Fake Delivery SMS Scams: How to Spot USPS, FedEx, and UPS Phishing Texts

You're expecting a package. A text arrives: "USPS: Your package could not be delivered due to an incomplete address. Update your information here." The link looks official. You tap it, enter your details, maybe even your card number for a small "redelivery fee." Within hours, unauthorized charges appear on your account.

This is package delivery smishing — one of the fastest-growing scam types, with millions of fake texts sent every day.

How Fake Delivery SMS Scams Work

Step 1: Spoofed Sender Identity

Scammers send texts that appear to come from "USPS," "FedEx," "UPS," or "DHL." They spoof the sender name so the message may even land in the same thread as legitimate delivery notifications on your phone.

Step 2: Creating Urgency

Common message templates include:

• "Your package could not be delivered — update your address"
• "A customs fee is required before delivery"
• "Your package will be returned in 24 hours — confirm now"
• "Delivery failed — schedule a redelivery"

Step 3: Fake Tracking Website

The link leads to a convincing replica of the carrier's website. The fake page asks for:

• Full name and address
• Credit card number and CVV
• Social Security Number (in some variants)
• Account login credentials

Step 4: Credential Theft

Once you submit your information, scammers use it to make purchases, drain bank accounts, or sell your data on the dark web.

Real vs. Fake Delivery Texts

Feature	Real Text	Fake Text
Sender	USPS, FedEx, UPS	USPS, FedEx, UPS (identical)
Content	Tracking number, delivery date	"Click here to update," payment requests
Links	Official domains (usps.com, fedex.com)	Look-alike domains (usps-redelivery.com)
Personal info requests	None	Card number, SSN, login credentials
Urgency	Standard updates	"Within 24 hours," "Immediate action required"
Opt-in	You signed up for alerts	Unsolicited

How to Verify Deliveries Legitimately

If you receive a delivery text, do not tap the link. Instead:

1. Use the official app — Track packages directly in the USPS, FedEx, or UPS app
2. Visit the website directly — Type usps.com, fedex.com, or ups.com into your browser manually
3. Call the carrier — USPS: 1-800-275-8777, FedEx: 1-800-463-3339, UPS: 1-800-742-5877
4. Check the retailer — Track your order through Amazon, Walmart, or wherever you purchased

Golden rule: No legitimate carrier will ever ask for payment or banking credentials via text message.

What to Do If You Clicked a Fake Link

If you already tapped the link and entered information, act immediately:

1. Freeze your cards — Call your bank or use your banking app to freeze affected cards
2. Change passwords — Update passwords for your bank, email, and any linked accounts
3. Check transactions — Review recent transactions for unauthorized charges
4. Report to your bank — File a fraud report and request a chargeback for unauthorized transactions
5. File official reports — Report to the FTC at reportfraud.ftc.gov and forward the text to 7726 (SPAM)
6. Alert your contacts — Warn family and friends who may receive similar texts

Share Real Tracking Links Safely with LOCK.PUB

When you need to share a legitimate tracking link — with a customer, a colleague, or a family member — sending a bare link via iMessage or Messenger can look suspicious. How does the recipient know it's not another phishing attempt?

With LOCK.PUB, you can:

• Password-protect the link — Only someone with the password can access the tracking page
• Set an expiration — The link automatically expires after delivery is complete
• Build trust — A password-protected link signals that it comes from a verified source

Instead of sending raw tracking URLs that look just like scam links, protect them with a password. Your recipient will know the link is legitimate.

---

Remember: Legitimate carriers never ask for payment or personal information via text. When in doubt, check directly through official apps or websites. And when you need to share tracking links, protect them with a password at lock.pub.