USPS Text Scam: "Your Package Could Not Be Delivered" Explained

The message is short and almost boring, which is exactly why it works. "USPS: Your package has been held at our facility due to an incomplete address. Please update your details within 24 hours to arrange redelivery." A link follows. Sometimes there is a tracking number that looks plausible at a glance.

Nearly everyone is waiting on something. That is the entire premise. Delivery smishing does not need to be clever or personalized because in any given week a large fraction of the population has a parcel in transit, and the message costs effectively nothing to send to a hundred thousand phones. The sender has no idea whether you ordered anything. They are betting on the base rate.

What makes this campaign unusually effective is the size of the ask. A redelivery fee of $1.99 does not trigger the alarm that a request for $500 would. It feels like friction, not theft — an annoying administrative charge. And that is deliberate, because the fee is not what the operation is collecting.

What the fake fee is actually for

When you land on the cloned USPS page and enter your details to pay $1.99, you hand over a complete card-not-present package: full card number, expiry date, CVV, cardholder name, billing address and often your phone number. The $1.99 may not even be charged. In many campaigns the page returns a plausible error and redirects you to the real usps.com, so nothing feels wrong and you never think about it again.

The card data is then either used directly or sold in bulk. The first sign is usually a small test charge — a few dollars at an unfamiliar merchant — placed to confirm the card is live before anything larger is attempted. People routinely dismiss these as forgotten subscriptions, which is precisely the reaction the test is designed to produce.

A second, more damaging variant asks you to "verify your identity" with a code sent to your phone. That code is not from the scam site. It is a genuine one-time passcode triggered by the fraudster attempting to log into your bank, add a payee, or enroll your card in a mobile wallet on their own device. Typing it into their page completes that action.

Why delivery scams spike around holidays

Volume rises sharply from late November through January, and around major retail events. The reason is simple base rates again: when more people have parcels in transit, a higher share of random recipients will find the message plausible. The same campaigns are recycled with FedEx, UPS, DHL and Amazon branding, and the template barely changes — only the logo and the sender name.

A related variant arrives as a physical door hanger or slip rather than a text, carrying a QR code to "reschedule delivery". It resolves to the same category of cloned payment page. We cover the mechanics of that in our guide to QR code phishing.

How to check a delivery notification safely

There is a single rule that makes every one of these messages harmless, and it costs about fifteen seconds: never navigate from the notification. Go to the carrier yourself.

1. Do not tap the link. Screenshot the message first if you intend to report it.
2. Open usps.com by typing it, or use the official USPS app you installed from an app store.
3. Paste the tracking number from the text into the site's own tracking box. If it is invalid or unknown, the message was fabricated.
4. Cross-check against your order confirmations. If nothing is in transit, you have your answer.
5. Sign up for USPS Informed Delivery if you want genuine notifications. Real alerts you opted into are far easier to distinguish from fakes.
6. Forward the text to 7726 (SPAM), then delete it. This is free on all major US carriers and feeds carrier-level blocklists.

If you already entered your card details

The durable lesson here is smaller than it looks. Delivery smishing is not a sophisticated attack; it is a cheap message that exploits a moment when almost everyone is expecting something. It fails completely against one habit — going to the carrier yourself instead of following the notification. That habit generalizes to bank alerts, toll notices, tax messages and everything else in this category, which is why it is worth building once rather than learning six separate warning lists.

Editorial note: This guide is general consumer education, not legal or financial advice. Dispute deadlines, liability limits and reimbursement policies vary by institution and change over time. Confirm your specific rights with your bank or a qualified professional. See our editorial policy for how we research and review this content.