The Package Delivery Smishing Scam: How to Spot Fake Shipping Texts Before You Lose Money

You are waiting for a package. It could be a gift for your grandchild, a book you ordered, or a replacement part for your lawnmower. Then your phone buzzes with a text message that looks official. It says something like “USPS: Your package has a delivery issue. Please update your address here.” There is a link. You click it because you really need that package, and the message looks legitimate. The page that opens asks for your personal information, maybe your credit card number to pay a small redelivery fee. You fill it out. Within hours your bank account is drained or your identity is stolen. Welcome to the world of smishing – SMS phishing – and the package delivery scam is one of the most effective traps for Americans aged 45 to 64.

Smishing attacks use text messages to trick you into handing over sensitive data or downloading malware. The package delivery variant is particularly dangerous because it exploits a daily reality for middle-class Americans: you order things online, you expect tracking updates, and you worry when something goes wrong. Scammers know this. They buy lists of phone numbers, often leaked from data breaches, and send thousands of these texts at once. They spoof the sender name so it appears as “USPS,” “FedEx,” “UPS,” or even “Amazon Logistics.” The message creates urgency: “Your package is undeliverable. Respond within 24 hours or it will be returned.” That ticking clock is designed to override your natural skepticism.

Once you click the link, you land on a phishing page that closely mimics the real carrier’s website. You may see official logos, a tracking number, and a form asking for your full name, address, phone number, and, most importantly, your payment card details to cover a “small redelivery fee” of one or two dollars. Many victims think it is a minor inconvenience to get their package. But once you hit submit, the scammers now have everything they need to drain your account, apply for credit in your name, or sell your information on the dark web. Some versions also attempt to install malware on your phone that can intercept your two-factor authentication codes or steal passwords.

Why are people in their fifties and sixties especially vulnerable? You grew up in an era when a phone call or a mailed letter was the standard way to communicate with businesses. Text messages still feel more personal and immediate to you, not like the endless spam younger generations ignore. You also likely order from a variety of retailers – Amazon, Etsy, Walmart, specialty stores – and you may not always remember exactly what you bought or which carrier is handling delivery. The scammers count on that confusion. They will even use real tracking numbers they find online to make the message feel genuine.

Here is the hard truth: legitimate carriers almost never text you out of the blue with a link asking you to update your address or pay a fee. If there is a real delivery problem, you will typically get a physical notice left on your door or an email from the retailer you ordered from. The U.S. Postal Service does send some tracking updates via text, but only if you explicitly signed up for that service using a specific tracking number. They will never ask you to click a link to provide personal information. FedEx and UPS have similar policies. Any text that demands urgent action, especially one that asks for money or login credentials, is a red flag.

What should you do when you receive one of these messages? First, do not click the link. Do not even reply “STOP” or “UNSUBSCRIBE,” because that tells the scammer your number is active and you will get more attacks. Instead, take a screenshot of the message and then delete it. If you are genuinely expecting a package, open your browser and go directly to the carrier’s official website or app, type in your tracking number, and check the status there. Never use the link from the text. You can also forward the suspicious text to 7726 (which spells SPAM) and then report it to the Federal Trade Commission at ReportFraud.ftc.gov. That helps authorities track and shut down these operations.

Prevention is your best defense. Enable two-factor authentication on your email and financial accounts. Use a password manager so you do not reuse passwords across sites. Consider using a separate credit card with a low limit for online purchases. And if you receive a text from a company you do business with, call them using a number you know is correct – not the one in the text. A thirty-second phone call can save you thousands of dollars and months of identity recovery work.

The package delivery smishing scam is not going away. It evolves with holidays, tax season, and major sales events. The crooks are patient and they are good at what they do. But you do not have to be their next victim. Stay calm, verify everything, and remember that a legitimate company will never pressure you by text to hand over personal or payment information. When in doubt, do nothing. That wasted minute is far better than the nightmare of cleaning up a stolen identity.