The “Missed Package” Text That Could Empty Your Bank Account

You check your phone during a commercial break and see a text message: “USPS: Your package has a delivery issue. Please confirm your zip code to reschedule.” There’s a link. You might have ordered something from Amazon last week, or you’re expecting a birthday gift. It looks official. It feels urgent. And that’s exactly what the criminals want you to feel.

This is a classic form of text message smishing—phishing delivered through SMS. The scam is simple, effective, and increasingly common. According to the Federal Trade Commission, Americans lost over $330 million to text-based scams in 2022 alone, and the numbers have only climbed since. People aged 45 to 64 are a prime target because you likely have established credit cards, bank accounts, and a habit of receiving real package deliveries. The scammers are counting on that familiarity to lower your guard.

Here is how it works. You receive a text that appears to come from a major shipping company—UPS, FedEx, USPS, or DHL. The message warns of an “undeliverable package,” a “failed delivery attempt,” or a “customs fee” that needs to be paid. The link in the text does not go to the real shipping company’s website. Instead, it leads to a fake page that looks almost identical. That fake page will ask for your personal information: your full name, address, phone number, and sometimes your credit card number to “pay a small redelivery fee.” Once you enter that information, the scammers have everything they need to drain your bank account, open new credit cards in your name, or sell your data to other criminals.

The not-so-obvious danger is that many of these fake sites also install malware on your phone. You might not notice anything wrong, but behind the scenes, the malware can intercept your two-factor authentication codes, read your contacts, and even access your banking apps. A simple click can turn your smartphone into a spy device.

Detection is not difficult once you know what to look for. First, check the sender’s number. Real companies use short codes or branded sender IDs, not random 10-digit numbers from an area code you do not recognize. Second, look at the message itself. Legitimate delivery notifications usually include a tracking number that you can verify on the company’s official app or website. Smishing texts rarely include a valid tracking number. Third, the language is often off—odd capitalization, missing punctuation, or a sense of panic designed to make you act before thinking. “YOUR ACCOUNT WILL BE SUSPENDED” or “FINAL NOTICE: RESPOND IMMEDIATELY” are red flags.

But the most important rule is this: never click the link. Even if the text looks convincing, do not tap it. Instead, open your browser manually and go directly to the shipping company’s website. Log into your account there, or use the company’s official app. If there is a real problem with a package, it will appear in your account dashboard. If there is no problem, you have just avoided a scam.

What do you do if you already clicked? Do not panic. Immediately change your passwords, especially for email, banking, and any account that uses your phone number for authentication. Enable two-factor authentication using an authenticator app rather than SMS if possible, because smishing attackers can also SIM-swap your number. Contact your bank and credit card companies to alert them that your information may have been compromised. Then report the scam text to the FTC at ReportFraud.ftc.gov and forward it to 7726 (SPAM) on most carriers. Reporting helps shut down the phone numbers and fake websites.

There is a deeper point here. Scammers are not just after your money—they are after your attention and your trust. They know that people in your age group tend to be more polite and more willing to resolve problems promptly. That is not a weakness, but it is something criminals exploit. The solution is not cynicism. It is simply slowing down. No legitimate delivery company will ever demand immediate payment via text. No real bank will ask you to click a link to “verify” your account. If a message makes you feel rushed or scared, that alone is reason enough to pause and verify through a separate channel.

Protect yourself by treating every unsolicited text with the same caution you would give a stranger knocking on your door. Ask yourself: Was I expecting a package? Do I have an account with this company? Does this contact method match what I usually receive? When in doubt, delete it. Your savings and your identity are worth more than a few seconds of inconvenience.

The criminals are getting better at mimicking logos, language, and even customer service tones. But they cannot mimic your common sense. Use it.