How to Spot Fake Package Delivery Texts That Steal Your Money and Identity

You check your phone and see a text message: “USPS: Your package is waiting. Please update your delivery preferences by clicking here.“ You might be expecting a package. You might not be. Either way, that text is almost certainly a smishing attack. And if you click the link, you are one step away from losing your bank account or having your identity stolen.

Scammers have perfected the art of sending fake package delivery texts because they know Americans order things online constantly. For middle-class Americans between 45 and 64, this is especially dangerous. You have credit cards, home equity, savings, and a Social Security number worth stealing. The scammers are counting on you being busy, distracted, or just tired of dealing with small annoyances. They want you to click without thinking.

The typical fake delivery text claims to be from the United States Postal Service, FedEx, UPS, or DHL. The message says there is a problem with a delivery. Maybe they need a new address. Maybe you owe a small fee, like three dollars, to release the package. Maybe your package is delayed and you need to confirm a time slot. Every variation has the same goal: get you to tap the link. That link takes you to a website that looks almost exactly like the real carrier’s site. You will be asked to enter your name, address, phone number, and often your credit card number to pay the so-called fee. Some versions go further and ask for your Social Security number or your online banking login under the pretense of verifying your identity.

Once you hand over that information, the scammers drain your accounts, open new credit cards in your name, or sell your data to other criminals. The three dollars you thought you were paying becomes thousands of dollars in fraudulent charges. Worse, identity theft can take months or years to clean up. You might not even know it happened until you get a collection call for a loan you never took out.

How can you tell a real delivery text from a fake one? Start with the phone number. Legitimate carriers send delivery updates from short codes or from official numbers that are already saved in your phone. Smishing messages often come from random eleven-digit numbers or from overseas country codes. But scammers have gotten smarter. They now spoof phone numbers to make them look local or even official. So do not trust the number alone.

Look at the language of the text. Real delivery notifications usually include your tracking number, sometimes the last four digits, and the expected delivery date. Fake texts are vague. They say things like “a package” or “your order” without specifying what it is. They create urgency: “Act now” or “Your package will be returned if you don’t respond within 24 hours.“ Real companies do not pressure you like that. They also never ask for payment via a link in a text message. If you owe Customs fees or a redelivery charge, you handle that through the official website you already know, not through a link sent to your phone.

Another red flag is the URL. Hover over or long-press the link without clicking it. Fake URLs mimic real ones but contain extra words or misspellings. For example, instead of fedex.com, the link might be fedex-delivery.com or fedex.co.kr. If the link looks off, it is a scam.

What should you do if you receive a suspicious delivery text? Do not reply. Do not click the link. Do not call back any phone number listed in the message. Delete it. If you think it might be real, go directly to the carrier’s official website and check your tracking number there. You can also call the carrier using a phone number you get from their official site, not from the text. For the USPS, you can forward the scam text to 7726 (SPAM). For other carriers, report it to their fraud departments.

If you already clicked the link and entered information, take action immediately. Contact your bank and credit card companies to freeze your accounts and place fraud alerts. Change the passwords on your online accounts, especially email and banking. Visit identitytheft.gov and file a report with the Federal Trade Commission. Place a fraud alert with the three major credit bureaus: Equifax, Experian, and TransUnion. Consider freezing your credit entirely to prevent new accounts from being opened in your name.

The best protection is prevention. Treat every unsolicited text message as guilty until proven innocent. Do not keep your phone number public on social media. Use spam filters on your phone. If you have an iPhone, enable “Filter Unknown Senders” in Messages settings. On Android, use the Messages app with spam protection turned on. And teach your family members, especially older relatives, the same rules. Scammers are relentless. They will keep sending these texts because they keep working.

In the end, the fake package delivery text is not about a package. It is a trap. The only way to win is to refuse the bait.