Your phone buzzes. A text says your package couldn’t be delivered and you need to click a link to reschedule. It feels urgent. It looks completely real. For millions of Americans every year, that familiar moment is actually the opening move in a well-rehearsed scam.
Package delivery text fraud has become the single most reported type of text scam in the United States. It’s not close. Understanding exactly how it works, why it keeps succeeding, and what you can do about it is genuinely worth a few minutes of your time.
The Numbers Are Hard to Ignore
In 2024, consumers reported losing $470 million to scams that started with text messages, and the most commonly reported type was fake package delivery. That figure is five times higher than what was reported in 2020, even though the number of individual reports actually declined.
Because the vast majority of scams and fraud are never reported, the FTC notes this number likely reflects only a fraction of the actual harm. In other words, $470 million is not the ceiling. It’s probably closer to the floor.
What “Smishing” Actually Means
A package delivery scam is a phishing or “smishing” attack that pretends to come from a trusted carrier like USPS, FedEx, UPS, DHL, or another delivery service. The word smishing combines “SMS” with “phishing,” and it’s become the preferred tool of delivery fraudsters because text messages feel personal and immediate in a way that email no longer does.
Text messages boast open rates as high as 98%, increasing the odds recipients will react before questioning authenticity. That statistic alone explains why scammers have shifted so aggressively toward this channel. They’re not guessing. They’re following the numbers.
The Exact Text Message They Send
Messages about package deliveries, usually from someone pretending to be from the U.S. Postal Service, were the most reported text scam in 2024. These messages say there’s a problem with a delivery and link to a website that looks like the real USPS site. Many people reported paying a small “redelivery fee” that turned out to be a trick to get their credit card or even Social Security number.
The message usually includes a link that leads to a very realistic-looking website using official logos, fake tracking numbers, and convincing language. It’s designed to move fast and feel routine. One glance, one click, one small payment, and the damage is done.
Why the Small Fee Trick Is So Effective
Victims are told there’s a problem with their delivery and tricked into paying a small “redelivery fee,” which is a ploy to steal their credit card or Social Security numbers. The fee is usually tiny on purpose. Ninety-nine cents. A dollar fifty. Something so trivial that it doesn’t trigger suspicion.
One person who contacted the AARP Fraud Watch Network paid just 99 cents and later discovered $400 had been charged to their card. Once scammers have a valid card number, the small initial charge is just the beginning. The real damage comes later, often days or weeks after the original message is forgotten.
The New Tariff Twist Scammers Are Using Right Now
New de minimis tariff rules went into effect in August 2025 on imported goods priced under $800. It’s unclear to most consumers how much they owe for import duties and when they should be paid. Capitalizing on that confusion, fraudsters have adjusted their package delivery text scams to claim that you owe a tariff that must be paid before your order can be delivered.
Watch out for text notices saying your purchase is “stuck in customs” or that your order will not be delivered until a tariff is paid. It creates urgency and fear to make people panic and click without thinking twice, eventually giving the crooks payment information when they try to pay the fees. This is a genuinely new evolution of an old scam, timed precisely to real-world policy changes.
Holiday Season Is Peak Season for These Scams
These scams surge around the winter holidays as more consumers shop online, according to the Better Business Bureau. New data from cybersecurity firm NordVPN shows malicious postal service websites jumped 86% in the past month alone, as scammers increasingly impersonate well-known delivery brands.
When online orders go up, fake USPS, UPS, and FedEx texts go up with them. Scammers count on the fact that most people are probably expecting a package, which makes the bait harder to dismiss. The timing is not accidental. It’s the whole strategy.
How Scammers Spoof Legitimate Carriers So Well
The scam works by impersonating the visual identity and tone of major carriers including USPS, FedEx, UPS, DHL, and Amazon Logistics, creating a plausible reason to click a link or call a number. The FBI and USPS Postal Inspection Service issued joint warnings in 2024 about a dramatic surge in USPS-branded smishing, noting that some campaigns were sophisticated enough to spoof legitimate USPS short code numbers, making the texts appear in the same thread as real USPS messages on some devices.
Scammers often “spoof” phone numbers and web addresses, sometimes changing a single character to appear legitimate. When a fake text sits right next to a real one in your message thread, even careful people get fooled.
What USPS, FedEx, and UPS Will Never Actually Do
USPS will not send customers text messages or emails without a customer first requesting the service with a tracking number, and it will not contain a link. Unless you explicitly sign up for status alerts on a package, you won’t receive a text from USPS. That’s the clearest rule of thumb available, and it comes straight from the United States Postal Inspection Service.
Legitimate delivery companies will not send unsolicited texts or emails asking for personal information unless a customer has specifically signed up for delivery alerts. If you didn’t opt in, and the text has a link or asks for money, treat it as a scam until proven otherwise.
What Happens After You Click
When your card details and home address land in the hands of a smishing operation, they rarely stop at one unauthorized charge. That data gets sold, combined with details from other breaches, and used to open accounts in your name.
It’s not always clear what the criminals do with the personal information they collect through smishing, but they may sell it to other bad actors or plan to use it in the service of future scams. You are more likely to trust future communications from them if they can provide personal details about you. A single click can quietly open a door that takes months to close.
How to Protect Yourself Starting Today
The FTC recommends not clicking links in unexpected delivery messages and instead checking shipping status through the retailer or carrier website you know is real. Tracking numbers should be entered directly into a carrier’s official website or app, rather than clicked from a message. It takes an extra thirty seconds and it’s the most reliable protection available.
Forward suspicious texts to 7726, which helps wireless providers block similar scams. Report scams to the FTC at ReportFraud.ftc.gov. The BBB also advises shoppers to keep track of what they have ordered, which can make it easier to spot messages that don’t add up. Keeping a simple list of active orders is genuinely one of the more underrated defenses against this type of fraud.
The Takeaway
Package delivery scams succeed not because people are careless, but because the messages arrive at exactly the right moment, look exactly right, and ask for almost nothing. That combination is hard to resist in a distracted, busy day.
The most useful thing to remember is a single rule: if you didn’t request it, don’t click it. Go directly to the carrier’s website, type in your tracking number manually, and verify from there. Scammers rely on urgency, fear, and convenience. Taking a few extra seconds to verify can save you money, identity theft headaches, and long-term damage. That pause between the buzz and the click is worth more than it seems.
AI Disclaimer: This article was created with the assistance of AI tools and reviewed by a human editor.