Scam Prevention
Package Delivery Text Scam: How Seniors Can Spot the Fake Before Clicking
Last updated: 2026-07-03
The Answer First: A Real Delivery Company Will Never Text You a Link Asking for Payment
If you got a text saying your package is "on hold," "delayed," or needs a "redelivery fee" — and it wants you to tap a link and enter your card number — it's almost certainly fake. USPS, FedEx, UPS, and Amazon do not send text messages asking you to pay a fee to release a package. Ever.
This scam has a name: smishing, short for "SMS phishing." It works exactly like a phishing email, except it arrives as a text message on your phone, which many people trust more than email simply because it feels more personal and immediate.
This guide walks through exactly what these texts look like, the five giveaways that separate a fake from a real delivery notice, and what to do if you've already tapped the link.
Why You're Getting These Texts Right Now
You don't need to have ordered anything for this scam to land in your messages. Scammers send these texts in bulk, to thousands of phone numbers at once, betting that enough people are expecting some package that they'll assume the text applies to them.
That's the whole trick. Between holiday shopping, prescription refills, subscription boxes, and everyday online orders, almost everyone has a package moving through the mail at any given time. The scammer doesn't need to know what you ordered — they just need you to think, "Oh, that must be the thing I bought last week."
The Federal Trade Commission and the U.S. Postal Inspection Service have both issued public warnings about this exact scheme because it has become one of the most common text-based scams reported by consumers of every age — but it's especially effective against people who do a lot of their shopping and bill-paying online and are used to getting legitimate shipping updates by text.
What These Fake Texts Actually Look Like
Scam texts about package deliveries tend to follow a small handful of scripts. Once you've seen them, they're much easier to recognize.
The "unpaid fee" text. "USPS: Your package could not be delivered due to an unpaid shipping fee of $2.99. Update your info here: [link]" This is the most common version. The small dollar amount is intentional — a $2.99 charge feels too small to worry about, so people pay it without thinking.
The "reschedule delivery" text. "FedEx: We attempted delivery today but no one was home. Reschedule your delivery: [link]" This version preys on the fact that missed deliveries are a real, everyday annoyance, so the message feels plausible.
The "verify your address" text. "Amazon: We were unable to verify your shipping address. Confirm your details to avoid delay: [link]" This version tries to harvest your full name, address, and sometimes payment information under the guise of "confirming" it.
The "your package is on hold" text. "USPS: Your package is on hold at our facility. Click here to schedule pickup: [link]" This one adds urgency by suggesting your item might be returned to sender if you don't act fast.
Notice that all four rely on the same emotional trigger: a small, specific-sounding problem with a deadline attached, paired with a link that promises to fix it instantly.
Five Ways to Tell a Delivery Text Is Fake
Before you tap anything, run the message through these checks.
1. Did you actually order something you're expecting? If you can't think of a single package currently in transit, that's your first and strongest clue. Even if you have something coming, real shipping updates almost always match the tracking number and retailer you actually used.
2. Does it ask for money or payment information? Legitimate delivery companies do not charge a "redelivery fee" or "customs fee" through a text link. If a package genuinely requires a customs payment (rare, and only for international shipments), it comes through an official notice — not a text with a payment link.
3. Look at the sender. Real shipping notifications typically come from a short code (a five- or six-digit number) that you can look up on the company's official website, or from the same number you've received legitimate texts from before. Scam texts often come from a random 10-digit phone number, an email address, or a number with a country code that doesn't match yours.
4. Check the link itself — without tapping it. On an iPhone, you can press and hold a link to preview the web address without opening it. On Android, tapping and holding does the same. Look closely: a fake link might read something like "usps-tracking-update.net" or "fedex-delivery.info" instead of the real "usps.com" or "fedex.com." Scammers count on you not reading past the first few letters.
5. Notice the tone. Real delivery notifications are informational and calm: "Your package has shipped" or "Delivered to your mailbox at 2:14 PM." Scam texts almost always create urgency — "act now," "final notice," "your package will be returned" — because urgency is what stops people from thinking it through.
If a text fails even one of these checks, don't tap the link. If it fails two or more, delete it.
What to Do Instead of Clicking the Link
The safest habit is also the simplest one: never track a package by tapping a link in a text you didn't expect.
Instead:
Go directly to the source. Open the retailer's app (Amazon, for example) or type the shipping company's official web address directly into your browser — usps.com, fedex.com, ups.com — and check your order status there.
Use the tracking number the honest way. If you have a legitimate tracking number from an order confirmation email, you can copy just the number (not any link) and paste it into the official carrier's website tracking tool yourself.
Call the company directly if you're unsure. Use the phone number printed on a past bill, on the company's official website, or on the back of a card — never a number provided in the suspicious text itself.
When in doubt, do nothing. If the text is fake, ignoring it costs you nothing. If it were somehow real (it almost never is), the company will follow up through your account, your email, or your regular mail.
Adding an Extra Layer of Protection
Even careful people get a text at the wrong moment — distracted, expecting a package, running late — and tap before thinking. A couple of tools can catch what a moment of distraction misses.
Browse and check links more safely with a VPN. A VPN (virtual private network) encrypts your phone's internet connection and can help block known scam and malware sites before they load, adding a layer of protection if you ever do end up on a suspicious page while double-checking a tracking link. NordVPN installs in a few minutes — you open the app, tap one button, and your connection is protected whether you're on your home Wi-Fi, a coffee shop, or anywhere else.
Affiliate Disclosure: This article may contain affiliate links. If you make a purchase through these links, we may earn a small commission at no extra cost to you. We only recommend products we genuinely believe in. This helps support our work and allows us to continue providing free content.
If You Already Tapped the Link
Don't panic, and don't be embarrassed — these texts are designed by professionals to fool careful people. Here's what to do, in order.
1. Close the page immediately. If you haven't entered any information yet, close the browser tab or app and delete the text. No harm done.
2. If you entered payment information, call your bank or card issuer right away. Use the number on the back of your card. Explain that you entered your card number on a suspicious link and ask them to watch for or block fraudulent charges. Many banks can issue you a new card number within days.
3. If you entered a password, change it immediately. Do this from a different, trusted device, and turn on two-factor authentication for that account if it isn't already on.
4. Watch your accounts closely for the next few weeks. Check your bank and credit card statements daily for any charge you don't recognize, even small ones — scammers sometimes test a stolen card with a tiny charge before making a larger one.
5. Report the text. Forward it to 7726 (which spells "SPAM" on your keypad) — this reports it directly to your mobile carrier. You can also file a report at reportfraud.ftc.gov, and if the text impersonated USPS specifically, report it to the U.S. Postal Inspection Service at uspis.gov.
The Short Version to Print and Keep
- Real delivery companies never text you a link asking for payment to release, reschedule, or "verify" a package.
- Ask yourself first: Am I actually expecting a package right now?
- Check the sender and the link — a random phone number or a web address that doesn't exactly match the real company's name is a red flag.
- Never tap the link. Go directly to the retailer's app or type the official website address yourself.
- If you already tapped it and entered information: close the page, call your bank, change your passwords, watch your statements, and report the text by forwarding it to 7726.
One Habit Away From Safe
Package delivery texts have become such a normal part of daily life that scammers are counting on you to react on autopilot. The fix isn't complicated — it's a five-second pause before you tap. Ask yourself what you're expecting, look at where the link actually goes, and when in doubt, go straight to the source yourself.
If you found this guide helpful, consider subscribing below for our free weekly security tips — written specifically for adults who didn't grow up with the internet but refuse to be easy targets. One short email a week, plain English, no technical jargon.
A little caution goes a long way. You've got this.
Subscribe to ClearShield Weekly
Get one practical security tip every Tuesday — written for adults 55+, jargon-free, and always free.