“USPS: Your package is being held due to an incomplete address. Please update at: usps-tracking24.com/redelivery.” You’re probably expecting a package — most people are, most of the time — so you tap the link, enter your address and a small “redelivery fee,” and the scammer now has your card number plus enough personal info to attempt identity theft.
Fake delivery texts (sometimes called “smishing” for SMS phishing) are now the most common scam text in the U.S. by volume. They impersonate USPS, FedEx, UPS, DHL, and Amazon, and they work because they’re plausible at exactly the moment they arrive.
Why These Scams Work
- Real expectation. Most people have something in transit at any given moment. The text feels like it might be real, especially mid-day on a weekday.
- Trivial action. “Confirm an address” or “pay $1.99 redelivery” feels low-risk. You’re not expecting a $5,000 loss; you’re expecting a small inconvenience. Brain doesn’t engage skeptical mode.
- The link is the entire scam. Once you’re on the lookalike site, they’ll get your name, address, phone, email, card number, and CVV — everything they need to drain accounts or sell the package on the dark web.
- Mobile makes URLs hard to read. “usps.com” vs “usps-tracking-portal.com” vs “u-sps.shipping24.cn” — small screens hide the differences.
The Tells of a Fake Delivery Message
- You didn’t opt in to tracking texts from this carrier. Carriers don’t text you out of the blue.
- The link is not the real domain. Real: usps.com, fedex.com, ups.com, amazon.com. Fake: anything with hyphens, country codes, or “tracking24”/“redelivery-portal”/“customs-fee” in the URL. Anything that uses a URL shortener (bit.ly, tinyurl, etc.) for an official notification.
- A “fee” is requested. USPS, UPS, and FedEx don’t charge you a small redelivery fee by text. International customs fees, when they exist, are paid through the official carrier site after you initiate the lookup — not via SMS link.
- Tracking number that doesn’t match your real package format. USPS tracking numbers are 20-22 digits, FedEx are 12 or 15, UPS starts with “1Z.”
- Awkward phrasing or slightly off branding. “Your parcel is on hold” or “USPS-Tracking team.”
- Comes from a long number or international code, not the carrier’s short code.
The One Habit That Stops All of These
Never tap the link in a delivery text. Ever. If you think there might be a real issue with a package you’re expecting:
- Go to the original order confirmation email from the retailer (Amazon, the store you bought from, etc.).
- Use the tracking link from that email, or copy the tracking number and paste it into the carrier’s website you typed in yourself.
- If you can’t find an order confirmation, you don’t have a package coming. Delete the text.
Variants to Watch For
The Customs Fee
“Your international shipment requires a customs payment of $3.50 to release.” Tap, enter card. The fee is fake; your card is now compromised. Real customs fees are collected by the carrier at delivery or through their official portal you initiated.
The “Sender Has Cancelled” Refund
“The sender of your package has requested a refund. Confirm your bank details to receive $X.” Real refunds go back to the original payment method — no “bank details” needed.
The Driver Photo Hook
“Your USPS driver took a photo at delivery — click to view.” Real Amazon and UPS delivery photos live in their apps, not as random SMS links.
The Voice Variant (“Vishing”)
A robocall: “This is FedEx. Press 1 to speak to an agent about your delayed package.” Same playbook in audio. Hang up.
How to Report a Fake Delivery Text
- Forward the text to 7726 (spells SPAM). Free across major U.S. carriers; routes to your phone carrier’s spam-fighting team.
- Report to the carrier being impersonated:
- USPS: forward to spam@uspis.gov with subject “Smishing”
- FedEx: abuse@fedex.com
- UPS: fraud@ups.com
- Amazon: stop-spoofing@amazon.com
- Report to the FTC at reportfraud.ftc.gov.
- Then delete the text. Don’t reply “STOP” — that just confirms your number is active.
If You Already Tapped and Entered Info
- If you entered card info: call your card issuer immediately, freeze the card, and request a new number. If a fraudulent charge already appeared, dispute it.
- If you entered login credentials (e.g., to a fake Amazon login page): change that password now, plus any account that uses the same password.
- Check your accounts for unauthorized activity over the next two weeks.
- Consider freezing your credit at all three bureaus. (See our guide to freezing your credit.)
- Report to ic3.gov and reportfraud.ftc.gov.
Further Reading
- Phishing Patterns: Email, Text, and Voice Scams Explained
- QR Code Scams (Quishing): The Newest Phishing Variant
- How to Freeze Your Credit
- All Scams & Fraud Protection articles
Educational only. Scam tactics evolve constantly. If you believe you’ve been targeted or have lost money, report to: the Federal Trade Commission at reportfraud.ftc.gov, the FBI’s Internet Crime Complaint Center at ic3.gov, your state attorney general, and your local police. For lost funds, contact your bank, credit-card issuer, or payment-app support immediately — speed of reporting often determines whether funds can be recovered. This article is not a substitute for legal or financial advice.