The Package Delivery Text That Could Empty Your Bank Account

You see your phone buzz with a text message. The sender appears to be the United States Postal Service, FedEx, or UPS. The message says something like “Your package could not be delivered due to an incorrect address. Please update your information here: [shortened link].” Maybe it adds a sense of urgency: “Delivery attempted twice, final notice.” You have been expecting a package, or even if you haven’t, the wording is vague enough to make you worry. So you click the link. That one tap is all it takes to start a chain reaction that can drain your savings, steal your identity, and take months to unravel.

This is a text message smishing attack. Smishing is a portmanteau of SMS and phishing. It is exactly the same con as the fake email from your “bank” or “IRS,” but delivered through a text. Scammers love texts because people trust their phones more than their email inboxes. And if you are between 45 and 64, you are a prime target. You have credit cards, a mortgage, retirement accounts, and you likely order things online. Scammers know that. They also know that you might not be as familiar with the latest tricks as someone raised on smartphones. That is not your fault—it is their business model.

The fake package delivery text is the most common smishing attack right now. Here is how it works. The scammer uses a spoofed phone number that looks like it comes from a legitimate carrier. Some even mimic the short codes that real shipping companies use. The link in the text takes you to a webpage that looks like the official USPS, FedEx, or UPS site. It will ask you to “confirm your address” or “pay a small redelivery fee” of a dollar or two. You fill in your name, address, and then it asks for your credit card number. That is the trap. Once you submit, the scammer now has your card information and your home address. But it gets worse. Many of these fake sites also ask for your Social Security number “for verification.” If you give that up, the scammer can open new credit cards, take out loans, or file a fraudulent tax return in your name.

Even if you do not enter any sensitive information, just clicking the link can be dangerous. Some smishing messages contain malware. The link may download a file that installs spyware on your phone. That spyware can record every keystroke, steal your passwords, and even read your two-factor authentication codes from your bank’s text messages. Suddenly, the scammer has the keys to every account you own.

How do you spot a fake delivery text before it hooks you? Start with the language. Real shipping companies do not send texts out of the blue with generic greetings. If you see “Dear Customer” or no greeting at all, be suspicious. Legitimate delivery notices will usually include the tracking number and the last four digits of your phone number or address. The fake ones use vague phrases like “your package” or “a delivery attempt.” Another red flag is the link. Never click a link in an unsolicited text. Instead, open your browser and go directly to the carrier’s official website. Type the tracking number from your email confirmation—if you have a package coming. If you do not have a package on the way, that text is a hundred percent a scam.

Also look at the phone number. Scammers often use international numbers or numbers that start with area codes you do not recognize. But be careful: they can spoof legitimate numbers too. The safest rule is this: if a message creates urgency and asks you to click a link, do not click it. No legitimate company will ever text you a link and demand immediate action. They will send an email or a letter, or they will leave a note on your door.

What should you do if you receive one of these texts? First, do not reply. Do not text “STOP” to unsubscribe—that only tells the scammer your number is active. Instead, take a screenshot and forward the text to 7726 (SPAM). That is the spam reporting number used by most mobile carriers. Then block the sender and delete the message. If you accidentally clicked the link, do not panic. Immediately change the passwords on your email and bank accounts. Enable two-factor authentication if you have not already. Then contact your credit card issuer and put a fraud alert on your account. You should also check your credit report at AnnualCreditReport.com—it is free once a week from each bureau. If you entered your Social Security number, call the Federal Trade Commission at 1-877-ID-THEFT and file a report.

The scammers are counting on your impulse to resolve a problem quickly. They want you to act before you think. The best defense is a ten-second pause. Ask yourself: Was I expecting a package? Does this message look right? Would a real company ask for my credit card number over text? The answer is almost always no. By slowing down, you can keep your money where it belongs—in your pocket.