If a text about a USPS, UPS or FedEx package arrives out of the blue with a link, do not click it. Check the package by going to the carrier's website or app yourself, or to the store where you ordered. Then report the message by forwarding it to 7726 (SPAM) and to the FTC at ReportFraud.ftc.gov, and delete it.
Who this is for and what you will have at the end
This guide is for US readers who get texts claiming a delivery problem, an unpaid fee or a missed delivery, and who are unsure whether they are real. At the end you will be able to check any such message in a minute without using its link, report it to the right places for each carrier, and know what to do if you already tapped the link or typed something in.
It covers recognition and response only. It does not describe how to build or send such messages.
What a real delivery notice looks like
Package scams work because real notices exist. Carriers do send messages, but usually because you asked for them: when you gave your phone number at checkout, signed up for tracking alerts, or entered a tracking number.
USPS
The US Postal Inspection Service (USPIS) says that:
- USPS tracking is free, and you must request it yourself, online or by text, using a tracking number.
- USPS does not send unrequested texts or emails.
- Its tracking messages do not contain links.
The FTC's alert on USPS text scams makes a similar point: the message promises an update such as an order confirmation, an "out for delivery" notice, unpaid postage or a missed delivery, and asks you to click a link that leads to a look-alike site asking for personal or financial information. The FTC says the real USPS will not contact you out of the blue about a delivery and will never demand payment to redeliver a package.
UPS
UPS publishes a fraud-awareness page (linked in the References) that explains how to recognize and report fraudulent messages claiming to be from UPS. Use it, not a number or address in a message, to find the current official sender details and reporting address.
FedEx
FedEx publishes a fraud page (linked in the References) covering how to recognize and report scams that use its name. If you receive an unexpected FedEx message, find the tracking or invoice number yourself on fedex.com and contact FedEx customer service using details from that site, not from the message or from a caller.
The comparison
| Carrier | What the carrier or regulator says | Where to confirm |
|---|---|---|
| USPS | No unrequested texts or emails; tracking messages carry no links | USPIS smishing page, usps.com |
| UPS | Publishes guidance on recognizing and reporting fraud | UPS fraud page |
| FedEx | Publishes guidance on recognizing and reporting fraud | fedex.com report-fraud page |
The key difference is that USPS states plainly that it sends no links in tracking messages. For UPS and FedEx, treat any link you did not ask for as untrusted, even if the domain looks right at a glance, because lookalike domains are a common trick.
Warning signs in the message
Use this list on the message in front of you:
- You did not order anything, or you cannot match it to an order, and you did not sign up for alerts.
- A link you were not expecting, especially one that is shortened or does not use the carrier's real domain.
- A fee or payment for "redelivery", "customs", "postage" or "address confirmation". The FTC says the real USPS will never demand payment to redeliver.
- Urgency, such as a package that will be returned today.
- A request for card details, passwords, a Social Security number or a verification code.
- Sloppy grammar, odd capitalization or a number you do not recognize. Polished messages exist too, so do not rely on bad grammar as the only test.
None of these alone proves a scam, and a clean-looking message is not proof of legitimacy. The reliable test is whether you can confirm the delivery without touching the message.
How to check a package without using the link
- Find the order. If you ordered from a retailer, open its website or app, or your account, and look at the order status. The FTC's advice is to check tracking there.
- Use the carrier directly. If you have a tracking number from a receipt or shipping email you trust, type the carrier's address into your browser yourself (usps.com, ups.com, fedex.com) or open its app, and enter the number.
- Call a number you know is real. The FTC says that if a message might be legitimate, contact the company using a phone number or website you know is real, and not the details in the message.
- If you cannot match it to anything, treat it as fake. A package you cannot explain is more likely to be a scam message than a delivery.
For USPS, USPIS adds that if you are expecting a package, you should check USPS.com on your phone or computer rather than clicking the link.
How to report a fake delivery text
Report in this order. Each takes under two minutes.
1. Forward it to 7726
Copy the message and forward it to 7726 (SPAM). The FTC says this helps your wireless provider spot and block similar messages in the future. USPIS recommends this for any smishing. You can also contact your carrier, usually at 611, to ask about blocking spam texts, as USPIS suggests.
2. Use your messaging app's report option
Use the report-junk or spam option in your messaging app, as the FTC advises. This also moves the sender out of your inbox.
3. Report to the carrier
- USPS: Email [email protected] without clicking the link. USPIS asks you to include your name, a copy of the message text and a screenshot showing the sender's number and the date. Questions can go to the Postal Inspection Service at 1-877-876-2455.
- UPS: Follow the reporting instructions on UPS's fraud page.
- FedEx: Follow the reporting instructions on FedEx's report-fraud page.
4. Report to the FTC
Report at ReportFraud.ftc.gov. The FTC's FAQ says to paste the message into the Comments field, without clicking any links, because it cannot accept forwarded messages. For scams that are not USPS-related, USPIS also points to the FBI's Internet Crime Complaint Center at ic3.gov.
Delete the message afterward and do not reply, as USPIS advises.
If you already clicked or typed something
How you respond depends on what happened.
You only tapped the link
USPIS says to notify your financial institution, even if you did not submit any information. Close the page, do not enter anything further and delete the message. The FTC notes that some links lead to spoofed sites and some messages install malware, so a click can have consequences.
You entered card details
Call the number on the back of the card and tell the issuer. Ask them to block the card and issue a new one, and review recent charges. USPIS also suggests reviewing your phone bill regularly for unauthorized charges.
You entered a password
Change that password on the real site, and anywhere else you reused it. Turn on two-step verification, which our guide on enabling two-step verification explains for Google, Microsoft and Apple accounts. If it was a Google account, see recovering a hacked Google account.
You entered a Social Security number or other identity details
Treat this as identity exposure. Report it at IdentityTheft.gov and consider a credit freeze at each bureau. Our article on a credit freeze vs a fraud alert covers how to place one.
You paid money by transfer or payment app
Contact your bank or payment app immediately. See what to do after sending money to a scammer on Zelle, Venmo or Cash App.
Prevent the next one
- Filter or block texts from unknown senders in your phone's settings. The FTC suggests using these filtering options.
- Use tracking inside the retailer's app or your account, so you rarely need a carrier text at all.
- Do not give your phone number for alerts to sites you do not trust.
- If you want carrier notices, sign up for them yourself on the carrier's own site, so you know what real messages look like.
- Remember the same pattern applies to other impersonators; see our guide to IRS impersonation scams.
Checklist
- Unexpected delivery text with a link? Do not click.
- Confirm through the retailer, the carrier's own site or app, or a number you know is real.
- Forward to 7726, report to the FTC, and email [email protected] if it mentions USPS.
- Delete the message without replying.
- If you clicked, tell your bank; if you typed details, call the card issuer and change passwords.
References
- US Postal Inspection Service, Package Tracking Text Scams (Smishing): https://www.uspis.gov/news/scam-article/smishing-package-tracking-text-scams
- FTC, Think that text message is from USPS? It could be a scam: https://consumer.ftc.gov/consumer-alerts/2025/04/think-text-message-usps-it-could-be-scam
- FTC, How to Recognize and Report Spam Text Messages: https://consumer.ftc.gov/articles/how-recognize-and-report-spam-text-messages
- UPS, Protect Yourself From Fraud and Scams: https://www.ups.com/us/en/support/shipping-support/legal-terms-conditions/fight-fraud
- FedEx, How to Recognize and Help Prevent Fraud and Scams: https://www.fedex.com/en-us/report-fraud.html
Comments
Questions and tips are welcome. Comments are checked by the EpiFive team before they appear; please do not share passwords, phone numbers or other private details.