Fake Package Delivery SMS Scam: How to Spot Postal Service Phishing

"USPS: Your package could not be delivered. Schedule redelivery: [link]." Got a text like this? Don't tap that link.

Fake postal service text messages — impersonating USPS, FedEx, UPS, Royal Mail, and others — are the most common smishing attack in 2026. With billions of packages shipped every year, there's always someone expecting a delivery.

Why Package Scams Work So Well

Factor	Why It Works
High volume	Billions of packages shipped yearly — someone's always waiting
Small amounts	Asking for $1-3 "customs fees" doesn't raise alarms
Urgency	"Package will be returned in 24h" forces quick reactions
Brand trust	USPS, FedEx, UPS are trusted names
Timing	Scams spike around holidays when everyone orders online

Common Variations

1. Customs or Delivery Fee

A text claims your package is held for unpaid customs fees. The link leads to a fake payment page that steals your card details.

2. Failed Delivery Rescheduling

"We couldn't deliver your package. Reschedule here." The link collects your personal information or installs malware.

3. Address Verification

"Your delivery address is incomplete. Update it to receive your package." Another data collection scheme.

4. Fake Tracking Links

"Track your shipment: [link]." The fake tracking page asks for login credentials or installs spyware.

Real vs. Fake Messages

Real Notification	Fake Scam Message
From official short code	From random phone number
Links to official domain (usps.com)	Links to look-alike domain
Includes actual tracking number	Generic or fake tracking number
Never asks for payment via text	Requests card details or small payment

How to Protect Yourself

• Never click links in delivery text messages
• Track packages directly on the carrier's official website or app
• Ignore payment requests — legitimate carriers don't collect fees via text
• Report suspicious texts — forward to 7726 (SPAM) in the US or UK
• Use official apps for delivery notifications

Sharing Delivery Information Safely

Need to share a door code, address, or pickup instructions with a delivery person or someone picking up your package? Don't leave it in a text message that stays forever. Create a password-protected link on LOCK.PUB that expires after use.

What to Do If You've Been Scammed

1. Contact your bank immediately to freeze your card
2. Report to the FTC at reportfraud.ftc.gov
3. File a report with the postal inspection service
4. Change passwords if you entered login credentials
5. Run a malware scan if you downloaded anything

Conclusion

Package delivery scams exploit the fact that most people are expecting a delivery at any given time. The rule is simple: never click links in delivery texts. Go directly to the carrier's website to track your package.

For sharing sensitive delivery information, use LOCK.PUB to create encrypted, expiring links.

---

Legitimate delivery services never request payment via text message. When in doubt, call the carrier directly.