Package Delivery Text Scams: USPS, UPS and FedEx Fakes

If you got a text saying your USPS, UPS or FedEx package is stuck and you need to "confirm your address" or "pay a small fee," it is almost certainly a scam. Real carriers do not text you a payment link out of the blue, and they do not ask for your card number to release a package. Delete the message, do not tap the link, and if you already did, keep reading — the first hour matters.

We are Getshure, a small American publisher and protection service. We write about scams in plain English and we make tools that help ordinary people catch more of them. This guide is what we tell our own families.

Why delivery text scams work

Almost everyone is waiting for a package. Scammers send millions of texts knowing that a good share of recipients really do have something in the mail. The message looks urgent — "final notice," "held at facility," "redelivery fee $1.99" — and the link looks almost right. One tap and you are on a page that copies the USPS, UPS or FedEx logo and asks for your address, card and sometimes a one-time code from your bank.

The Federal Trade Commission tracks package delivery scams as one of the most reported text scams in the country. The FBI's Internet Crime Complaint Center (IC3) does too. That is why your phone is getting hit.

What a fake delivery text looks like

Scam texts change wording constantly, but the pattern is the same. Common examples:

• "USPS: Your package is on hold due to an incorrect address. Please confirm within 24 hours: [link]"
• "UPS Alert: Delivery failed. A small customs fee of $2.99 is required to re-schedule: [link]"
• "FedEx: We tried to deliver your parcel. Update address here or it will be returned: [link]"
• "USPS final notice: package will be returned to sender today. Pay $1.95 redelivery: [link]"

The link often uses an odd top-level domain or a long string of letters, something like usps-redelivery-notice.top or ups-trackalert.shop or fedex-parcel-hold.click. Those are invented examples, but that is the shape. Real US carriers do not send payment links on domains like that.

Six quick red flags

1. You were not expecting a notification like this. You did not sign up for carrier text alerts, or the tracking number does not match anything you ordered.
2. It asks for money. A few dollars for "redelivery," "customs" or "handling." Real USPS, UPS and FedEx do not text you a card-payment link for small fees.
3. It asks for personal info. Full address, date of birth, Social Security number, bank login, or a code from your bank's text — all red flags.
4. The link is not the carrier's real site. Do not trust the link in a text. Type the carrier's name into your browser yourself.
5. Urgency and threats. "Final notice," "24 hours," "will be returned today." Pressure is a scam tool.
6. The sender is a random mobile number or email address. A text from a personal-looking number claiming to be USPS is not USPS.

What to do when a suspicious delivery text arrives

1. Do not tap the link. Do not long-press it to preview either on an older phone — just leave it alone.
2. Check tracking yourself. Open your browser and type the carrier's name in by hand, or go to the order confirmation email from the store you bought from. Use the tracking number there.
3. Report the text. On iPhone and Android, forward the message to 7726 (that spells SPAM). Your carrier uses these reports to block scam numbers. It is free.
4. Report to the FTC. File a quick report at reportfraud.ftc.gov. If you lost money, also file at ic3.gov.
5. Delete the message. Then block the sender in your messaging app.

Reporting straight to the carriers

Each of the big three carriers has a published fraud reporting process. Do not trust a reporting link in a text either — go to the carrier's real site by typing it in yourself, then search for "report fraud" or "report phishing." USPS, UPS and FedEx each publish an email address for forwarding suspicious messages. We do not list those addresses from memory here because scam copies of them circulate; look them up on the official site.

What to do if you already clicked the link

Clicking alone usually does not install anything on a modern iPhone or Android. The danger is what happened on the page after you clicked.

If you only opened the page and typed nothing

1. Close the browser tab.
2. Clear your browser history and cache for that site.
3. Watch for texts over the next few days — scammers often follow up.

If you entered your address and phone number

Expect more scam texts and calls. Your info is now on a scammer's list. Nothing is on fire, but tighten up:

• Do not answer calls from numbers you do not know. Let them go to voicemail.
• Be extra suspicious of any follow-up calls claiming to be "USPS fraud team," "your bank" or "Amazon." That is the common second-stage play.

If you entered your card number

1. Call the number on the back of your card right now. Ask them to cancel the card and issue a new one.
2. Review recent charges and dispute anything you did not make.
3. Turn on transaction alerts in your bank's app.

If you entered a bank login or a one-time code from your bank

1. Call your bank immediately using the number on your card, not any number in a text or email.
2. Change your online banking password from a device you trust.
3. Ask the bank to review recent transfers, Zelle activity and new payees.
4. File a report at reportfraud.ftc.gov and ic3.gov.

If you entered your Social Security number

1. Go to identitytheft.gov and start a recovery plan.
2. Place a free credit freeze at all three bureaus: equifax.com, experian.com and transunion.com.
3. Pull your credit reports at annualcreditreport.com.

Our step-by-step guide Just Got Scammed? What to Do in the First 10 Minutes walks through the full recovery sequence calmly.

How to tell a real carrier message from a fake

A simple rule: trust the sender, not the message. If you ordered from a store and are expecting a package, open that store's order confirmation email and click the tracking link there. That link goes to the real carrier page. Any "carrier" text you did not sign up for is suspect by default.

USPS Informed Delivery is a free service you have to sign up for and verify your identity through USPS directly. If you did not sign up, USPS is not texting you.

UPS and FedEx do offer delivery alerts, but you have to turn them on in your account, and they do not ask you to pay small fees by text link to release a package.

The quick checklist (save this)

• I did not click the link.
• I checked tracking on the retailer's order email, not the text.
• I forwarded the text to 7726.
• I reported it at reportfraud.ftc.gov.
• I deleted and blocked the sender.
• If I did click: I know what information I entered and I acted on each item above.

How the Getshure app helps with text and call scams

You can do all of the above by hand, every time, for the rest of your life. Most people will not. That is why we built the Getshure app and include it with every protection plan.

For package delivery and related scams, these features do the most work:

• Scam Shield. Identifies likely scam and spam callers, helps block robocalls, and lets you look up an unknown number before you call back. A lot of delivery text scams have a follow-up phone call — Scam Shield helps you catch those.
• Breach check. Shows whether your email or passwords appear in known data breaches. If your info is already out there, you understand why the scam texts are coming.
• Data broker removal. Sends removal and opt-out requests to people-search and data broker sites. Each site decides if and when it removes a record, but fewer listings means less of your info for scammers to buy.
• Safer browsing on public Wi-Fi and tracker blocking, which reduce how much of your activity gets harvested in the first place.
• Phone security score with plain-English steps to tighten up your device.

No app can block every scam text or every scam call — anyone who tells you otherwise is overselling. What a good app does is catch more of them and give you a faster way to check what is real.

The Getshure app is included with every protection plan and billed only by Getshure. Plans today start at $9.99, $29.99 or $79.99 depending on the plan you pick, then $29.99 every 30 days until you cancel, with a reminder email about 3 days before each renewal. You can cancel in one step at getshure.com/cancel, and every plan charge is covered by our 30-day money-back guarantee. More on the app: The Getshure App: What It Does and What It Can't Do.

Android users can grab the app here: Getshure on Google Play. iPhone users: use the download link in your Getshure order confirmation email. See Getshure App Sign In: How to Activate After Your Order if you need help.

The book: Don't Get Screwed by AI

If you want the full playbook on text scams, voice-cloning calls, fake delivery pages, romance scams and the AI tricks scammers are using in 2025 and 2026, read our hardcover Don't Get Screwed by AI ($29). It is plain English, no jargon, built for adults and parents who want one clear book on the shelf instead of a hundred browser tabs. Free US shipping on orders of $40+. Returns accepted within 30 days of delivery.

Related reading

• The Unpaid Toll Text Scam: What It Is and What to Do
• Fake Bank Text Message: How to Spot and Stop It
• How to Check if a Phone Number Is a Scam: Quick Guide
• How to Report a Scam in the US: FTC, IC3 and Your Bank

Ready to stop guessing on every text?

You do not need to become a cybersecurity expert. You need a short checklist, a book you can trust, and a tool on your phone that quietly does the boring parts.

Here is a clear next step:

• Pick a Getshure protection plan and get the Getshure app on your phone today. Cancel in one step. 30-day money-back guarantee.
• Add the book Don't Get Screwed by AI so someone in the house always has the answer on hand.
• Prefer to talk to a human first? Call us at (754) 812-1679, Monday–Friday, 9:00 AM – 6:00 PM Eastern, or email contact@getshure.com. We are a real American company (MetaWise Enterprises, LLC, Delaware file 10336625) with a US address and written policies you can read before you buy: About, Refund Policy, Subscription Terms.

Delete the fake text. Then set yourself up so the next one is easier to ignore.