“Your package could not be delivered”: the USPS, UPS and FedEx text scam

Short, slightly off, and always with a link. “USPS: Your package could not be delivered due to an incomplete address. Please update your information within 24 hours.” “Your parcel is on hold at our warehouse, a $1.99 redelivery fee is due.” “FedEx: shipment held for customs duty, pay here.” The sender is a random ten-digit number, an email address or a number from another country, and the link goes to a domain that contains the carrier’s name somewhere in it, followed by something else. The page behind it copies the carrier’s real site well: logo, colours, a tracking number, even a little map. It asks for your name and address first and your card last.

The link. The Postal Inspection Service says a real USPS text only arrives if you signed up with a tracking number, and it does not contain a link. UPS and FedEx texts come from their own short codes and send you to ups.com or fedex.com, not to “usps-redelivery-help.com” or a string of letters on an unfamiliar ending. The money. No carrier asks for a fee through a text to release a parcel; UPS and FedEx both say so on their fraud pages. The clock. “Within 24 hours or the package is returned” is there to stop you from checking. A delivery that failed yesterday can wait ten minutes while you type the tracking number into the carrier’s site yourself.

The fee is small on purpose. People think twice about $200 and hardly at all about $1.99, and nobody calls the bank over a two-dollar charge. The money is not the point. The form captures the full card number, the expiry date, the code on the back and your billing address, which together are enough to use the card elsewhere. Some versions go a step further and ask for the one-time code your bank texts you “to confirm the payment”. Security researchers who studied these kits found that code is often used to add your card to a phone wallet on the criminal’s own device, where it keeps working until the card itself is cancelled.

These texts run all year, but the timing is chosen around the holiday shopping season. From Black Friday through December nearly everyone has a parcel on the way, often several from shops they barely remember ordering from, so “your package is on hold” sounds plausible to far more people than it does in July. The crews behind the biggest campaigns rent ready-made phishing kits: in November 2025 Google sued the operators of one of them, known as Lighthouse, which it said was behind the fake USPS and road-toll texts that reached victims in more than 120 countries. Taking one kit down did not end the scam; the same templates are sold by others. The same pattern runs as fake E-ZPass and toll texts, which use the same page with a different logo.

Call the bank on the number printed on the card, today, and ask for a new card number rather than just a chargeback on the fee. A new number stops the charges that have not happened yet; a dispute only covers the ones that already did. If you typed in a one-time code, say so, and ask the bank to check whether your card was added to a phone wallet you do not own. Go through the last few weeks of statements for small test charges. If you reused a password on the fake page, change it wherever you use it. Your name, address and phone number were in that form too, so expect more targeted texts and calls in the weeks that follow, some of them offering to “recover” the money for a fee.

Forwarding the text to 7726 is the fastest step: it goes to your mobile carrier, which uses the reports to block the sending numbers. For fake USPS texts, the Postal Inspection Service asks for a screenshot showing the sender and date at spam@uspis.gov. UPS takes reports at fraud@ups.com, and FedEx has a reporting form on fedex.com. Then delete the text. Reporting will not stop the next batch, since each run uses fresh numbers and fresh domains, but it gets pages taken down faster, and it is how the FTC and the Postal Inspection Service track the campaigns.

Nobody picked you. The senders work from lists of mobile numbers that are known to be active, and those lists are built from old breaches and from people-search sites that publish your phone number together with your name, age and address. A number that sits on a dozen of those sites gets every wave: delivery texts in December, toll texts in spring, political texts in election years. You cannot undo a breach, but you can take the number off the commercial sites. Our guide to removing your phone number shows how to do it for free, and the short-codes guide covers the legitimate texts that look similar. Brokers tend to re-list a number weeks after a removal, so it is worth checking again later.