USPS Text Scam: Fake ‘Undeliverable Package’ Messages Explained

It arrived on a Tuesday night while Marcus was half-watching TV: “USPS: Your package could not be delivered due to an incomplete address. Please update your details within 24 hours to avoid return: usps-redelivery-verify[dot]xyz.” He was, in fact, waiting on a package — a birthday gift he’d ordered the week before. So he tapped. The page that opened looked exactly like USPS tracking, right down to the eagle logo. It asked for his address, then for a $1.99 “redelivery fee” on a card. He typed in his debit card number. The package never existed. The fee was never the point — his card number was, and within two days there were three charges he didn’t recognize. He had just walked into the usps text scam, one of the most reported frauds in the country.

If that story feels familiar, you’re not alone. The usps text scam is one of the most widespread frauds in the country right now: fake delivery texts, sent by the millions, designed so that anyone who happens to be waiting on a real package — which, on any given day, is a lot of us — finds the message plausible. It is a volume game. The scammers blast random numbers knowing that sheer probability will do their targeting for them.

The FTC’s April 2025 consumer alert put the scale in plain numbers: Americans lost roughly $470 million to package-delivery smishing texts in 2024 alone, up nearly $100 million from the year before — and those are just the reported losses. Most victims never file anything. This article breaks down exactly how the scam works, the one rule that settles every suspicious delivery text, and what to do if you already tapped the link.

The short answer: A text claiming a USPS package problem with a link to click is almost certainly a scam. USPS only texts you if you first requested tracking updates for a specific package — and even those texts never contain a link. Don’t tap it, don’t reply, forward it to 7726, and report it to the U.S. Postal Inspection Service.

The Red Flags That Give It Away in Seconds

• A link in the message. This is the single biggest tell. The U.S. Postal Inspection Service states plainly that a genuine USPS tracking text never contains a link. Full stop. If there’s a link, it fails the test — no matter how real the rest looks.
• You never signed up for tracking texts. USPS will not text or email you about a package unless you first requested the service with a tracking number. An out-of-the-blue “delivery failed” message about a package you never gave USPS your number for is fake by definition.
• The sender looks wrong. These come from random long numbers, unfamiliar short codes, or even email addresses — not from USPS’s own channels. Sender IDs can be spoofed, but most of these don’t even bother trying.
• Manufactured urgency. “Update within 24 hours or your package will be returned.” Real carriers don’t hold your parcel hostage on a one-day countdown delivered by text. The deadline exists to stop you from thinking.
• A small fee. $1.99. $2.45. Just enough to feel harmless. Nobody guards a two-dollar payment the way they’d guard their life savings — and that’s exactly why the fee is the hook. What the scammer collects is your card number, name, address, and phone number, which are worth far more than $1.99.
• The link isn’t usps.com. It might be usps-delivery-track[dot]top, usps-parcel[dot]xyz, or a shortened URL that hides everything. Look closely: extra words, odd endings, hyphens doing heavy lifting. The real site is just usps.com.
• Vague details. No tracking number from a store you ordered from, no item name, no sender. A real tracking alert you signed up for references your actual tracking number. The fake ones stay vague because they’re sent to millions of strangers at once.

One important nuance, because getting this wrong cuts both ways: USPS does send some legitimate texts — but only when you initiated them, and never with links. Knowing the real rule (initiated-by-you + no link) is better than the popular myth (“USPS never texts”), because the myth makes you distrust real alerts and gives you no defense when a fake one arrives right after a real one.

How the usps text scam Works, Message by Message

The operation is industrial in scale and depressingly simple:

Step 1: The blast. Automated systems fire millions of texts to randomly generated or purchased phone numbers. The wording rotates every few weeks — “package held at warehouse,” “delivery attempt failed,” “address incomplete,” “redelivery fee required” — but the shape never changes: your package is stuck, something is wrong, a link fixes it, hurry.

Step 2: The fake tracking page. The link opens a site dressed up like USPS tracking, sometimes startlingly well made — the logo, the colors, the tracking-number format. It asks you to “confirm” your address first. This is harvest step one: your name, address, and phone number go into a database sold to other criminals.

Step 3: The fee. Then comes the payment page: a small redelivery or customs fee, payable by card. This is harvest step two and the real prize. Your card number, expiry, and CVV go straight to the operators — and often get tested with small charges within hours, then sold or used for bigger fraud.

Step 4: The afterlife of your data. People who paid are marked as “responsive” and the number gets recycled: more scam texts, fake bank alerts, other smishing campaigns. People who only entered an address get added to lead lists. Nobody wins except the scammers.

Why does it keep working when everyone has heard of it? Because it doesn’t need you to be gullible — it needs you to be busy, distracted, and expecting a package. Online shopping has made “package arriving soon” the default state of millions of households. The scam doesn’t beat your intelligence. It beats your timing.

Why So Many Smart People Fall for It

It’s worth being honest about the psychology, because blame doesn’t prevent anything but understanding does. The text exploits a perfect storm: it’s short, it arrives on the device you trust most, it references something real in your life (that order from last week), and the ask is trivially small. Each step feels harmless on its own — check the link, fix the address, pay two dollars. Nobody would hand a stranger their wallet; plenty of people will hand a familiar-looking website their card for the price of a coffee.

There’s also the authority of the brand. USPS is a federal institution, older than the country itself. When its name and logo appear on your phone, skepticism feels almost unpatriotic. The scammers know this, which is why USPS is the most imitated sender in the country — with FedEx, DHL, and UPS variants running the same playbook behind it.

How to Verify a Real USPS Text

When a delivery text arrives and you’re genuinely unsure, run this check before you touch the link:

1. Ask: did I request this? Did you sign up for USPS tracking updates on a specific package with a tracking number? If not, stop here — it’s a scam.
2. Ask: does it contain a link? A genuine USPS tracking text never contains a link. If there’s a link, it’s a scam — even if you did sign up for tracking.
3. Check the sender. Real USPS messages come through channels tied to your request, not random long numbers or email addresses you’ve never seen.
4. Verify independently. Open your browser, type usps.com yourself (or open the official USPS app), and enter the tracking number from your order confirmation email — the one from the store, not from the text. If USPS has your package, it’ll show up there.
5. Look up the order at the source. Check the retailer’s site or your order email for the real tracking status. The store knows where your package is; the text doesn’t have to.

What to Do If You Clicked or Paid

Don’t panic, and don’t wait to see if anything happens. Move through these in order:

• If you only clicked the link but entered nothing: close the page, delete the text, and run a security scan on your phone. Clicking alone rarely installs anything — the danger starts when you type or download.
• If you entered personal details (name, address, phone): expect more scam attempts and be extra skeptical of unexpected calls and texts for the next few months. Consider it a warning, not a disaster.
• If you entered card details: call your bank or card issuer immediately and report the card as compromised. Ask for a new card number. Check recent statements for charges you don’t recognize — scammers often test with tiny amounts first.
• If you entered banking login credentials: change the password from a clean device, enable two-factor authentication, and alert your bank to watch for unauthorized logins or transfers.
• If you downloaded anything the page offered (an “app” or “profile”): don’t install it — and if you already did, uninstall it and have the device checked for malware.

Then report it, which brings us to the part most people skip — and shouldn’t.

How to Report It: The 3-Minute Walkthrough

Reporting feels like paperwork, but it’s the reason these operations eventually get shut down — investigators build cases from complaint volume. Here’s the whole thing, in order:

1. Minute 1 — forward to 7726. On your phone, forward the scam text to 7726 (which spells SPAM). Your carrier uses these reports to identify and block the sender’s number. This takes fifteen seconds and protects the next person who’d get the same blast.
2. Minute 2 — report to the Postal Inspection Service. Go to uspis.gov and file a report through their mail fraud reporting page. Include the sender’s number, the message text, and the fake link if you still have it. You can also call 1-877-876-2455.
3. Minute 3 — file with the FTC and FBI. Report the smishing attempt at ReportFraud.ftc.gov — the FTC feeds reports into its Consumer Sentinel database used by over 2,000 law enforcement agencies. If you lost money or entered financial details, also file at ic3.gov, the FBI’s Internet Crime Complaint Center.
4. Bonus — delete and block. Delete the text, block the sender, and mark it as junk if your phone offers the option. Marking as junk trains your phone’s spam filter for the next wave.

Sources

1. U.S. Postal Inspection Service — https://www.uspis.gov
2. ScamDrill, “USPS Text Scam: Examples, Red Flags & What to Do” (updated October 2026) — https://scamdrill.com/blog/usps-text-scam-smishing-guide
3. Shieldr, “USPS Package Text Scam: How to Tell If a Delivery Text Is Fake” (September 2026) — https://tryshieldr.app/usps-package-text-scam
4. FTC, ReportFraud.ftc.gov — https://reportfraud.ftc.gov
5. FBI Internet Crime Complaint Center — https://www.ic3.gov

Last reviewed: October 2026

This article is for education only and is not financial or legal advice.

---

Originally published at warnscams.com

Comments

[cryptostrapon]

One step that makes the newer kits worse than plain card theft: after the fee page, many ask for the code your bank just texted. That code is not a payment check, it lets them add your card to a phone wallet they control, so charges keep coming after you notice. If a bank text ever mentions adding your card to Apple Pay or Google Pay and it was not you, call the bank and freeze the card right away.