The "Package Delivery" Text Scam

What is it?

Also known as “Smishing” (SMS Phishing), this scam involves you receiving a text message pretending to be from the USPS, FedEx, or UPS. The text claims a package you are expecting cannot be delivered because of a missing address detail or an unpaid shipping fee of just $1 or $2. They include a link to resolve the issue.

How it works (The Teardown)

1. The Text: You receive a message: “USPS: Your package is on hold at the distribution center. Please update your address and pay the $1.50 redelivery fee here: [Link]”
2. The Fake Site: Because almost everyone is expecting a package from Amazon or elsewhere at any given time, you click the link. It takes you to a website that perfectly mimics the official postal service website.
3. The Data Grab: The site asks you to enter your name, home address, and phone number to “update the label.”
4. The Theft: Finally, the site asks for your credit card to pay the tiny $1.50 redelivery fee.
5. The Aftermath: There never was a package. The scammers now have your name, address, phone number, and full credit card details. They will immediately start charging thousands of dollars to your card or sell it on the dark web.

How to identify this scam

• Look at the link: If you look closely at the web address in the text message, it won’t be usps.com or fedex.com. It will be a random scramble of letters, or something tricky like usps-delivery-help.com.
• They ask for money: Legitimate postal services will never text you asking you to pay a fee by clicking a link.

How to avoid it

• Never click links in unexpected texts: If you think there actually is a problem with a package, do not click the link. Instead, go to your email, find the original tracking number from the store you bought it from, and type that number directly into the official UPS or USPS website.
• Filter unknown senders: Turn on the setting on your iPhone or Android to filter text messages from unknown numbers into a separate folder.

What to do if you are affected

1. Cancel your card: If you typed your credit card number into the fake website, call the number on the back of your card immediately and report it as stolen. The bank will cancel it and issue you a new one.
2. Watch for identity theft: Because you also provided your address and phone number, expect an increase in scam phone calls over the next few months. Do not answer calls from numbers you do not recognize.