Package on hold: the fake USPS text and other delivery scams

Package on hold: the fake USPS text and other delivery scams

"USPS: Your package could not be delivered due to an incomplete address. Pay the $1.68 redelivery fee here." Plus a link. This text, sent in the name of USPS, UPS, FedEx, DHL, or Amazon depending on the wave, is one of the most persistent text scams out there. It works because almost everyone shops online and almost everyone has a package on the way at some point: the message lands on fertile ground.

The amount is deliberately tiny. The goal was never to collect $1.68: it's to get you to enter your full card details on a fake site that imitates the delivery company, and sometimes also the verification code you get afterward, so they can make bigger charges.

Why it works even when you're not expecting a package

The scammers don't know whether you're expecting a delivery. They don't need to:

• Volume. They send the same text to thousands of numbers. With so much online shopping, a large share of recipients really do have something on the way or had something recently, so the message fits.
• A tiny amount. A dollar or two doesn't set off alarms. Nobody double-checks a $1.68 payment the way they'd check a large one.
• Urgency and zero friction. "Pay now and get it tomorrow" pushes you to deal with it on the spot, from your phone, without stopping to check the sender or the domain.
• A rotating disguise. When one brand burns out (people start warning each other that "the USPS text is fake"), the campaign switches to another carrier. The skeleton is always the same as the fake unpaid-toll text (E-ZPass, SunPass, FasTrak, and others): a known name + a pending issue + urgency + a payment link.

How to spot the fake text

None of these signs is conclusive on its own, but together they're a fairly reliable diagnosis:

• It asks you to pay a fee through a link. Never pay customs fees, postage, or a "redelivery fee" through a link in a text you weren't expecting. If a real charge is due, you'll see it when you look up your tracking number on the carrier's official website or app.
• USPS doesn't text out of the blue. USPS only sends texts or emails if you first requested tracking updates with a tracking number, and those messages don't contain a link. An unrequested "USPS" text with a link is fake.
• The link isn't the official domain. Domains with extra hyphens and words ("usps-redelivery", "fedex-delivery-help") or odd endings. On a phone screen, in a hurry, they slip past you; look calmly and they stand out.
• No real tracking number. The fake text talks about "your package" in general terms because it doesn't know which one. A real notice includes the tracking number, and it matches the one the store gave you.
• A random sender. Sometimes an ordinary 10-digit number, sometimes an email address made to look like the company's. The sender of a text can be faked: it proves nothing.
• Sloppy writing. Clumsy phrasing, odd capitalization, exaggerated urgency ("final notice before your package is returned"). Real companies write better than this.

How to check a real delivery

The method is always the same, and it works for any company:

1. Don't tap the link in the text. Close it.
2. Open the official channel yourself: the app of the store where you ordered, the order confirmation email, or the carrier's official website, typing the address yourself.
3. Enter your tracking number there. If there's a real issue (customs, an incomplete address, a missed delivery), it will show up in the official tracking. If nothing shows up, the text was fake.

This sequence (close the message, go to the official channel yourself) is the same one we recommend for checking a call or text from your bank, or a message from the IRS or Social Security; you'll find both in our step-by-step guides. It's the habit that cuts off the most fraud at the root.

What to do if you already entered your card

• Call your bank now, explain what happened, and ask them to block the card and issue a new one. That stops the problem cold.
• If you also entered a verification code that came by text, tell the bank that too: a transaction may already have been approved.
• Watch your account over the following weeks and turn on transaction alerts in your bank's app. Fraudulent charges don't always show up right away.
• Report the text: forward it to 7726 (SPAM) so your carrier can block similar messages, and report it at ReportFraud.ftc.gov. If it used the USPS name, also email [email protected], as the U.S. Postal Inspection Service recommends. If money was taken, file a report with your local police.
• Report the sender's number in the spam numbers directory.

Quick questions

What if I am expecting a package and the text seems to match? A match proves nothing: with so many orders in transit, getting it right by chance is easy. Always check through the official channel with your tracking number. It takes a minute and clears up any doubt.

Do delivery companies really send texts? Yes, some send delivery notices or missed-delivery alerts. The difference is that a real notice doesn't ask you to pay through a link: it points you to the official app or website, mentions your tracking number, and doesn't rush you with threats to return the package. In the case of USPS, the texts you sign up for don't include a link at all.

Does the same thing happen on WhatsApp or by email? Yes, the same bait shows up on WhatsApp, in email, and even in QR codes on fake stickers. The channel changes; the defense doesn't: never pay through a link someone sends you, and always check through the official channel yourself.

If you've received one of these messages, report it in the NoCall spam numbers directory: these campaigns reuse numbers for days, and your report is the warning the next person will see before entering their card number.