The Package Delivery Phishing Scam: How a Simple Text Can Empty Your Bank Account

You are expecting a package. Maybe it is the birthday gift you ordered for your granddaughter, the new running shoes you finally pulled the trigger on, or that tool set from the hardware store. Your phone buzzes. The text message says, “USPS: Your package has a delivery issue. Please confirm your address here: [link].” You tap the link. It looks exactly like the official USPS website. You enter your name, address, and—because the form asks for it—your credit card number to pay a “redelivery fee” of three dollars. Within hours, your bank notifies you that fifteen hundred dollars have been charged to a store in another state. You have just been phished.

This is the package delivery phishing scam, and it has become one of the most common traps for middle-class Americans in their forties, fifties, and sixties. Why? Because you actually are expecting packages. The scammer does not need to guess. They know that anyone who shops online—and that is most of us—is vulnerable. They send thousands of these texts and emails a day, betting that a small percentage of recipients will be caught off guard by the sheer coincidence of a pending delivery. And too often, they are right.

The scam works like clockwork. You receive a text message, an email, or even a voicemail claiming to be from the United States Postal Service, FedEx, UPS, or Amazon. The message uses official logos, proper grammar (or just enough to look legitimate), and a sense of urgency. “Your package could not be delivered due to an incomplete address.” “Your shipment is on hold pending a customs fee of $2.99.” “Click here to reschedule delivery within 24 hours or your item will be returned to sender.” The link takes you to a page that mimics the real carrier’s login or tracking portal. There, you are asked to enter sensitive information: your full name, home address, phone number, and often your credit card or debit card details. Sometimes the scam asks for your Social Security number under the guise of “identity verification for international shipments.” Once the scammer has your credit card number and personal data, they can drain your account, open new lines of credit in your name, or sell your information on the dark web.

What makes this scam especially dangerous for people aged 45 to 64 is your habits. You are more likely to have a stable home address, to order items for your household, and to manage your own deliveries. You may also be less familiar with the common signs of a phishing link. For instance, the scam website’s URL might be “usps-trackinng.com” instead of the real “usps.com.” You might not notice that the text message came from a random cell number, not a short code like “USPS.” You might assume that because the message arrived at the exact moment you were expecting a package, it must be legitimate. Scammers count on that assumption.

Here is the hard truth: no legitimate shipping company will ever text you out of the blue and ask for money or personal information. The USPS, FedEx, and UPS already have your address and any necessary fees are collected at the point of sale or upon delivery, never through a random link. If there is a genuine delivery problem, the carrier will leave a physical notice on your door or send an official notification through the account you created with them—not a text from an unknown number.

You can protect yourself with three simple moves. First, stop and think before you tap any link in a text or email. The scam relies on your impulse to solve a problem immediately. Instead, go directly to the carrier’s official website by typing the address into your browser yourself. Check the tracking number you were given by the seller. If you do not have a tracking number, the message is almost certainly fake. Second, look at the sender’s phone number or email address. Scammers often use addresses like “usps-delivery@gmail.com” or numbers with area codes you do not recognize. Third, never enter your credit card number or Social Security number on a page you reached through a text link. No matter how real the page looks, it is a clone. If you have already entered information, call your bank immediately and freeze your cards. Then change the passwords on your email and any accounts tied to that card.

This scam has stolen billions of dollars from Americans, and it is not going away. The criminals adapt faster than the carriers can warn you. During the holiday season, the volume of these messages spikes because everyone is waiting for gifts. But the packages you are waiting for are not the problem—the fake delivery notices are. Treat every unsolicited delivery message as guilty until proven innocent. Your bank account will thank you.