An unexpected text saying your package cannot be delivered can arrive at exactly the right—or wrong—time. Many people regularly have something on the way, so a message claiming to be from USPS, UPS, or another delivery service can seem plausible even when the sender has no knowledge of a real shipment.
Delivery-themed text scams are a form of phishing known as smishing: phishing delivered through SMS or another messaging service. A message may claim your address is incomplete, a package is waiting at a warehouse, or a small redelivery fee is required. A link then leads somewhere that may request personal or payment information.
Receiving a suspicious delivery text does not mean your phone is compromised, and receiving one while you genuinely expect a package does not prove the sender knows about your purchase. Instead of trying to determine authenticity from the text alone, verify the shipment through the retailer or carrier using contact information and websites you reach independently.
This guide focuses on the USPS text scam and similar package delivery scams, including messages impersonating UPS. It explains fake tracking links, small-fee requests, safe verification, reporting options, and what to do if you already interacted with a message.
Quick Takeaways
- Do not assume an unexpected delivery text is genuine simply because you are waiting for a package.
- Avoid using an unsolicited message’s tracking or payment link. Open the retailer or carrier’s official app or website independently.
- USPS says it will not send customers unsolicited text messages or emails containing a link about a package; USPS tracking texts are associated with customer requests for tracking notifications.
- UPS offers legitimate SMS and other delivery notifications, so the existence of a delivery text alone does not establish whether it is genuine. Verify unexpected messages independently.
- Treat requests for a small “redelivery,” “address correction,” or similar fee cautiously, especially when the link leads to an unfamiliar domain.
- If you clicked a link but did not provide information or download anything, that does not automatically mean your device has been compromised.
- If you provided card or banking information, contact the financial institution using the number on your card, statement, official app, or independently verified website.
- Report appropriate suspicious texts through your messaging/carrier tools, the FTC, and carrier-specific channels such as the U.S. Postal Inspection Service when USPS is impersonated.
What Is a USPS Text Scam?
A USPS text scam is a message that falsely claims to represent the United States Postal Service.
A common version claims a package cannot be delivered because of an incomplete or incorrect address. The recipient is asked to follow a link to “update” delivery details.
Other variations may refer to:
- A package being held
- A failed delivery attempt
- An incomplete ZIP Code
- Missing address information
- A delivery scheduling problem
- A required redelivery payment
- A customs or processing charge
- A final notice before a package is returned
These themes are not evidence that a particular text is fraudulent. Legitimate delivery situations can involve delays or address problems.
The safer distinction is how you verify the claim.
If a text says USPS cannot deliver a package, leave the text alone and independently visit USPS.com or use an official USPS service. If it supposedly concerns UPS, independently use UPS.com or the official UPS app.
If you purchased something from a retailer, another useful approach is to open the retailer’s app or website and view the order there.
What Does “Smishing USPS” Mean?
Smishing combines “SMS” and “phishing.” It generally describes phishing carried out through text messages.
The sender’s goal may be to persuade the recipient to provide:
- Contact information
- A home address
- Account credentials
- Card information
- Other personal details
A message could also direct someone toward an unwanted download or another deceptive interaction.
The defensive principle is the same regardless of the sender’s precise objective: do not let an unexpected text choose the website where you enter sensitive information.
How a Package Delivery Scam Typically Works
A delivery-themed smishing attempt often follows a simple sequence.
First, an unexpected text introduces a minor but urgent problem: your parcel cannot be delivered.
Next, it offers an easy solution: open a provided link and confirm your address.
The website reached through that link may imitate a delivery page and request information. In some versions, it asks for a relatively small payment described as a redelivery, service, or processing fee.
Why delivery themes can be convincing
You do not have to be a frequent online shopper to be expecting a package. People receive online purchases, prescriptions, gifts, replacement cards, work equipment, subscriptions, and household supplies.
A broad batch of delivery messages will therefore reach some people who genuinely have packages in transit.
That timing can be coincidental.
Do not assume a sender has access to a carrier or retailer’s systems simply because its message arrived while you were expecting something.
Suspicious vs. Safer Verification
| Situation | Potential concern | Safer action |
|---|---|---|
| Unexpected text says address is wrong | Link requests immediate action | Open the carrier’s site/app yourself |
| Message requests a small redelivery fee | Payment request comes through unknown link | Verify shipment independently |
| You are genuinely waiting for a package | Timing makes the message believable | Check your real order history |
| Text contains a tracking number | Number alone does not establish sender identity | Enter a known tracking number at the carrier’s official site |
| Message says “final attempt” | Artificial urgency may pressure you | Check actual tracking status independently |
| Sender name displays “USPS” or “UPS” | Sender labels are not sufficient proof | Use official carrier channels |
| Link uses HTTPS | HTTPS protects a connection, not the site’s identity | Verify the domain |
| Text asks for card details | Sensitive information is being requested | Leave the text and verify separately |
No single line of this table is an absolute authenticity test. Independent verification remains the safest method.
USPS Texts: What the Postal Service Says
USPS does provide text tracking functionality. That distinction is important because saying “USPS never sends text messages” would be inaccurate.
According to the U.S. Postal Inspection Service, however, USPS will not send unsolicited text messages or emails about a package with a link. USPS tracking-related texts occur when a customer has requested that service.
If you receive an unexpected message supposedly from USPS that includes a link, do not use that link to determine whether it is legitimate.
Instead, visit:
Type the address yourself or use a bookmark you already trust.
If you have a legitimate USPS tracking number from a merchant, receipt, or prior transaction, enter it at USPS.com.
UPS Delivery Texts: Legitimate Notifications Exist
UPS offers legitimate delivery notifications, including supported SMS services. For that reason, the fact that a text mentions UPS, a parcel, or a delivery status is not enough to classify it by itself.
If a UPS message is unexpected or asks for information or payment, verify it without following its link.
Open the official UPS application if you already use it, or independently navigate to:
If your shipment came from a retailer, you can also check the retailer’s order page for the tracking information.
UPS publishes fraud-awareness information explaining how to recognize and respond to communications impersonating the company.
Red Flag #1: A Fake Tracking Link
A fake tracking link is designed to look relevant to shipping but leads somewhere other than the carrier’s expected service.
Do not judge the link by whether it contains words like:
“usps”
“ups”
“parcel”
“tracking”
“delivery”
“support”
A website can put brand-related words in many parts of an address.
You do not need to investigate the link
A common mistake is trying to determine where a suspicious link goes by opening it.
There is usually no reason to.
If you want to know where a package is, retrieve the tracking number from the original retailer, shipment email you already trust, purchase history, paper receipt, or official carrier service.
Then open the carrier directly.
This approach answers the practical question—“Where is my package?”—without requiring you to prove whether the text is fake.
Red Flag #2: The “Pay a Small Fee” Scam
Some package delivery scams request a small payment, perhaps framed as redelivery, address correction, postage, or processing.
The amount may appear trivial compared with the value of the package.
The dollar amount should not be the basis for deciding whether the request is safe.
A payment form can request valuable information even when the amount displayed is small. If an unexpected delivery text requests payment, leave the message and verify the underlying shipment through the real carrier or merchant.
If a legitimate charge exists, you should use the carrier or merchant’s independently verified payment process rather than the text’s link.
Red Flag #3: Urgency and “Final Notice” Language
Delivery scams may imply that you have only a short time to act.
For example, a message might say the package will be returned immediately if you do not update your address.
Urgency is not proof of fraud. Genuine services sometimes have deadlines.
The key is that a legitimate deadline can still be checked through a legitimate channel.
Do not let a countdown or “final attempt” message prevent you from opening the carrier’s actual website and checking the status yourself.
Red Flag #4: Requests for Unnecessary Information
Be cautious if a delivery page reached through an unexpected text asks for information unrelated to ordinary package tracking.
That could include account passwords, Social Security numbers, one-time authentication codes, or extensive identity information.
Do not provide a password or one-time authentication code to someone who unexpectedly contacts you about a delivery.
If you are unsure what information a carrier legitimately requires for a particular service, consult that carrier’s official website.
Red Flag #5: An Unfamiliar Web Address
A site’s design does not establish who owns it.
Someone can create a webpage that visually resembles a shipping site. The browser’s address bar provides more useful information than a logo inside the page.
HTTPS is important because it encrypts web traffic to the site. But a fraudulent site can obtain HTTPS too.
In other words:
HTTPS does not mean “this is definitely USPS” or “this is definitely UPS.”
It means the connection to that particular website is encrypted.
For a carrier service, reach the known carrier domain yourself rather than relying on a domain contained in an unexpected text.
What to Do When You Receive a Suspicious Delivery Text
If you have not interacted with the text, handling it is straightforward.
Step 1: Do not open the supplied link
You do not need to click to confirm whether the message is suspicious.
Avoid replying as well. There is generally no benefit to arguing with the sender or asking it to prove its identity.
Step 2: Check whether you are expecting a package
Open the online store or service from which you purchased something.
Use its official app, a saved bookmark, or a website address you independently know.
Review your order history.
Step 3: Find the legitimate tracking number
Use tracking information from the retailer, receipt, official account, or another source you already trust.
Do not automatically copy a tracking number out of a suspicious message and assume that it corresponds to your shipment.
Step 4: Open the carrier independently
For USPS, type USPS.com yourself.
For UPS, type UPS.com yourself.
The same principle applies to FedEx and other carriers: navigate to the carrier’s known site or official application.
Step 5: Check the actual shipment status
Enter the trusted tracking number or view shipments in your established account.
If the carrier actually needs something from you, follow the instructions shown through the official service.
Step 6: Report the suspicious message
Use your phone’s built-in spam or junk reporting option where available.
USPS-related impersonation can also be reported according to U.S. Postal Inspection Service instructions.
The FTC accepts fraud reports at:
Step 7: Block the sender if appropriate
Once you have saved anything you need for a report, block the number or sender using your phone’s normal controls.
Blocking one sender will not prevent every future scam because senders can use different numbers or accounts, but it can stop further messages from that specific source.
How to Block the Sender on iPhone
Apple periodically changes the Messages interface, but the general process is:
- Open the conversation in Messages without opening suspicious links.
- Open the sender’s information or conversation details.
- Look for the option to block the caller or contact.
- Confirm the block.
Apple also offers message filtering and junk-reporting features depending on the message and your configuration.
Search iPhone Settings for “Messages,” “Unknown Senders,” or related spam-filtering options if the menus have changed.
Blocking a sender does not undo information you may already have provided. If you submitted sensitive information, follow the additional steps later in this guide.
How to Block the Sender on Android
Android interfaces vary among Google Pixel, Samsung Galaxy, and other devices.
In your Messages application:
- Open the conversation.
- Open the conversation menu or sender details.
- Select the available Block, Report spam, or equivalent option.
- Confirm when prompted.
Google Messages and many manufacturer messaging apps include spam-protection features. Search your Messages settings for “Spam protection” or similar wording.
Your wireless carrier may also provide spam-reporting or filtering options.
How to Report a USPS Text Scam
The U.S. Postal Inspection Service publishes specific information for reporting USPS smishing.
Current reporting instructions are available through:
Follow the current instructions on the official .gov site, since reporting procedures can change.
When appropriate, retain the original message and relevant sender information until you have completed the reporting process.
Do not continue interacting with the sender to collect more information.
How to Report Suspicious UPS Messages
UPS maintains fraud-awareness and reporting information on its official website.
Navigate independently to UPS.com and search for “fraud” or “fraud awareness” rather than using a link contained in the suspicious message.
If you have an actual shipment with a delivery problem, use UPS’s official tracking and customer-support channels.
Do not use a customer-service phone number provided by a questionable text.
Reporting Spam Texts to Your Carrier
In the United States, many wireless carriers support spam reporting by forwarding a suspicious text to 7726, which spells SPAM on a phone keypad.
The FTC also describes 7726 as an option for forwarding unwanted text messages to participating wireless providers.
Your carrier or messaging app may provide a more direct “Report spam” feature.
Do not expect reporting to make all unwanted messages disappear immediately. Filtering systems reduce unwanted traffic but cannot guarantee that every future smishing message will be blocked.
Report Fraud to the FTC
The Federal Trade Commission accepts reports about scams and fraud at:
Reporting can provide the FTC and enforcement partners with information about fraud patterns.
Reporting a scam is different from securing a compromised account or disputing a card transaction. If you provided sensitive information, complete the relevant recovery steps separately.
What If You Clicked the Fake Tracking Link?
Clicking a suspicious link does not automatically establish that your phone has malware or that your accounts have been compromised.
What happened after the click matters.
If you opened the page but did not enter information, download a file, install anything, or approve permissions:
- Close the page.
- Do not reopen it simply to investigate.
- Update your browser and phone if updates are available.
- Check whether you granted the website notification or other permissions.
- Remove any permissions you did not intend to grant.
- Delete the message after reporting it as appropriate.
Modern iPhones and Android devices include significant application isolation and security protections, but no device should be treated as invulnerable. Keep the operating system current.
If you have a specific reason to suspect malicious software was installed, use official device security/support resources.
What If You Entered Your Address or Personal Information?
The appropriate response depends on the information involved.
Providing a name or mailing address is different from providing an account password, Social Security number, or financial details.
Be especially cautious about follow-up communications. Information submitted to a suspicious site may potentially be used to make later messages appear more personalized.
Do not assume every future message mentioning your address is genuine simply because it knows that information.
If highly sensitive identity information was provided and you are concerned about identity theft, the FTC’s official IdentityTheft.gov site offers US recovery guidance.
This article provides general cybersecurity information, not legal or financial advice.
What If You Entered a Password?
If a suspicious delivery page asked you to sign in and you supplied a password, treat that password as potentially exposed.
From a device you trust:
- Open the legitimate service directly.
- Change the affected password.
- Change it anywhere else you reused the same password.
- Review recent account activity and signed-in devices.
- Sign out unfamiliar sessions when the service provides that option.
- Verify account-recovery details.
- Enable available multifactor authentication or a passkey where appropriate.
If the password was for your primary email account, prioritize it. Access to email can be particularly important because many other services use email for account recovery.
Two-factor authentication reduces account-takeover risk but is not perfect. Do not share one-time verification codes or approve sign-in attempts you did not initiate.
What If You Entered Credit or Debit Card Details?
If you submitted payment-card information through a suspicious delivery page, browser cleanup alone is not sufficient.
Contact the card issuer using a trusted channel: the phone number printed on your physical card or statement, the official banking application, or a website you independently verify.
Explain what happened and follow the issuer’s fraud procedures.
Monitor the account through your legitimate banking service.
Do not call a “fraud department” number displayed by the suspicious delivery page.
Financial institutions have their own procedures for card replacement, disputes, and account monitoring. Follow the institution’s instructions for your circumstances rather than relying on generic internet advice.
What If You Entered Bank Account Information?
Contact the financial institution directly through its official app, known website, statement, or independently verified phone number.
Tell the institution what information was provided and follow its recommended security steps.
Do not continue interacting with the sender in an attempt to recover money or information.
If money was already sent or an unfamiliar transaction appears, contact the relevant institution promptly. Recovery is not guaranteed, but the financial institution is the appropriate source for transaction-specific assistance.
What If You Downloaded an App or File?
An ordinary delivery-tracking webpage generally does not need you to install an unfamiliar application, configuration profile, browser extension, or desktop program merely to see a package status.
If a suspicious page persuaded you to download something, do not open the file if you have not already done so.
Windows
If an unverified file downloaded but was never opened, delete it. If you ran unfamiliar software, review installed applications and use Windows Security/Microsoft Defender or another reputable security product you already trust for an appropriate scan.
Keep Windows updated.
Mac
If you downloaded an unfamiliar file but did not open it, delete it if you cannot verify the source.
If you installed something, review Applications and relevant Privacy & Security permissions. Keep macOS updated so built-in protections such as XProtect and Gatekeeper receive applicable security updates.
Android
Review recently installed applications and remove apps you determine are unwanted using Android’s standard app controls. Keep Google Play Protect and Android security updates operating where supported.
Do not install a “cleanup” application suggested by the suspicious webpage itself.
iPhone and iPad
Keep iOS/iPadOS current. Review recently installed apps and, if relevant, search Settings for VPN or Device Management and check configurations you intentionally use.
A workplace or school may legitimately install management profiles. Do not remove managed configurations without consulting the organization.
If an unfamiliar profile appears on your personally owned device and you do not know why, Apple Support can help you evaluate it.
What About a Message That Knows My Name or Address?
Correct personal information does not authenticate a sender.
Names, phone numbers, addresses, and other details can exist in public directories, marketing databases, social media, prior transactions, and other sources.
Do not assume that a delivery text is connected to a specific data breach merely because it knows something about you. Without reliable evidence, that conclusion would be speculative.
Instead, evaluate what the message wants you to do and verify the delivery through an independent channel.
Does a Real Tracking Number Prove the Text Is Genuine?
No.
Tracking information can sometimes be public, reused, mistyped, or otherwise unrelated to the authenticity of the sender.
The more useful question is whether the tracking number associated with your actual order—obtained from a source you already trust—shows the claimed problem on the carrier’s official site.
If it does, handle the issue there.
If it does not, there is no reason to resolve the discrepancy through the unexpected text.
Can the Sender Fake the Phone Number?
Phone and messaging systems do not always provide perfect identity verification to the recipient.
Do not rely solely on the number, sender label, or conversation grouping as proof.
Even if a message appears in a familiar context, independently verify sensitive requests.
The same general principle applies to email display names and incoming caller ID.
Protect Yourself From Future Package Delivery Scams
You cannot prevent every scammer from sending a text, but a few habits reduce how much any one message matters.
Use retailer and carrier apps or bookmarks for tracking rather than searching for shipping links each time.
Enable legitimate delivery notifications directly through the carrier’s official website or app if you find them useful. That can make your expected notification process more familiar.
Use unique passwords for shopping, email, and shipping accounts. A reputable password manager can help.
Enable MFA or supported passkeys on important accounts. Strong authentication reduces the impact of password theft, though no method eliminates all social-engineering risk.
Keep iOS, Android, browsers, and apps updated.
Use your phone and carrier’s spam-filtering options, understanding that legitimate messages can occasionally be filtered and unwanted messages can still get through.
Most importantly, make independent verification a habit. A text can remind you to check a shipment, but it does not have to provide the link you use to check it.
Common Mistakes to Avoid
Do not assume a message is legitimate simply because you are expecting a delivery. High-volume package shipping makes coincidental timing common.
Avoid clicking a fake tracking link merely to investigate it. Open the carrier independently instead.
Do not assume a tiny requested fee is harmless. Verify any payment request through the official carrier or retailer.
Avoid trusting a sender name, logo, tracking number, HTTPS connection, or polished website on its own.
Do not reply to the suspicious sender to ask whether it is really USPS or UPS. That keeps verification within the same untrusted conversation.
Never provide an unexpected caller or sender with a password or one-time authentication code.
Do not install an unfamiliar “tracking app” or “security tool” from an unsolicited text.
Finally, do not assume a click by itself means your phone has been hacked. Focus on what occurred after the click and take proportional defensive steps.
FAQ
How can I tell if a USPS text message is a scam?
USPS and the U.S. Postal Inspection Service advise that USPS does not send unsolicited text messages containing links about packages. USPS does offer tracking texts when customers request tracking notifications.
If an unexpected text includes a USPS link, do not use it. Independently visit USPS.com and check your real tracking information.
Does USPS send text messages about packages?
Yes, USPS provides tracking text services that users can request.
That is different from an unsolicited message unexpectedly arriving with a link and demanding that you correct an address or provide information. Check current USPS and USPIS guidance for details.
Does UPS send text messages?
UPS offers legitimate delivery notifications, including SMS services.
Because legitimate UPS texts exist, do not classify a message based only on the fact that it is a text. Independently use UPS.com, the official app, or your retailer’s order history when a message is unexpected.
What is the small redelivery fee scam?
Some delivery-themed phishing pages request a small payment described as a redelivery or processing charge.
The amount being small does not make the request safe. Do not enter card information through an unexpected text link. Verify any legitimate charge through the carrier’s official service.
What should I do if I clicked a USPS scam link?
If you only opened the page and entered nothing, close it, update your device, and check for unintended downloads or permissions.
If you submitted a password, payment information, or other sensitive data, take the corresponding account or financial recovery steps.
Clicking alone does not prove that the device was compromised.
Can I safely copy the tracking number from the text?
A better choice is to obtain the tracking number from the retailer, purchase receipt, order history, or another independently trusted source.
Then enter that number at the carrier’s official website.
How do I report a USPS text scam?
Use the U.S. Postal Inspection Service’s current smishing-reporting instructions at USPIS.gov. You can also use your phone or carrier’s spam-reporting tools and report fraud to the FTC at ReportFraud.ftc.gov.
Should I block the sender?
Yes, blocking an unwanted sender is generally reasonable after you have retained what you need for any report.
Blocking one number does not prevent messages from different numbers, so continue treating unexpected delivery texts cautiously.
Should I cancel my credit card after clicking a fake tracking link?
Clicking a link alone does not normally require canceling a card you never entered or otherwise exposed.
If you submitted card information to a suspicious site, contact the card issuer through a trusted channel and follow its instructions for your particular account.
Can package scams arrive through email or social media too?
Yes. Delivery-themed phishing can arrive through email, SMS, social media, messaging applications, or QR codes.
Use the same rule: obtain your tracking information independently and use the carrier’s official site or app.
When to Get Extra Help
If the issue involves an actual USPS shipment, use USPS.com or official USPS customer-service channels. For suspicious messages impersonating USPS, the U.S. Postal Inspection Service provides fraud-reporting information.
For UPS shipments or suspected UPS impersonation, navigate independently to UPS.com and use the company’s official tracking, support, or fraud-awareness resources.
If you provided card or bank information, contact your financial institution through the number printed on your card or statement, its official application, or an independently verified website. If an unfamiliar transaction appears, follow the institution’s fraud-reporting process.
If you believe an online account may have been accessed, use that provider’s official account-recovery and security tools. A work or school account should also be reported to the organization’s IT or security team.
For suspected identity theft in the United States, the Federal Trade Commission’s IdentityTheft.gov offers official recovery guidance. This article provides general cybersecurity information and is not legal or financial advice.
If the situation includes credible threats, extortion, theft, or potentially criminal activity, consider contacting the appropriate local or federal authorities.
Conclusion: The Safe Way to Handle Delivery Texts
Package delivery scams are easier to manage when you do not make the text itself responsible for proving whether a shipment problem is real.
Remember the basic checklist: do not open unexpected tracking or payment links; retrieve your tracking number from a source you already trust; open USPS.com, UPS.com, or the relevant carrier directly; verify payment requests independently; report suspicious messages; and block the sender when appropriate.
If you already interacted with a suspicious text, respond according to what happened. Opening a page is different from submitting a password, installing software, or providing card details.
The central habit is simple: when a message says your package needs attention, check the package—but use a trusted route that you chose yourself.