No one in the western world who has a smart phone is not aware of phone scams. Everyone has been told not to trust random links in text messages, usually by the banks and businesses that are being used in these scams, but 'just this time, it looks safe, they’ve always been safe before."

This kind of online-safety thinking needs to be drilled into people like wearing seatbelts and brushing your teeth.

Especially when they spoof the phone number to be from official numbers. Your first instinct is probably to check if the number really belongs to CRA/Canada Post/etc, and while the idea of being asked for payment via text in general should set off your suspicision, a genuine number could easily convince enough people to make a profit. Basically like the social engineering version of spoofing a TLS identity via a compromised certificate authority.