Don’t Let a Fake Package Text Cost You Real Money

That text message saying your package is stuck at a sorting center and needs a two-dollar redelivery fee may look harmless. It isn’t. It is a smishing attack, a text message designed to steal personal information or money. This delivery notification scam works because it preys on the expectation of online orders and the habit of acting quickly.

The scenario is familiar. You are waiting for a delivery from a well-known company, and a text arrives from something like “USPS” or “FedEx.“ It says your package cannot be delivered because the address is incomplete or because a small fee remains unpaid. You are asked to click a link, enter your zip code, and pay a small fee, usually less than five dollars, to reschedule. The message is urgent: the package will be returned to sender within 24 hours if you do not act. That urgency is the hook. Once you click, the trouble begins.

The link does not go to the real carrier’s website. It goes to a convincing look-alike page, often with the carrier’s logo and a form asking for your name, address, phone number, credit card number, expiration date, and security code. In some versions, the fake page asks for your email password to “confirm your identity.“ Everything you type is captured. If you enter a credit card number, you may see a small charge go through, but the real theft comes later when the card is used for larger purchases or sold on the dark web.

There are variations. One common offshoot claims you owe a toll bill, like E-ZPass, and includes a link to pay it. Another says you have a voicemail or missed package and asks you to download an “invoice” or “label” file. That file is malware, often capable of stealing passwords from your phone. The package delivery text is just bait. The real payload is access to your identity.

How do you spot the difference? The first clue is the number the text comes from. Real carriers rarely send unsolicited package updates from random 10-digit mobile numbers. They send notifications from shortcodes or official branded numbers tied to your account, and only after you have opted in. If you did not sign up for text updates, any text about a package is suspect. The second clue is the link. Hover over it without clicking, or press and hold on your phone to preview the URL. A real carrier will not use a jumbled link with random letters and numbers, nor will it ask you to pay on a domain like “usps-trackers.com” or “fedex-delivery-fee.top.“ Look for typos, unusual spacing, and language that sounds slightly off. Scammers are getting better, but they still make mistakes, especially with urgency.

If you believe a package is actually delayed, do not click the link. Go to the carrier’s official website or app by typing the address yourself. Check tracking with the real tracking number from your order confirmation. If there is truly a fee or issue, it will appear inside your official account, not in a random text. If the text is fake, do not reply “stop” or any other word, because that confirms to scammers that your number is active. Instead, delete the message. On an iPhone, delete the conversation and report it as junk. On Android, long-press and choose report spam or block. You can also forward the phishing text to 7726 (SPAM), which many carriers use to investigate and shut down malicious numbers.

The package delivery smishing scam is not going away, because it continues to work. Scammers know Americans order everything from dog food to prescription refills online, and a missed package can be a genuine inconvenience. They rely on your hope that the text is real and your willingness to solve the problem in ten seconds. The best defense is a slow hand. Pause before you click. Verify through official channels. When a text arrives out of nowhere and demands money or information, assume it is a trap until proven otherwise. A two-dollar fee is never worth giving a stranger the keys to your bank account.