The text arrives at 8:14 on a Tuesday morning. Your package could not be delivered because of an incomplete address. There is a tracking number that looks real, a link, and a note that the parcel goes back to the sender if you do not act soon. You are annoyed rather than suspicious, because you genuinely are waiting on something.
That is the entire trick. This scam does not need to fool you. It only needs to catch you at a moment when the message is plausible, and with the amount most households order in a week, that moment is always. Here is how the scam runs, the details that give it away, and the calm steps to take if you already tapped the link.
Why This One Works on Almost Everyone
Most scams have to manufacture a reason for you to care. This one does not. Somebody in your house is expecting a package right now, and you probably could not name every item in transit. When a message mentions a delivery, your brain fills in the blank with a real order.
It also arrives on a phone, which is the worst place to inspect anything. The screen is small, the address bar is truncated, and you are usually walking, driving, or half awake. The Federal Trade Commission’s guidance on spam and scam texts lists package delivery notices right alongside fake prizes and phony account alerts as the standard bait scammers use to get personal information.
The good news is that the whole thing collapses on a single fact you can memorize. The United States Postal Inspection Service states it plainly: USPS will not send customers text messages or emails without a customer first requesting the service with a tracking number, and it will not contain a link. If you did not ask for the text, the Postal Service did not send it.
The Script, From Text to Phone Call
These messages follow a formula. Recognizing the shape matters more than memorizing any one version, because the wording changes while the structure stays put.
- A believable problem. An incomplete address, an unpaid customs charge, a failed delivery attempt, or a parcel sitting at a facility waiting on you.
- A small fee. The amount is deliberately trivial, low enough that paying feels easier than arguing. The fee is never the point. Your card number is the point.
- A link to a lookalike site. The page carries the right logo, the right colors, and often a working lock icon. The FTC warns that these links lead to a spoofed website that looks real but is not, and that anything you type there goes straight to the scammer.
- A form that asks for far too much. Name, full address, phone, card number, expiration, security code, and sometimes a date of birth or a bank login. No carrier needs that to move a box across town.
- The follow-up call. This is the part people do not expect. Days later, someone phones claiming to be from your bank’s fraud department, says they spotted the suspicious charge, and asks you to confirm a code or move money to a safe account. They already have your details from the form, which is what makes the call convincing.
That last step is why these texts matter even though the first ask is tiny. The delivery message is the opening move in a longer con, and the second act is where the real money moves.
The Tells That Give It Away
- You did not sign up for the alerts. Real carrier notifications come because you asked for them, usually on an order you placed. An unrequested one is the whole answer.
- There is a link at all. The Postal Inspection Service is explicit that a legitimate USPS text will not contain a link. Other carriers do send links, which is why the safest habit is to ignore all of them and look the number up yourself.
- The web address is not quite right. Look at the words right before the first single slash. That is the real site. A domain ending you do not recognize is somebody else’s website wearing a costume.
- It asks you to pay. If a delivery genuinely needs money, that gets settled through the carrier’s own account system or at the counter, not through a text link.
- The sender is strange. A long unfamiliar number, an email address, or a foreign country code sending domestic postal updates.
- It pushes on time. Twenty-four hours to respond or the package goes back. Urgency exists to stop you from checking, which is the same pressure pattern behind most phishing attacks that keep getting through filters.
How to Check a Tracking Number Yourself
Never tap the link. Not even to peek. There is a better method and it takes twenty seconds.
Start with the order, not the text. Open the retailer’s app or your confirmation email and find the tracking number there. If the message is real, the same delivery will already be visible in your account. If nothing in your order history matches, you have your answer without touching anything.
If you want to check a tracking number directly, type the carrier’s website address into your browser by hand, or use the carrier’s own app that you installed from an app store. Never copy the link out of the text.
Then get rid of the message. The FTC recommends forwarding scam texts to 7726, which spells SPAM, and reporting them at ReportFraud.ftc.gov. For postal impersonation, the Postal Inspection Service asks you to email the details, including a screenshot and the sender’s information, to [email protected]. Both take under a minute and they feed real enforcement.
If You Already Tapped, Here Is the Order of Operations
First, stop being embarrassed. These messages are convincing by design, and the people who get caught are careful people who were busy. What matters now is speed, not blame.
- Call your bank or card issuer. The Postal Inspection Service advises notifying your financial institution if you interacted with the link at all, even if you did not hit submit. Use the number on the back of your card. Ask for a replacement card and watch for small test charges.
- Change any password you typed. If you entered a password on that page, change it wherever else you used it. This is where a password manager and multifactor authentication earn their keep, and we compared the options in YubiKey vs passkey vs MFA.
- Expect the follow-up call, and do not take it. Nobody from your bank will ever ask you to read back a verification code or move money to a safe account. Hang up and call the bank yourself.
- Watch your statements for a few months. Small unexplained charges usually come first, while someone tests whether the card is live.
- Consider freezing your credit. If you handed over a date of birth or Social Security number, freeze your credit file at each of the three major credit bureaus.
The Bottom Line
One rule covers this entire category. Never act on a delivery message. Go find the delivery instead, in your own order history or in an app you installed yourself. The Postal Service will not text you a link out of the blue, no carrier settles a fee through a text message, and a real package is never lost because you took an extra minute to check.
Forward these to 7726 and delete them. Tell the people in your life who get flustered by this sort of thing, especially anyone who orders a lot and worries about missing a delivery. If you got caught by one and want a second opinion on what to lock down, we are happy to walk through it with you. Contact us today.
Sources:
Comments are closed