Fake Package Delivery Texts: 7 Real Examples and Red Flags

Is this package delivery text a scam?

Almost certainly, if you didn't ask for text tracking and the message has a link. Real carriers don't text you out of the blue to ask for a fee, a new address or your card number. Don't tap the link or reply. Check the tracking number on the carrier's own site or app, then report the text and delete it.

What to do if you got one

• Don't tap the link, call the number or reply, not even with STOP.
• If you're expecting a package, type the carrier's address into your browser yourself or open its app, and look up the tracking number from your order confirmation.
• Forward the text to 7726 (SPAM) so your carrier can block the sender, then delete it.
• If it came to a work phone, tell your IT or security team.

A fake package delivery text is a phishing message sent by SMS or iMessage instead of email, a form of smishing. It borrows the name of USPS, UPS, FedEx, DHL or Amazon and claims a package is stuck. The fix is always a small step: confirm an address, pay a redelivery fee, schedule a time. Each step ends on a fake site that collects your card number, your login or both. The seven examples below are written out the way these texts usually arrive, with the red flags in each.

7 fake package delivery texts, written out

1. USPS "incomplete address" text

Sender: a phone number with a foreign country code, or an email address sent as an iMessage

Message: "USPS: Your package has arrived at the warehouse but could not be delivered due to incomplete address information. Please confirm your address within 12 hours: usps.redelivery-center.top"

• USPS sends tracking texts only from short codes, and only after you sign up for them. A regular phone number or an email address is a giveaway.
• The link is not usps.com. Scammers put the brand at the start of a domain they own.
• The 12-hour deadline is there to stop you from checking.

2. USPS redelivery fee text

Sender: an unknown 10-digit number

Message: "USPS: We have attempted to deliver your package twice. A redelivery fee of $0.30 is required. Pay now to reschedule: usps-parcel-care.com/fee"

• The fee is tiny so you won't think twice. The real goal is the card number and billing address you type on the payment page.
• USPS doesn't charge to reschedule a missed delivery by text.
• "Attempted twice" with no tracking number, date or address is a template sent to thousands of phones.

3. UPS customs or duty fee text

Sender: an unknown number

Message: "UPS: Your international shipment 1Z8829 is on hold pending a customs fee of $2.99. Pay within 24 hours to avoid return to sender: ups-clearance-pay.net"

• The tracking number is short or incomplete. Real UPS tracking numbers start with 1Z and run 18 characters.
• Most people who get this text aren't expecting anything from overseas, which is the clue.
• Any page that asks for a card number on a domain other than ups.com is fake.

4. FedEx "schedule your delivery" text

Sender: a short message from an unknown number, often with your first name

Message: "Hi Dana, your FedEx package with tracking code GB-6412-GH83 is waiting for you to set delivery preferences: fedex-deliveryprefs.com/GB6412"

• Your first name makes it feel personal, but names are easy to buy from data breaches.
• The tracking code doesn't match the format FedEx uses, which is digits only.
• The page will ask you to "verify" with your card to finish scheduling. FedEx doesn't need a card to deliver a package you already paid for.

5. Amazon "payment failed, package on hold" text

Sender: an unknown number or email address

Message: "Amazon: Your recent order could not be shipped because your payment method was declined. Update your billing information to release your package: amzn-orderhelp.com"

• No order number and no item name. Real Amazon order messages name the order.
• The link leads to a copy of the Amazon sign-in page. Entering your password hands over your account and every saved card.
• Check your orders in the Amazon app. If there's no problem there, there's no problem.

6. "Reply Y to activate the link" text

Sender: an email address or foreign number

Message: "Your parcel delivery failed due to an invalid address. Please reply Y, then exit the text and reopen it to activate the link, or copy it into your browser: parcel-redeliver.info"

• iPhones turn off links in texts from unknown senders. Asking you to reply Y is how the scammer turns them back on.
• Replying also tells the sender your number is live, so more scam texts follow.
• No carrier name at all is common in this version. It works on anyone who is expecting some package.

7. DHL "parcel on hold" text

Sender: an unknown international number

Message: "DHL Express: Your parcel is on hold at our facility due to unpaid shipping charges. Your package will be returned in 48 hours if payment is not received: dhl-express-hold.com"

• The message names no sender, no item and no tracking number.
• The 48-hour return threat pushes you to pay before thinking.
• If you're expecting a DHL shipment, look up its tracking number on dhl.com yourself instead of paying through a link.

How to tell a real delivery text from a fake

Real delivery texts come after you asked for them. The US Postal Inspection Service says USPS sends texts only to people who requested tracking with a tracking number, uses 5-digit short codes to send them, and won't include a link. Other carriers follow similar patterns. A real alert has these traits:

• You signed up for it when you ordered or shipped something.
• It shows a full tracking number that matches your order confirmation.
• It never asks for a payment, a password or your card number to deliver a package.

A fake alert usually has one or more of these:

• A personal phone number, a foreign number or an email address as the sender.
• A link to a domain that only starts with the carrier's name.
• A fee, a deadline or a threat to return the package.
• Odd spacing, capital letters in the wrong places, or a greeting with no name at all.

What to do if you tapped the link

Act on what you entered, not on the click alone. The Postal Inspection Service advises telling your bank if you interacted with the page at all, even if you didn't press submit.

1. If you entered a card number, call the number on the back of your card, report the charge risk and ask for a new card.
2. If you entered a password, change it on the real site and on any other account that uses the same password. Turn on multi-factor authentication.
3. If you entered your date of birth or Social Security number, place a fraud alert or credit freeze with the credit bureaus.
4. If it happened on a work phone, or you typed a work password, tell your IT or security team now. Fast reports let them block the site for everyone else.
5. Watch your card and bank statements for small trial charges over the next few weeks.

How to report a fake delivery text

• Forward the text to 7726, which reports the sender to your mobile carrier. The Postal Inspection Service recommends this for every smishing text.
• For texts that use the USPS name, email a screenshot showing the sender and date to spam@uspis.gov.
• Report the scam to the FTC at ReportFraud.ftc.gov.
• If you lost money, file a complaint with the FBI's Internet Crime Complaint Center.

Why fake delivery texts work

Most people are expecting a package on any given day, so a delivery problem feels plausible. The texts lean on three of the manipulation tactics Hook teaches people to notice: urgency (the deadline), trust (a brand you use) and helpfulness (a small, reasonable request to fix a problem). The same playbook shows up in email, which is why these texts look so much like the fake invoice emails and callback voicemail scams that start in an inbox. For more written-out examples from Microsoft, PayPal, Amazon and other brands, see Hook's phishing email examples and the FedEx phishing email example.

Employees who have practiced spotting these patterns in phishing simulations catch them faster on a phone, where the screen is small and the sender details are hard to see. The habit to build is the same everywhere: pause, check the source yourself, and report it.

Fake package delivery text FAQ

Does USPS send text messages about packages?

Only if you signed up. USPS sends tracking texts after you request them with a tracking number, and those texts come from a short code with no link. A USPS text you didn't ask for is a scam.

Why do I keep getting delivery texts when I'm not expecting a package?

Scammers send the same text to huge lists of phone numbers, many bought or guessed. They count on some people expecting a package that day. Getting one doesn't mean your information was stolen.

What happens if I click a fake USPS link but don't enter anything?

Usually nothing, but close the page, don't download anything it offers, and keep your phone's software up to date. If you typed anything at all, follow the steps above and tell your bank.

Should I reply STOP to a scam text?

No. Replying confirms your number is active and can lead to more scam texts. Forward it to 7726, then delete it.