The “Your Package Cannot Be Delivered” Smishing Scam: What to Do

You check your phone after a long day, and there it is: a text message from what looks like the United States Postal Service. “Your package could not be delivered due to an incomplete address. Please update your details here: [link] to reschedule delivery.” It looks official. It has the USPS logo, a tracking number that sounds real, and a sense of urgency. You were expecting a package from Amazon. You click the link. That single tap can cost you hundreds or even thousands of dollars.

This is not the Post Office. It is a smishing attack—a text message designed to steal your personal information. Smishing, a blend of “SMS” and “phishing,” has exploded in the last few years because it works. People aged 45 to 64 are prime targets. You grew up trusting mail, telephone calls, and official-looking notices. You are busy. You are not paranoid. And scammers know that. They play on the fact that you probably did order something recently, that you are worried about missing a delivery, and that a text feels less official than an email or a phone call, so you let your guard down.

Here is how the scam works. The message appears to come from a legitimate carrier—USPS, FedEx, UPS, even DHL. It might say the package is held at a facility or that a small fee is needed to release it. The link in the message leads to a website that mimics the real carrier’s login page. You are asked to enter your name, address, phone number, email, and sometimes your credit card number for a “redelivery fee” of a few dollars. Once you hit submit, the scammers have enough to drain your bank account, open new credit cards in your name, or sell your information on the dark web. Even if you do not pay the fee, the simple act of clicking the link can install malware on your phone. That malware can steal passwords stored in your browser, record your keystrokes, or lock your device and demand a ransom.

The scam is clever because it exploits your habits. You shop online. You get tracking notifications. You are conditioned to click on package updates without thinking. Scammers also spoof the sender name so the message appears in your conversation thread alongside real texts from carriers. They use official logos and professional language. Some versions even include a fake tracking number that looks plausible. The goal is to make you act before you pause to question it.

How do you spot the fake? Real carriers never send a text asking you to click a link to resolve a delivery issue unless you specifically signed up for text alerts. They do not ask for payment via a link in an unsolicited message. Look at the phone number. If it is a random ten-digit number or a short code you do not recognize, be suspicious. Check the URL in the link without clicking—long press on the message to see the actual web address. If it is a string of random letters or a domain like “usps-delivery.com” rather than “usps.com,” do not touch it. Real tracking numbers have a format that scammers often get wrong. A legitimate USPS tracking number, for example, is twenty-two digits and starts with a specific pattern. The scammers’ number will look off.

If you receive such a text, do not reply. Do not click. Do not even delete it right away. Instead, report it. Forward the message to 7726—that is the number for the mobile industry’s spam reporting service. Then block the sender. If you accidentally clicked the link, you need to act fast. Do not enter any information past the initial click. Immediately change your passwords for any accounts you access on your phone, especially banking and email. Run a security scan on your phone if you have antivirus software. If you entered your credit card number, call your bank and freeze the card. Place a fraud alert with one of the three major credit bureaus—Equifax, Experian, or TransUnion—so new accounts cannot be opened without your permission.

The damage from these scams goes beyond money. Your identity can be stolen, your credit ruined, and your accounts drained before you even know what happened. Recovery takes months, sometimes years, and costs you time, stress, and legal fees. Do not assume you are too smart to fall for it. The scammers are professionals who update their scripts constantly. They send millions of messages knowing that only a tiny fraction of people need to bite for them to make a fortune. And with the holiday season, tax season, or any time online shopping spikes, the volume of these texts doubles.

The bottom line: treat every unsolicited text about a package delivery the same way you would treat a stranger knocking on your door demanding your credit card. You would not hand over your wallet without checking their badge. Do not hand over your information without verifying the source. Legitimate delivery problems are handled on the carrier’s official website or app, not through a link in a text. If you are unsure, go directly to the carrier’s website, type in the tracking number manually, or call customer service from the number on your receipt. That extra minute of caution is the difference between a package delay and a financial disaster.