Don’t Fall for the Fake USPS Delivery Text: How Smishing Scams Target Your Wallet

You check your phone during a coffee break and see a text message from what looks like the United States Postal Service. It says a package couldn’t be delivered because of an incomplete address, and you need to click a link to reschedule delivery within 24 hours or face a return-to-sender fee. The link looks official, maybe with “USPS” in the URL, but something feels off. That feeling is your best defense. This is a classic smishing attack—a text-message version of phishing—and it’s hitting millions of middle-class Americans right now.

Smishing, a combination of “SMS” and “phishing,” works exactly like those fake emails you’ve been warned about, but it lands in a text message, where you’re more likely to trust it because texts feel more personal and less formal. The scammer’s goal is simple: trick you into clicking a link that either installs malware on your phone or takes you to a fake website designed to steal your credit card number, Social Security number, or bank login. In the case of the fake USPS text, they often demand a “small redelivery fee” of a few dollars, which you’d pay via a phony payment page. Once you enter your card details, they drain your account or use the information for identity theft.

Why are these scams so effective for people in their forties, fifties, and sixties? Because many of you order packages online—from Amazon, home improvement stores, or gifts for grandkids—and you’re used to tracking deliveries. You expect notifications. The scammers know this. They also know that older adults are less likely to report a suspicious text or to understand that legitimate delivery services will never ask for payment via a random text link. According to the Federal Trade Commission, Americans lost over $330 million to text-based scams in 2022, and the numbers have only grown since then.

Here’s how to spot a fake USPS smishing message before you lose money. First, look at the sender phone number. Legitimate USPS notifications come from short codes or official numbers like 28777 or 243725, not random ten-digit phone numbers, especially ones with area codes you don’t recognize. Second, check the greeting. Real delivery services use your address or a tracking number, not generic phrases like “Dear Customer.” Third, examine the link. Scammers create fake domains that look close to the real thing: usps-redelivery.com instead of usps.com or something with a .top, .xyz, or .click extension. If the link doesn’t start with “https://www.usps.com/” exactly, it’s a trap. Fourth, notice the urgency. Any message that threatens fees, return-to-sender, or service termination if you don’t act immediately is pressure tactic designed to shut down your critical thinking.

If you receive such a text, do not click the link. Not even to “see what happens.” Clicking can launch a website that silently downloads spyware onto your phone, or it can confirm to scammers that your number is active, leading to more smishing attempts. Instead, delete the message, block the sender, and report it to the USPS using their official phishing reporting page at usps.com or forward the text to 7726 (which spells SPAM) on most carriers. If you already clicked the link but didn’t enter any information, run a security scan on your phone using a trusted app, change your important passwords, and monitor your accounts for unusual activity. If you did enter personal or financial information, act fast: contact your bank or credit card provider to freeze the card, place a fraud alert on your credit reports, and file a report with the FTC at ReportFraud.ftc.gov.

Don’t assume you’re too savvy to fall for this. Smishing attacks are becoming more sophisticated every month. Scammers now use “spoofing” technology to make the text appear in the same conversation thread as a real USPS tracking update you received earlier. They also harvest your name and address from data breaches to make the message feel personally tailored. The best defense is a simple rule: never give out sensitive information in response to an unsolicited text, no matter how official it looks. If you’re expecting a package, go directly to the USPS website or use the app you already have. Don’t use the link in the text.

Remember that the USPS, FedEx, UPS, and Amazon will never text you asking for money or personal details. If there’s a real problem with a delivery, they’ll leave a physical notice on your door or ask you to log into your account directly. That’s it. Smishing is a low-effort, high-reward crime because scammers cast a wide net, and even one person paying a fake “redelivery fee” makes it worth their while. Protect yourself and your family by staying skeptical. That text message isn’t from the post office—it’s from someone trying to empty your bank account.