Total Defense makes internet security easy for you and tough on destructive malware. We don’t just protect devices, we protect people.

Your phone buzzes with a delivery update. The message says your package is delayed because of an incomplete address, unpaid postage, or a customs fee. Since you recently ordered something, the text feels believable. 

That sense of familiarity is exactly what scammers count on. 

Fake package delivery texts, also called smishing attacks, impersonate USPS, UPS, FedEx, DHL, Amazon, and other recognizable brands. The messages direct recipients to look-alike websites that capture payment details, passwords, Social Security numbers, and other personal information. 

How common are fake package delivery texts? 

Delivery scams are not rare or isolated. According to the Federal Trade Commission’s analysis of the top text scams of 2024, consumers reported $470 million in losses from scams that started with text messages in 2024, more than five times the amount reported in 2020. Fake package delivery problems were the most commonly reported type of text scam.

The FTC also notes that reported losses probably represent only a portion of the actual harm because many fraud incidents go unreported. 

Why are package delivery scams getting harder to spot? 

People regularly receive real delivery notifications, so a fake one does not immediately feel unusual. Scammers strengthen the illusion by copying logos, colors, shipping terminology, and website layouts from legitimate carriers. 

Recent variations have also adapted to current events. The Federal Communications Commission’s package delivery scam guidance warns that criminals may send texts claiming a shipment is stuck in customs or requires a tariff payment before delivery. 

Common scam messages claim: 

• Your address is incomplete. 
• A delivery attempt failed. 
• Your package needs to be rescheduled. 
• You owe a small redelivery or postage fee. 
• Your order is stuck in customs. 
• Your package will be returned unless you act immediately. 

The small fee is often bait. The real goal may be to obtain your full credit card number, billing address, security code, login credentials, or Social Security number. 

What is smishing and how does it work? 

Smishing combines “SMS” and “phishing.” The U.S. Postal Inspection Service’s smishing guidance explains that scammers send deceptive text messages designed to persuade recipients to provide personal or financial information. 

The scam usually follows this sequence: 

1. You receive an unexpected delivery text. 
2. The message creates urgency or curiosity. 
3. A link opens a fake carrier website. 
4. The website requests information or a small payment. 
5. The scammer captures everything you enter. 

The website may look legitimate on a phone’s smaller screen. A familiar logo and convincing page design can distract you from a misspelled or unrelated web address. 

How can you tell if a delivery text is fake? 

Look for several warning signs instead of relying on grammar alone: 

• The message arrived unexpectedly. 
• It contains a shortened, unusual, or misspelled link. 
• It asks for a password, card number, or Social Security number. 
• It pressures you to act immediately. 
• It demands a redelivery fee. 
• The tracking details do not match your actual order. 
• It comes from an unfamiliar number or email address. 
• It asks you to reply, including with the word “STOP.” 

The FCC advises consumers not to reply to suspicious messages, even when a text asks them to respond with “STOP,” because some scammers seek engagement or want to confirm that a phone number is active. 

For USPS specifically, the Postal Inspection Service says customers must first request tracking for a particular package before receiving USPS tracking texts. Those requested messages will not contain a link, and USPS does not charge for its tracking service. 

What should you do when you receive a delivery text? 

Follow one rule: Leave the message and verify independently. 

• Do not click the link. 
• Do not reply to the sender. 
• Open the retailer’s official app or website. 
• Check the order directly in your purchase history. 
• Type the carrier’s website address into your browser yourself. 
• Compare the tracking number with your order confirmation. 
• Contact the retailer or carrier through verified contact information. 

The FTC recommends contacting the company through a phone number or website you know is real, rather than using information contained in an unexpected text. 

How does this help someone become safer online? 

Independent verification breaks the scam’s chain. You prevent the criminal from controlling where you go, what website you visit, and what information you provide. 

This habit protects more than one package. It trains you to handle bank alerts, toll notices, password warnings, account problems, and other urgent messages with the same healthy caution. 

Safer online behavior means: 

• Pausing before clicking 
• Navigating to official websites independently 
• Questioning unexpected requests for payment 
• Protecting login credentials and verification codes 
• Reporting scams so providers can improve filtering 

What should you do if you clicked the link? 

If you clicked but entered nothing, close the page and avoid downloading files. Update your device and security software, then run a security scan if the site initiated a download. 

If you entered information: 

1. Contact your card issuer or bank immediately if you provided payment information. 
2. Change exposed passwords from a trusted device. 
3. Replace reused passwords on other accounts. 
4. Enable multifactor authentication wherever available. 
5. Monitor bank, credit card, email, and shopping accounts. 
6. Save screenshots and transaction details for reporting. 

The Postal Inspection Service advises contacting your financial institution if you interacted with a suspicious USPS-related link. 

How do you report a fake delivery text? 

Forward unwanted texts to 7726, which spells SPAM. The FTC says this helps wireless providers identify and block similar messages. 

For USPS impersonation, forward the message to [email protected] and include a screenshot, the sender’s number, the date, and details about any interaction or loss. The Postal Inspection Service provides complete USPS scam-reporting instructions. 

You can also report delivery scams through the FTC’s official fraud-reporting system. 

Fake package delivery texts are getting harder to spot because they blend into everyday shopping and shipping activity. Logos, polished language, believable tracking problems, and small payment requests can make a scam feel routine. 

Do not judge the message by appearance alone. Avoid the link, open the retailer or carrier’s official site yourself, and confirm the shipment independently. That brief pause can prevent a fake delivery update from turning into payment fraud, password theft, or identity theft. 

Traveling is fun. Losing access to your email, bank account, or phone while traveling? Not so much. Whether you’re heading out for a weekend trip or flying internationally, your devices carry a lot of sensitive information: photos, passwords, banking apps, work files, travel confirmations, and personal messages. A few simple cybersecurity habits can help protect […] Read More»