Texts about a package or a delivery problem

What the message says

The FTC describes these texts as claiming to be from USPS, FedEx or DHL. They may confirm an order, say a package is out for delivery, or report a problem such as unpaid postage or a missed delivery, with a link to "learn more" or "fix the problem." In the FTC's figures for 2024, fake package-delivery problems were the most commonly reported text scam of all.

Emails work the same way, sometimes with a carrier's logo and a "track your package" button.

Where the link goes

According to the FTC, the link leads to a lookalike of a real carrier's website that asks for personal or financial information. In its look at the top text scams of 2024, the FTC says many people reported paying a small "redelivery fee" that turned out to be a trick to get their credit card or even Social Security number. Anything you pay, and anything you type, goes to the people who sent the text.

Some scam texts, including the toll texts that state officials have warned about, tell you to reply Y and then close and reopen the message to "activate" the link. On iPhones running iOS 17 and 18 with Filter Unknown Senders turned on, Apple's guide says links from an unknown sender can't be opened until you reply or add the sender to your contacts, so the reply is what switches the link on. On iOS 26 it works differently: Apple says that responding to a message from an unknown sender "does not automatically mark the sender as known." Apple's guide for iOS 27 says links from a sender it has screened open once you "mark them as known or add them to Contacts." Whatever your phone, don't reply.

What the Postal Service actually sends

The U.S. Postal Inspection Service, the Postal Service's law enforcement arm, explains how real USPS tracking texts work on its page about package-tracking text scams:

"USPS will not send customers text messages or e-mails without a customer first requesting the service with a tracking number," and it "will NOT contain a link."

U.S. Postal Inspection Service

USPS can also text you about a package you didn't ask about. If you use the Postal Service's free Informed Delivery service and turn on its package notifications, USPS says "you'll automatically get text and/or email alerts" about packages on their way to you. And a sender who buys a label with USPS's online Click-N-Ship service can enter your phone number so you get "shipment status notifications via email, text, or both." Either way, check a delivery by opening the Informed Delivery app or typing usps.com yourself, not through a link in a text.

So if you never signed up for tracking and a "USPS" text arrives with a link, the Postal Inspection Service's advice is not to click it. Even if you are expecting a parcel, it asks you not to click links in a suspicious text: report it and go to USPS.com yourself instead. Other carriers have their own systems; the reliable check for any of them is the same one below. A text without a link isn't proof that it's real, either, so check that kind the same way.

How to check a delivery yourself

1. Start from your order, not the message. The FTC suggests checking the shipping status through the store or account where you placed the order. Its tracking page or your order confirmation will show the real carrier and tracking number.
2. Type the carrier's address yourself if you want to look up a tracking number. Don't use the link in the text.
3. Not expecting anything? Then there's no order to check, and nothing the text can fix for you.
4. Paste the link into our link checker if you'd like to see where it points. Look at the highlighted registered domain: a carrier's name earlier or later in the link doesn't count.
5. Report it. Use your phone's "Report spam" option, or forward the text to 7726 (SPAM); the IRS says forwarding "helps your wireless provider spot and block similar messages." It isn't a number to call. For texts that use the Postal Service's name, the Postal Inspection Service also asks you to email the text of the message to spam@uspis.gov, pasting it in without clicking the link, and to "also attach a screenshot of the text message showing the phone number of the sender and the date sent." Do that before you use "Report spam": on an iPhone, Apple's guide for iOS 27 names the button "Delete and Report Spam."

Packages you didn't order, with a QR code inside

A related pattern arrives by mail. The FTC described an unexpected package with a note asking you to scan a QR code to find out who sent it, and the FBI issued a similar warning in July 2025 about packages that often come without sender information. Scanning can lead to a site that asks for personal and financial information, or to software that steals data from your phone. The FBI notes this one is less widespread than other schemes. The FTC adds that you're allowed to keep merchandise you didn't order. More on this in QR codes on parking meters, packages and texts.

If you already tapped the link or paid

The Postal Inspection Service says that if you interacted with the link at all, even without pressing "submit," you should tell your bank or card company. Call them at the number on the back of your card. If you typed a password, change it, and change it anywhere else you use the same one. If you gave your Social Security number, see what to do about that, including how to freeze your credit. Our "if you clicked" page has the full list.

Related patterns

• Texts about an unpaid tollA small toll balance, a late fee and a link to pay.
• QR codes on parking meters, packages and textsA square code hides a link you can't read until you scan it.
• Emails about an order, invoice or renewal you don't recognizeA big charge you didn't make, and a number to call within 24 hours.