Package-delivery text scams

How to check a “held package” text without tapping the link, with official Postal Inspection Service sources.

Written November 12, 2026.

During the holiday shipping season it is ordinary to get real tracking updates from a store you already shopped with. It is also common to get fake texts that look like the Postal Service, UPS, FedEx, or a retailer. The United States Postal Inspection Service (USPIS) publishes guidance on these “smishing” (SMS phishing) package texts and on fake USPS emails. The safe habit is the same for any carrier name in a surprise message: do not tap the link; look the package up yourself.

Warning signs

• A text or email you did not expect says a package is delayed, held, or “needs a small fee or duty” to be released.
• The message includes a short link, a button, an attachment, or a QR code and urges you to act immediately.
• The message asks for a card number, a login, a Social Security number, or a one-time passcode.
• You are not waiting for a package, or the tracking number does not match an order you actually placed.

USPIS describes package-tracking text scams and fake USPS emails on its official scam-article pages (linked below). USPS also maintains a “Scams & Scheme Alerts” help article. Those pages are the official references for USPS-branded messages. Other carriers likewise ask customers to start from the official site or app, not from an unexpected link. We are not reproducing another company’s full policy here; the method — type the official site yourself — still applies.

What to do instead of tapping the link

1. Leave the text alone. Do not reply, and do not call a number that appears only in that text.
2. If you are expecting a delivery, open the retailer’s app or site the usual way, or open the carrier’s official site by typing the address you already know (for the Postal Service, start at USPS.com help or the tracking tool on USPS.com).
3. Enter the tracking number from your original order confirmation, not from the surprise text, unless you have already confirmed they match.
4. If nothing is supposed to be on the way, you can ignore the message. You can also report a suspicious USPS-related email using the contact method on the USPIS fake-email article.
5. If you already tapped a link and entered a password or card number, change that password on a device you trust, watch the account, and tell your bank or card issuer. Report the scam at ReportFraud.ftc.gov.

A credit freeze does not stop you from being tricked into paying a fake “delivery fee,” but it can make it harder for someone who captured your personal information to open a new credit account. See how to freeze your credit for free.