt-outs. A rising count can mean the exercise felt invasive, and those people are now untested.
How do you launch a holiday cross-channel simulation in Herd in six steps?
Herd runs cross-channel phishing simulations on email, SMS and voice. Email simulations come with every plan (on Startup as a $20-a-month add-on); SMS and voice are on the Enterprise plan (pricing). The email and voice legs are two campaigns, not one triggered sequence, so you choose the gap between them and who gets the call.
1. Get a delivery template
Search your template library for a delivery notice. If none fits your carrier and region, go to the Templates tab, click New template, write a short "we couldn't deliver your parcel" message with the link placeholder, and choose a landing page that captures credentials. You can also clone any template that already has a credential-capture landing page and rewrite its sender, subject and body.
2. Build the email campaign
Go to Simulations, then Email, then Campaigns, click New campaign and pick the template. On the Audience tab, add people or groups, or define the audience by rule (department, title, risk level and more). In the delivery settings, tick Ask for a verification code after a password is entered, then launch now or schedule it. Herd records that a code was entered, never the code itself, so you learn who would have handed over a second factor without collecting anything sensitive.
3. Add the text
The text leg lives under Simulations, then SMS. A smishing template is a short message with a tracked link and, optionally, the same landing pages email uses. On the Campaigns tab, click New campaign, pick the template, add the audience and launch or schedule it, the same way as the email. Herd records delivery, the tap, any credential submission and whether the person reported it. Recipients who reply STOP are honored on every later send.
4. Set up voice and write the call
Go to Simulations, then Voice. For your organization's first voice campaign, complete the consent attestation at the top of the page; nothing is dialed until an admin does. On the Attack types tab, click New attack type. The text message must contain the {{code}} placeholder, and the script should end by asking for it. Keep the disclosure line Herd pre-fills. If your organization requires approval for new attack types, a reviewer approves it before it can be used. A seasonal script: "This is the delivery desk. I've just sent a code to your phone so I can release the parcel. Can you read it to me?"
5. Target and launch
Create a voice campaign with that attack type. On Audience, add yourself first with Me to hear the call, then add the same group as the email, or only the people who failed it. Turn on training on failure if you want it. The confirmation tells you exactly how many people will be texted an inert code and called. Herd waits for the carrier to confirm the text landed, then places an AI-voiced call that follows your script and asks for the code back. Reading it back is the failure, recorded as a high-weight risk event. No call audio is kept, only the digits the speech recognizer heard; opted-out recipients are never called; and once calling starts the campaign can't be paused.
6. Read the results
Email results show the Delivered, Opened, Clicked and Credentials funnel, the report rate, median time to click and median time to report, and a per-person table of outcome, assigned training and follow-up. Voice results count Targeted, Code texted, Calls placed, Answered and Read code back, with the read-back rate measured against calls placed. Then open Intelligence, then People risk, and pick a person: email, SMS and voice simulations all feed their one risk score.
Rehearse it before the real one
Go back to the Tuesday in December. The email arrives and the page asks for a login. This time the person has met this chain before, in an exercise with a lesson attached. The phone rings, they say they don't read codes to callers, and they hang up and report both the text and the call.
Without that exercise, the first time this employee met the chain would have been the real one. The code would have gone to the caller, and an attacker would be inside your SSO with your email, Slack, payroll and customer data behind it.
Want to learn more about designing fair, realistic scenarios across channels? Read Building Effective Cross-Channel Simulations.
Want to see the email, text and call chain running in your own environment before the holiday peak? Book a demo.
