USPS text scams: how to spot the fake package notice
Quick answer
A text about a USPS package that you didn't ask USPS to track, and that has a link, is a scam called smishing. USPS says it only texts you after you request tracking with a tracking number, and those texts have no link. Don't tap it. Report it and track the parcel on usps.com.
- Pretends to be
- USPS
- Last updated
How it works
Smishing is phishing by text. The message looks like it's from USPS: a package is held, an address is incomplete, or a small fee is due. A link takes you to a fake page.
The Postal Inspection Service says the goal is personal and financial information: usernames and passwords, Social Security number, date of birth, card numbers and PINs. Criminals then use it for financial fraud.
USPS tracking by text is free and works the other way around. You start it by providing a tracking number, and the messages you get back don't contain a link. If you never asked USPS to track a package and the text has a link, it isn't from them.
Red flags
- A tracking text you never requested
- A link in the message
- A fee to release or redeliver a package
- A sender that isn't a USPS short code you signed up for
- Urgent wording about a deadline
- A package you aren't expecting
Example message
USPS: your package could not be delivered due to an incomplete address. Confirm your details and pay a small redelivery fee at [link] within 24 hours or it will be returned.
What to do
- 1
Don't click the link
If you're expecting a parcel, go to usps.com on your phone or computer and enter the tracking number there.
- 2
Report it, then block and delete
Without clicking, copy the text into a new email to spam@uspis.gov, with your name and a screenshot showing the sender's number and the date. Mention if you clicked or lost money. Forward the text to 7726, then block the sender and delete it.
- 3
If you opened the link, call your bank
The Inspection Service says to notify your financial institution if you interacted with the link, even without pressing submit.
- 4
If you entered details, change passwords
Change the passwords you used, turn on two-step verification and consider a credit freeze.
- 5
Check your phone bill
Look for unauthorized charges and report them to your carrier.
Report it
Check if your details are exposed with Serus
Scammers find your number and address on data brokers and people-search sites. Serus removes them.
Why you got it
Texting scams are sent to huge lists of phone numbers, then sharpened with names and addresses from people-search sites and breaches so the message feels personal. Serus finds where your address, phone number and email are listed on data brokers and people-search sites and removes them, and alerts you when your details show up in a breach, so fewer scammers can reach you.
Frequently asked
Does USPS text me about packages?
Only if you start a tracking request with a tracking number. USPS says those texts don't contain a link.
What if I'm really expecting a package?
Still don't use the link. Open usps.com yourself and enter your tracking number.
What does smishing mean?
It's phishing by text message: a deceptive text meant to get you to give up personal or financial information.
I clicked but didn't enter anything. What now?
The Postal Inspection Service says to notify your financial institution if you interacted with the link, even without submitting anything.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
