Package Delivery Text Scams (USPS, UPS, FedEx)

How the scam works

Scammers send delivery texts by the million. The message says a package could not be delivered: the address is incomplete, postage is short, nobody was home, or the parcel is "held" pending a small fee. Since late 2025 the FCC has also flagged a tariff variant, where the text claims your order is stuck in customs until you pay import duties. Every version carries a link, usually a shortened or look-alike address. The FCC's sample UPS text points to a domain that reads like a tracking site but is nothing of the sort.

Tap the link and you land on a convincing copy of a USPS, UPS or FedEx page. It asks you to confirm your address and pay a redelivery or customs charge, often a dollar or two. The fee is not the point. The card number, name, address and sometimes date of birth or account login you type in are the point, and the FTC notes that everything you enter goes straight to the scammer along with the payment. Some pages push a fake "tracking app" that is malware.

The trick works because most of us have something on the way most of the time, so the message lands at a plausible moment. The scale is real: the FTC reported that consumers lost roughly $470 million to scams that began with a text in 2024, and fake package delivery was the most commonly reported text scam of the year.

Red flags

What to do in the moment

What to do if you already clicked or paid

You entered a card number. Call the number on the back of the card, report it as compromised and ask for a replacement. Watch for small test charges over the next few weeks; scammers often verify a stolen card with a tiny purchase before selling it. Dispute anything you do not recognise.

You typed a login. Change that password right away and everywhere you reused it, then turn on two-factor authentication. If it was your email or Amazon login, check for forwarding rules or new addresses the scammer may have added.

You gave a Social Security number or date of birth. Place a free credit freeze with Equifax, Experian and TransUnion, and file a recovery plan at IdentityTheft.gov. A freeze costs nothing and stops new accounts being opened in your name.

You installed something. Delete the app, run a security scan, and if the phone behaves oddly, back up your photos and reset it to factory settings. Change your passwords from a different device.

Whatever you lost, report it to ReportFraud.ftc.gov and to the FBI at ic3.gov. Your report will not always recover money, but it feeds the takedowns that shut down the sending networks and it helps your bank flag the next victim faster.

Defense first: set your phone up once

Both major phone platforms can filter texts from unknown senders into a separate list and flag likely spam. Turn that on for yourself and for older relatives, who receive the same flood without the habit of ignoring it. Then agree on one rule for the whole family: a delivery problem is only real if it shows up in the retailer's account or the carrier's app. If a relative calls you worried about a held package, walk them through opening the app rather than the text. Five minutes of setup removes most of these messages before anyone has to judge them.