Scam alert · November 3, 2026
That Package Text Arrived at Exactly the Right Time. That Is Why It Works.
Fake USPS and delivery texts thrive when families are expecting packages. Learn the safest way to check a delivery without touching the link.
Read this in five minutes. Then talk about it with someone you care about.
The text says a package cannot be delivered because the address is incomplete. Tap the link, confirm a few details, and pay a small redelivery charge.
It sounds believable because there really is a package on the way.
As holiday ordering begins, many families are waiting for several deliveries at once. Scammers do not need to know what you bought or where you bought it. They can send the same message to thousands of people and count on timing to make the story feel personal.
The U.S. Postal Inspection Service calls this kind of text-message phishing smishing. The link may lead to a convincing copy of a delivery website that asks for a name, address, card number, password, or other information. It may also expose the device to malicious software.
The message is not proof that a criminal knows about your order. Often, it is simply a guess sent during a season when that guess is likely to be right.
Why it works
Package messages combine familiarity, urgency, and a small request.
People are accustomed to receiving tracking updates. A missed delivery creates a practical problem, especially when the package may contain a gift or something needed soon. The requested fee is often low enough that paying seems easier than investigating.
The fake page may look polished and use a familiar logo. On a phone screen, the full web address can be difficult to inspect. Someone who would hesitate over a large payment may enter a card number for a charge of only a few dollars.
But the small fee is not necessarily the scammer's real goal. The payment form can collect the card details, address, login credentials, or other information needed for larger fraud later.
Warning signs to watch for
Treat a delivery text as suspicious when:
- You did not request text tracking for that specific package.
- The message contains an unfamiliar or shortened link.
- It says immediate action is required to prevent a return or cancellation.
- It asks for a redelivery fee, unpaid postage, or card information.
- The sender is an ordinary phone number or strange email address.
- The message uses awkward spacing, unusual punctuation, or a web address that is close to, but not exactly, the carrier's real domain.
- The link opens a page asking for more information than delivery should require.
The Postal Inspection Service says USPS customers must initiate tracking notifications and provide a tracking number. USPS does not send an unsolicited tracking text containing a link, and its tracking service does not require a redelivery payment.
The 60-second defense
Use one simple rule:
The text does not get to take you to the package.
Do not tap its link or reply. Instead, open the retailer or carrier app you already use, type the carrier's official address into the browser yourself, or use the tracking number from the original order confirmation.
If the order page shows no delivery problem, delete the text. If there is a real issue, handle it inside the trusted account or through a phone number from the carrier's official website.
Forward suspicious texts to 7726, which spells SPAM on a phone keypad. USPS-related scam texts and emails can also be forwarded to spam@uspis.gov. Then use the phone's option to report junk, block the sender, and delete the message.
If you tapped the link
Do not panic. What matters is what happened next.
If you opened the page but did not enter anything, close it. Update the phone and its apps, and watch for unusual behavior.
If you entered a card number, contact the card issuer immediately using the number on the back of the card. Explain that the details were entered on a fraudulent delivery site, ask about replacing the card, and review transactions.
If you entered a password, change it from the real website or app. Change it anywhere else you reused it, and turn on multifactor authentication. If personal information may have been exposed, visit IdentityTheft.gov for a recovery plan.
Keep a screenshot of the message and the web address before deleting it, but do not reopen the link to collect evidence.
Talk about it tonight
Ask your family:
“If a delivery text arrives while we are waiting for a package, where will we check it?”
Have everyone point to the trusted retailer or carrier app on their phone. For a parent who shops less often, bookmark the official carrier sites and show them where order confirmations are stored.
The goal is not to determine whether every text looks real. It is to create a safer route that makes the text irrelevant.
Scammers want one quick tap. Families can replace it with one reliable habit: leave the message and check the delivery independently.
If a package message still feels uncertain, paste its wording, but not the link or personal information, into the free Scam Detector for help identifying warning signs and deciding what to verify.