How to Spot the FedEx, UPS, and USPS Smishing Scams Flooding Your Phone

You check your phone while waiting in line at the grocery store and see a text message from “USPS”: “Your package is delayed due to an incomplete address. Please update your delivery details here: [link].” You were expecting a delivery from Amazon later this week, so you tap the link without thinking. Within seconds, you have handed over your name, address, credit card number, and the three‑digit security code on the back of your card. Congratulations—you have just been smished.

Smishing is the text‑message cousin of phishing. Scammers send a text that looks like it comes from a legitimate company—FedEx, UPS, the U.S. Postal Service, or even a retailer like Walmart or Best Buy—and demand that you click a link to “resolve” a delivery issue. The link takes you to a fake login page or payment portal designed to steal your personal information or install malware on your phone. These attacks are on the rise, and people between the ages of 45 and 64 are prime targets because they tend to be homeowners who order packages, pay bills online, and may not be as familiar with the latest mobile‑security threats as younger generations.

The scam works because it plays on a very real anxiety: a missing package is a genuine hassle. You might have a birthday gift that needs to arrive on time, or medication that cannot be delayed. The scammers know that you are likely to react quickly rather than stop and think. They also use official‑looking logos, domain names that sound close to the real thing—like “fedex‑tracking.info” instead of “fedex.com”—and urgent language such as “action required within 24 hours” or “your shipment will be returned to sender.”

Do not fall for it. The first rule is simple: never click a link in an unsolicited text message. If you receive a message about a package delivery, do not tap anything. Instead, go directly to the carrier’s official website by typing the address into your browser yourself. USPS, FedEx, and UPS all have free tracking tools that let you look up a package using the tracking number you received from the seller. If you never ordered anything, or if the tracking number in the text does not match any of your recent orders, it is a scam.

Another red flag is the request for payment. No legitimate carrier will text you and ask you to pay a small fee—usually $1.99 or $3.99—to “release” your package. That is a common smishing tactic: they want your credit card number, and they hope that you will not notice the small charge leads to larger unauthorized transactions later. Likewise, be suspicious of messages that claim you need to “verify your identity” by entering personal details such as your Social Security number, birthdate, or mother’s maiden name. The post office does not need that information to deliver a parcel.

If you do accidentally click a suspicious link, do not panic. Close the website immediately. Do not enter any information. If you already typed in your credit card details, call your bank right away and report the card as compromised. Change the passwords on any accounts you may have logged into through the fake site. Run a security scan on your phone if you have security software installed. And consider placing a fraud alert on your credit report if you gave out sensitive data like your Social Security number.

You can also protect yourself before the scam arrives. Go into your phone’s settings and enable the option to block messages from unknown senders, or at least filter them into a separate folder. Many carriers now offer free spam‑blocking tools that automatically flag suspicious texts. Never store your credit card information in your phone’s browser or in shopping apps, because if your phone is compromised, that data becomes easy to steal.

Finally, report smishing attempts. Forward the suspicious text to 7726 (which spells “SPAM” on most keypads). This sends the message to your carrier’s fraud department. You can also report it to the Federal Trade Commission at ReportFraud.ftc.gov. The more reports they receive, the faster they can shut down the scam phone numbers and websites.

Remember: scammers are counting on your good manners and your trust in familiar brand names. They are betting that you will act before you think. That is how they win. The best defense is to slow down, read the message with a skeptical eye, and never, ever click a link that arrives out of the blue. A real package delay will be handled by the seller or the carrier through official channels—never through a panicky text message. Hold that line, and you will keep your money and your identity safe.