Package delivery scam texts are easiest to believe when you are actually waiting for a box. The message may say a label is wrong, postage is unpaid, a driver missed you, or your shipping preferences need to be updated. The safer move is simple: do not tap the link first.
The Federal Trade Commission said consumers reported $470 million in losses to scams that started with text messages in 2024, and fake package delivery was the most commonly reported type. That does not mean every delivery message is fake. It means a real shopping week is exactly when a fake message can blend in.
The short rule: verify the package from a website or app you already trust, not from the link in the text.
Do this first
- Do not click the link. If the text is unexpected, treat the link as unsafe until you verify the shipment somewhere else.
- Open the retailer or carrier yourself. Use the store account, order confirmation, carrier app, or a typed-in address such as USPS.com. Do not use the phone number or website included in the message.
- Check whether the message matches a real order. Look for a real order number, tracking number, carrier name, shipping address, and estimated delivery date in your account.
- Pause before paying any fee. Scammers often ask for a small redelivery, postage, customs, or address-correction payment because a small amount feels harmless.
- Report the text. Forward unwanted texts to 7726, use your phone's junk-reporting option, and report fraud to the FTC if you lost money or shared information.
Check these details
A fake delivery text often creates urgency. It may say the package will be returned today, that your address is incomplete, or that you must reply before a deadline. The FTC warns that these links can lead to look-alike websites that ask for personal or financial information.
The United States Postal Inspection Service gives one especially useful test for USPS-branded messages: USPS text tracking requires the customer to request the service and provide a tracking number. USPIS says USPS will not send customers text messages or emails without that request, and those messages will not contain a link.
That does not mean you should ignore every delivery issue. Packages really can be delayed or need attention. The difference is the channel. If the alert might be real, go directly to the retailer or carrier, sign in, and check the shipment there.
Common warning signs
- A link that does not match the carrier. Misspellings, extra words, strange domains, and shortened links are common red flags.
- A request for a small payment. A tiny fee can be bait for your full card number, billing address, and security code.
- Generic wording. Be cautious when the text does not name the retailer, order, product, or tracking number you can match to your account.
- Pressure to reply. Some messages ask you to reply first to activate a link or confirm that your number is live.
- Requests for sensitive information. A delivery update should not ask for your account password, Social Security number, bank login, or full card details by text.
If you clicked or paid
If you clicked but did not enter information, close the page, do not download anything, and consider running your phone's security update and browser safety checks. If you entered a password, change it from the real site and change it anywhere else you reused it.
If you entered payment information, contact your bank or card issuer quickly. Ask about replacing the card, disputing unauthorized charges, and monitoring the account. If you entered a Social Security number or other identity details, consider an identity-theft recovery plan through IdentityTheft.gov.
Where to report it
For USPS-related smishing, the Postal Inspection Service says to email spam@uspis.gov with the suspicious message details and to forward the text to 7726. For other unwanted texts, the FTC recommends forwarding the message to 7726, reporting it in the messaging app, and filing a report at ReportFraud.ftc.gov when appropriate.
The best habit is boring but effective: when a message tries to move you from a text into a payment page, stop and check the package through a source you chose yourself. Real deliveries can wait a minute. A scam link is designed to make you skip that minute.
