The Package Delivery Phishing Scam: How a Text About a Missed Delivery Can Empty Your Bank Account

You get a text message. It says USPS, FedEx, or UPS tried to deliver a package but couldn’t. There’s a link to “reschedule delivery” or “confirm your address.” You click it because you’re expecting something from Amazon or a prescription refill. The page looks real. You type in your name, address, and maybe your credit card number to pay a small redelivery fee. Then nothing happens. A few days later you see a charge for $500 at a store you never visited. That’s the package delivery phishing scam, and it is currently the most common phishing trap hitting middle‑class Americans over 45.

Why this age group? Because you are the ones who order online, who still answer unknown texts, and who trust official‑looking logos. Scammers know that. They harvest numbers from data breaches, from old mailing lists, or simply by dialing random area codes. The text arrives with a sense of urgency: “Your package could not be delivered. Please update your delivery preferences within 24 hours or the package will be returned.” That pressure is designed to make you act before you think.

The next step is the fake website. It will have the carrier’s logo, the same color scheme, and even a tracking number that looks real if you squint. The URL might be “usps‑track.top” or “fedex‑delivery‑help.com” – close enough to the real thing if you are glancing on a phone screen. Once you enter your information, the scammer has your name, address, phone number, and often your credit card or bank account details. They can use that data to make purchases, open new accounts in your name, or sell it to other criminals.

This is not a new trick, but it keeps evolving. A few years ago these scams came as emails with ugly formatting. Now they are text messages (smishing) that look exactly like the real delivery alerts because scammers copy the official templates. Some even include a phone number to call. If you call, a “customer service agent” will ask you to verify your identity by reading off a code sent to your phone. That code is actually a two‑factor authentication reset for your bank account. Once you give it, the scammer locks you out and drains your money.

Spotting these phishing attempts is not hard once you know what to look for. First, the sender number is almost always a random 10‑digit number or an international code, not a short code like 27272 or 48773. Legitimate carriers use short codes for tracking alerts. Second, the message will have misspellings or odd grammar, though scammers are getting better. Third, the link will not match the carrier’s real domain. Hover over it if you can, or long‑press on mobile to see the actual URL. If it ends in something weird like “.xyz” or contains a string of numbers, it is fake. Fourth, real delivery services never ask you to pay a fee by clicking a link in a text. If you owe customs or a redelivery charge, they leave a door tag or a physical notice, not a text with a payment link.

What should you do if you get such a text? Do not click. Do not reply. Do not call the number. Delete the message. If you think it might be real, open your browser and type the carrier’s official website directly. Log into your account there or use their official app. If you have a tracking number from a real order, check it on the carrier’s site. If you already clicked the link and entered personal information, act immediately. Call your bank or credit card company and put a fraud alert on your accounts. Change the passwords on any accounts you use online, especially email and banking. Monitor your credit reports for new accounts opened in your name. You can freeze your credit at the three major bureaus for free.

This scam works because it exploits a common, boring fact of modern life: we all get packages. Scammers play on the slight anxiety of missing a delivery. They count on you being busy, distracted, and trusting of familiar logos. The only defense is skepticism. Treat every unsolicited text about a package as guilty until proven innocent. Legitimate companies will never ask for sensitive information through a text link. If you remember only one thing: never click a link in an unexpected delivery message. Type the address yourself. That small habit will keep your money where it belongs.