Fake Delivery Notices: Why That Text About Your Package Is a Smishing Trap

You’re expecting a package. Maybe it’s a birthday gift for your grandkid or a new tool set from an online retailer. Then your phone buzzes. The message reads something like, “USPS: Your package has been suspended due to an incomplete address. Click here to update delivery preferences within 24 hours.“ There’s a link. Your first instinct is to tap it. Don’t.

This is a smishing attack - a phishing scam delivered by text message. The name comes from SMS and phishing, and it’s one of the fastest-growing ways criminals are getting into the phones and wallets of middle-class Americans. Why you? Because you order online, you track deliveries, and you’re busy. You don’t have time to second-guess every notification. That’s exactly what they count on.

Here’s how it works. The scammer sends a text that mimics a legitimate carrier like USPS, UPS, FedEx, or Amazon Logistics. The message claims a package couldn’t be delivered due to a missed fee, a customs hold, or an address glitch. The link in the message takes you to a lookalike website that asks for your name, address, phone number, and sometimes your credit card number to “redeliver” or “pay a small fee.“ Once you enter that information, it’s gone. The criminals use it to open new credit cards, drain existing bank accounts, or sell the data on the dark web. In newer variations, clicking the link triggers a silent installation of malware on your phone, giving crooks remote access to your text messages, contacts, and even your banking apps. That malware can sit dormant for weeks, sending them every password reset code that lands in your inbox.

Why do these texts feel so real? Because scammers have access to data breaches that include your name, address, and purchasing history. They can tailor the message to include your actual zip code or a reference number that looks legitimate. They’ve gotten so good at mimicking official notifications that even savvy people can be fooled. A recent Federal Trade Commission report showed that smishing complaints have tripled in the past two years, with delivery-related texts being the number one category. And unlike email scams, which many people have learned to filter out, text messages feel personal. You glance at your phone, see a familiar logo, and react before your brain catches up.

So how do you spot a smishing text? First, look at the sender’s number. Legitimate carriers use short codes like 555-123, not random 10-digit or 11-digit mobile numbers. Second, check for urgency. Scammers create panic with phrases like “final attempt” or “your package will be returned to sender.“ Real carriers don’t threaten you. They already know how to deliver your stuff. Third, inspect the link. If the URL doesn’t match exactly what you’d see when you track a package through the official carrier website, it’s fake. On a phone, don’t tap it at all. Hovering isn’t possible on most mobile browsers, so your only safe move is to ignore it. Instead, open your browser manually and go directly to the carrier’s official site or app. Enter your tracking number there. If there’s a real problem, it will show up in your account.

If you already clicked and entered personal information, don’t panic. Act quickly. Start by changing the passwords for your email, bank, and any account where you used the same credentials. Contact your credit card issuer or bank and place a fraud alert on your credit files with Equifax, Experian, and TransUnion. Alerting one agency is enough because they’re required to share the notice with the others. Then report the text to the Federal Communications Commission at fcc.gov, to the FBI’s Internet Crime Complaint Center at ic3.gov, and forward the message to 7726 (which spells SPAM). That forwarding step helps your carrier block the number for other customers. Finally, tell your family and friends. Middle-class Americans aged 45 to 64 are prime targets because they have savings, good credit, and a lifetime of trusting official-looking messages. But you don’t have to be a victim.

Remember this: no real carrier will ever ask for your Social Security number, banking details, or credit card information via text. They already have your address. They don’t need you to “verify” anything by clicking a link. If they need to reach you, they’ll send a letter or alert you through their app. The next time you get a “package could not be delivered” text, take a deep breath. Don’t click. Don’t reply “STOP” either, because that just confirms your number is active and makes you a bigger target. Simply delete the message. Then go to your carrier’s website and check your tracking number directly. That two minutes of caution can save you months of identity theft cleanup, not to mention the frustration of having your phone locked down by malware.

Spreading awareness is the best defense. Talk to your neighbors, your coworkers, and even your teenagers. You might be surprised that younger people are often worse about clicking links without thinking. Smishing is a crime of convenience. When you refuse to be convenient, the scammers move on to someone who won’t hesitate. Stay alert, stay skeptical, and always verify before you tap.