The text looks routine: a package could not be delivered because of a small address problem, and you just need to tap a link to fix it. You are expecting a delivery, so your thumb hovers over the link. Stop there. That link is the entire scam.
Fake package-delivery texts have become the most-reported phishing scam in the country, and they work because almost everyone has something in the mail. The scam has a name, smishing, and once you know the handful of things that give it away, it goes from convincing to obvious. Here is how the fake delivery text works, the signs that expose it, and exactly what to do when one lands in your messages.
The Short Version
A fake delivery text claims a package cannot be delivered over a missing address, unpaid fee, or other problem, and pushes you to tap a link. The link leads to a fake site that steals your logins, card number, or personal details. The giveaway is simple: real carriers like USPS do not send you unsolicited texts with links about delivery problems. Do not click, forward the text to 7726, and delete it.
What Smishing Actually Is
Smishing is phishing delivered by text message, and the fake delivery notice is its most common form. The scammer sends a message impersonating a carrier such as USPS, UPS, or FedEx, claiming there is a problem with a package and that you must act to resolve it.
It works for one reason: timing and volume. Send enough of these texts and a large share will reach someone actually waiting on a package, at which point a message about a delivery problem feels plausible rather than suspicious. As the US Postal Inspection Service warns, the goal is to get you onto a fake page and hand over information, and the delivery pretext is simply the bait that fits almost everyone.
The Dead Giveaways
You do not need to analyze the message closely. A few reliable tells expose it fast.
- It contains a link. This is the biggest one. Legitimate USPS tracking texts do not contain links, so a delivery text with a link to tap is a red flag by itself.
- You never signed up for it. If you did not request text tracking for a specific package, an unsolicited delivery text is suspect.
- It asks for a fee or details. A request to pay a small “redelivery fee” or to enter personal or payment information is not how real carriers operate.
- The web address is off. The link points to a strange domain that is not the carrier’s real site, often a jumble of words or a lookalike.
- It pressures you. Language about a package being returned or held unless you act immediately is manufactured urgency.
- It attaches a PDF. Some versions include a PDF and tell you to open it first, which is not standard carrier behavior.
What the Scammers Are Really After
The fake page on the other side of that link is built to harvest whatever it can. Depending on the version, it asks for account usernames and passwords, your card or bank details, a Social Security number, a date of birth, or a PIN. The “small redelivery fee” is itself a trap, because entering your card to pay a dollar or two hands the scammer your full card number.
Some of these details are used immediately, and some are bundled and sold. Either way, the value to the scammer is your information, not the tiny fee they advertise. That framing helps: the moment a delivery message wants money or personal data, its real purpose is exposed.
What to Do When You Get One
Handling a smishing text takes about a minute, and doing it right also helps carriers and investigators shut the numbers down.
- Do not tap the link. That single action defeats the scam, and security reporters put it plainly: do not click the link. Nothing bad happens from simply receiving the text.
- Verify independently. If you are genuinely expecting a package, check its status on the carrier’s official app or website, or with the tracking number you already have, not through the text.
- Report it to 7726. Forward the message to 7726, the universal SMS spam shortcode, which sends it to the carriers for action.
- Report to the Postal Inspection Service. For USPS-branded texts, report to the USPS Postal Inspection Service, and to the FTC as well.
- Delete and block. Remove the message and block the sender so it does not resurface.
What to Do If You Already Clicked
If you tapped the link but entered nothing, you are most likely fine, though you should close the page and avoid it. The risk begins when you enter information.
If you did type in details, act quickly. Change the password on any account you entered, and on any other account that shared that password. If you gave card or bank information, contact your bank or card issuer to flag the card and watch for fraudulent charges. Consider freezing your credit if you handed over a Social Security number, and report the incident to the FTC. Fast action is what limits the damage, so treat it as urgent rather than embarrassing.
What To Know
- Smishing is phishing by text, and fake delivery notices are its most common and most-reported form.
- Real USPS tracking texts do not contain links, so a delivery text with a link is a giveaway on its own.
- Other red flags are unsolicited contact, a requested fee, personal-info requests, odd web addresses, and urgency.
- The scammers want your logins, card details, or personal data, and the small “fee” is just a way to grab your card.
- Do not click, verify through the official app, forward the text to 7726, report it, and delete it.
Frequently Asked Questions
Does USPS ever text you about a package?
Only if you specifically signed up for text tracking on that package, and even then the messages do not contain links. An unsolicited text claiming a delivery problem, especially one with a link or a request for a fee or personal information, is not a legitimate USPS message.
What happens if I click the link in a fake delivery text?
Simply opening the page is usually not harmful by itself, but do not enter anything. The danger is the fake form, which captures whatever you type, such as logins, card numbers, or personal details. If you entered information, change passwords, alert your bank, and monitor for fraud right away.
How do I report a package delivery scam text?
Forward the message to 7726, the universal SMS spam shortcode, which routes it to the mobile carriers. For USPS-branded texts, also report to the USPS Postal Inspection Service, and file with the FTC. Then delete the message and block the sender.
Why do these texts feel so convincing?
Because scammers send them in huge volumes, so many land on people who really are expecting a package. That coincidence makes a message about a delivery problem feel plausible. The trick is timing and numbers, not a message tailored to you, which is why the same tells expose them all.
Final Word
The fake delivery text survives on a split-second of trust: you are expecting a package, the message sounds routine, and the link is right there. Take that second back. Real carriers do not text you links about delivery problems, so a link is the tell, and verifying through the official app costs you nothing. Forward the junk to 7726, delete it, and move on. Treat every delivery text with a link as a scam until proven otherwise, and you will almost never be wrong. For more coverage, see ShoutPost’s Tech News and Finance & Money sections.
This article is general consumer-safety information, not financial or legal advice. If you lost money or shared sensitive details, contact your bank and report the scam to the FTC at reportfraud.ftc.gov.