UPS tracking scam texts and emails: how to spot the fake
Quick answer
A text or email saying your UPS package is held and asking you to click a tracking link may be phishing. UPS is the company being impersonated. Don't click: track the package by going to UPS's site or app yourself, and report the message.
- Pretends to be
- UPS
- Last updated
How it works
Scammers pretend to be UPS, the victim, and send a message about a package: a tracking problem, a missed delivery or a fee. The FTC describes phishing messages as stories meant to get you to click a link or open an attachment, often from a company you might actually deal with.
UPS's own fraud page says phishing awareness is key, and that fraudulent emails often pretend to come from trusted senders.
The link leads to a fake page that asks for your card details or login, or installs malware. Because you may really be expecting a package, the message is easy to believe.
Red flags
- A tracking message about a package you didn't order or expect
- A link to "reschedule" delivery or pay a small fee
- A sender address or number you don't recognize as UPS
- An unexpected attachment, such as an invoice or shipping label
- A generic greeting
- Urgency: the package will be returned
Example message
UPS: Your package could not be delivered because of an address problem. Confirm your details and pay the redelivery fee here: [link]
What to do
- 1
Don't click the link
Go to UPS's website or app yourself and enter the tracking number there if you have one. If you're not expecting a package, ignore the message.
- 2
Ask: am I expecting a package from this company?
The FTC advises: if you don't have an account or an order, it could be phishing. Report the message and delete it.
- 3
If you clicked or entered details
Update your security software, run a scan, change passwords you entered and call your card issuer using the number on your card.
- 4
Report it
Report to the FTC at ReportFraud.ftc.gov. Forward phishing emails to reportphishing@apwg.org and texts to SPAM (7726).
- 5
Protect your identity if you gave personal details
See IdentityTheft.gov and our guide on what to do after a data breach.
Report it
Check if your details are exposed with Serus
Scammers find your number and address on data brokers and people-search sites. Serus removes them.
Why you got it
Delivery scams go out in huge batches, but your number is easier to reach if it's in a data broker file or an old breach. Scammers match your phone number or email to a recent order to make a message look right.
Serus finds where your phone number, email and address are exposed and removes them where it can, and alerts you if your details appear in a breach.
More UPS scams
Frequently asked
Is UPS sending these messages?
No. Scammers pretend to be UPS. UPS's fraud page says phishing awareness is key because fraudulent emails often pretend to come from trusted senders.
How do I check a package safely?
Open UPS's site or app yourself and enter the tracking number. Don't use links from a message.
I clicked but didn't enter anything. Am I okay?
Update your security software and run a scan, since links and attachments can install harmful software. Watch your accounts.
Where do I report it?
ReportFraud.ftc.gov, and forward texts to SPAM (7726).
Sources
Something wrong or out of date? Tell us and we'll re-check it.
