A USPS text scam is an unsolicited text claiming a package is stuck and asking you to open a link and pay a small fee. The Postal Inspection Service says USPS tracking texts go only to customers who requested them with a tracking number, and that such a text “will NOT contain a link”, while the USPS FAQ says the Postal Service “does not charge a fee for redelivery”. Check the delivery yourself at USPS.com.
What a USPS text scam says
The pattern the Postal Inspection Service describes is short: a text you were not expecting, an unfamiliar web link, and a delivery that supposedly needs a response from you. “This type of text message is a scam called smishing,” the agency writes. The USPS FAQ lists the lures it sees most often, among them “your account has been suspended”, “there is suspicious activity on your account”, “there is a problem with your shipping address” and “there is a package waiting for you at the Post Office”.
The wording shifts with the season and with the news. The Postal Inspection Service’s 2025 holiday campaign warned that a message might mention a package delivery, unpaid online postage charges or a “Delivery Failure Notification”. A USPIS video for the 2024 holidays quoted a typical one: “Package has arrived at warehouse and cannot be delivered due to incomplete address information”, then “Click link to confirm your address”. In guidance updated December 1, 2025, the FCC reported a customs and tariff version, with notices claiming an order is “stuck in customs” or that a tariff must be paid before delivery. The FCC also describes a version that costs money without any website: the fake notice gives a 10-digit call-back number that is an international number, where connection fees and per-minute rates run high.
One 2026 example sits in a court file. In the complaint it filed on June 12, 2026 against the operators of a phishing kit it calls Outsider, Google says a Google Messages user in the United States reported a text on May 28, 2026 about a delivery that could not be completed because “A signature was required at the time of delivery”, with a link that spoofed the USPS website. Assertions in a civil complaint are allegations, not findings.
Why the fake delivery texts work
Almost everyone has something in transit, so the message rarely arrives at an impossible moment. The FTC’s December 14, 2023 alert sets out the mechanics: the text says you missed a delivery attempt and asks you to click to reschedule, or says your item is ready but your shipping preferences need updating, and some versions warn that unless you respond right away “they’ll return your package to the sender”.
The sum asked for is small enough to pay without thinking. In a Data Spotlight published April 14, 2025 on reports from 2024, the FTC said package delivery messages, usually impersonating the Postal Service, were the most reported text scam of that year, and that many people reported paying a small “redelivery fee” that turned out to be “a trick to get their credit card or even Social Security number”. Google’s complaint of November 12, 2025 over the Lighthouse kit alleges that the fake page said USPS “will charge for redelivery” and showed a check box reading “I hereby authorize the U.S. Postal Service to charge $0.30.”
Urgency carries the rest. A USPS Postal Bulletin dated March 9, 2023 lists the phrases postal staff were told to watch for, the suspended account, the suspicious activity, the shipping address error and the package waiting at the post office, and states the rule in six words: “USPS does not send unsolicited text messages”.
What a real USPS text looks like
A genuine USPS tracking text is something you switch on. The Text Tracking FAQs tell you to “Send a text to 28777 (2USPS) with your tracking number”, or to register for updates after looking up an item on USPS Tracking, which USPS does “on a tracking number by tracking number basis”. The first time, you are asked to opt in, and a request made through usps.com requires you to reply “YES” to a welcome message.
The reply itself is dull by design. USPS publishes the format: “USPS 01123456789123456789, Available for Pickup 4:55am BOWIE MD 20701 Reply STOP to cancel”. A tracking response carries the sender, the tracking number, the status, in most cases the date, time and location, and instructions for stopping further messages. There is no link, no payment and nothing for you to confirm. For questions about the service itself, USPS gives the number 1-800-222-1811.
The sender is worth a glance before the text is. USPIS says USPS uses five-digit short codes to send and receive SMS, and that USPS “would never contact a consumer via text message, unless the customer initiated the request”.
Informed Delivery, the second way USPS texts you
There is one more route by which a real USPS text can reach you without a request for that particular parcel. Informed Delivery is “a free service from USPS” that shows preview images of incoming mail along with status updates for incoming and outbound packages, and USPS says that if you turn on package tracking notifications you “automatically get text and/or email alerts” with the status and delivery details. A USPS text can therefore arrive because you enabled notifications months ago rather than because you texted a tracking number this week.
USPS says eligibility covers residential, business and PO Box addresses in eligible ZIP Codes, and most ZIP Codes are eligible. From the dashboard you can see package details and tracking history, “Schedule a Redelivery for another day” and add other USPS Tracking numbers manually. USPS requires multifactor authentication for some users and recommends it for all, which matters because the account shows images of your mail.
Real USPS text vs. scam text
The contrasts below come from the USPS Text Tracking FAQs, the USPS scam FAQ, the Postal Inspection Service’s smishing page and the FCC’s page on package delivery scams.
| What to check | Real USPS tracking text | USPS text scam |
|---|---|---|
| How it starts | You texted a tracking number to 28777, registered on USPS Tracking, or turned on Informed Delivery notifications | Arrives unsolicited, often about a package you cannot place |
| Sender | A five-digit USPS short code | Not a short code; one version supplies a 10-digit call-back number that is international |
| Links | None | A link to a look-alike site |
| Money | Nothing to pay; redelivery is free | A small redelivery fee, tariff or customs charge |
| What it asks of you | Nothing; it reports status | Your address, card number, sometimes your Social Security number, and a one-time code |
| Content | Tracking number, status, date, time, location, and how to stop messages | A suspended account, an address error, a failed delivery, a deadline |
No redelivery fee from USPS
On the fee itself the USPS FAQ is one sentence: “USPS does not charge a fee for redelivery.” Redelivery is something a customer arranges, and an Informed Delivery account can schedule one for another day at no cost. USPIS puts the wider version of the same point this way: USPS officials “would never directly contact customers by email or text asking for payment or PII”. A text that ties a delivery to a payment is answering a question the Postal Service does not ask.
How to check a delivery yourself
Four checks, each from the agency that published it:
- Go to the carrier instead of the message. If you are expecting a parcel but the text looks wrong, USPIS says not to click any links, to report it, and to “visit USPS.com from your mobile device or computer for tracking”.
- Go back to the order. The FTC’s April 23, 2025 alert says to “Verify delivery information independently” by looking up shipping and tracking in the retail site or account you ordered from.
- Compare the numbers. The FCC says to “Look closely at tracking numbers and other order details” so they match what the merchant gave you, and to use the tracking links in order confirmation emails.
- Use contact details you already hold. The FTC says to “contact the shipping company using a phone number or website you know is real” rather than anything inside the message.
If you have already opened a page, the Postal Inspection Service’s 2026 warning about AI-assisted scams lists “Mismatched website information” as a red flag: tiny misspellings, a non-secure page asking for login information, or an email domain that does not match the site, with john.doe@USPSUS.com against the real USPS.com as its example.
What happens to card details you enter
The FTC states the outcome without hedging: the click opens a look-alike of a real website that asks for personal or financial information, and if you pay, the money together with your card number, name and address “will go straight to the scammer”. USPIS sets the threshold earlier, advising anyone who has interacted with the URL, even without clicking submit, to “notify your financial institution”.
Google’s two complaints offer a reason that advice is drawn so wide, as allegations rather than proven facts. The Lighthouse complaint alleges that as victims type their payment details, “the Lighthouse interface simultaneously tracks their keystrokes”, so the operator does not need the victim to finish the transaction. It then alleges what follows a submission: the victim lands on a fake multifactor page, the group generates an image resembling the physical card, scans that image with a phone camera and tries to add the card to a digital wallet, which makes the bank send a real one-time code to the victim. The victim, believing the code confirms a purchase, types it into the fake page, and once the card is loaded onto the device the complaint says it can be used for further transactions without new codes. The same filing alleges that scammers load stolen card data onto wallets and sell the phones to others. Google’s June 2026 Outsider complaint describes the same mechanism and alleges the software produces card images so stolen data can be used “with tap-to-pay systems”.
Read against those allegations, a one-time code that arrives while you are sitting on a delivery-fee page may be your own bank asking whether to put your card in somebody else’s wallet. USPIS lists what the criminals are collecting in the first place: account usernames and passwords, Social Security number, date of birth, credit and debit card numbers and PINs, used “to carry out other crimes, such as financial fraud”.
What to do after clicking the link
If you opened the page but typed nothing, close it and leave the keyboard alone, including any code that arrives afterward. Tell your bank anyway, since USPIS asks people who interacted with the link to notify their financial institution even without a submission. Forward the text to 7726, which USPIS says helps get the sending number reported.
For the phone itself, the FTC’s checklist is to update your security software, run a scan, delete anything it flags, then change your passwords and turn on two-factor authentication. USPIS adds a longer-term setting: call your carrier’s customer service, usually 611, and ask them to block text and multimedia messages sent to you as email, a channel these campaigns use.
What to do if you paid or entered card details
For a credit card, the FTC says to report it to the issuer immediately using the number on the back of the card or your account online or in the app, and to ask for a refund, noting that “Federal law protects you from unauthorized use of your credit card.” For a debit card the route is the same, with the bank or credit union contacted immediately and a refund requested, and the FTC states the same federal protection. The Postal Inspection Service’s 2026 consumer checklist opens with the same instinct, telling people to “Contact the bank/payment provider immediately to attempt to stop or trace transfers.”
If you typed more than a card number, the follow-up depends on what left your hands. Where a Social Security number was given and used, the FTC points to IdentityTheft.gov, and to IdentityTheft.gov/databreach for other personal information. USPIS says to change passwords and enable multifactor authentication if login details were shared, and to place fraud alerts and a credit freeze if sensitive financial data was. These are the steps those agencies publish for consumers, not legal advice.
How to report a USPS text scam
USPIS takes USPS-related smishing at spam@uspis.gov and asks for a specific package of information: copy the body of the text into a new email without clicking the link, give your name, attach a screenshot showing the sender’s phone number and the date sent, and say whether you clicked, lost money, handed over personal information or saw any effect on your credit. The Postal Inspection Service says it will contact you if it needs more, and asks you to forward the message to 7726 as well.
The other addresses sit in the same guidance. Postal inspectors also take reports at uspis.gov/report or on 877-876-2455, the FTC at reportfraud.ftc.gov, and the FBI’s Internet Crime Complaint Center at ic3.gov. The FTC adds that you can report the message as junk or spam inside your messaging app. In an April 12, 2024 public service announcement about a similar smishing scheme involving road tolls, IC3 asked complainants to include the phone number the text came from and the website named in it, and to dispute unfamiliar charges.
FTC numbers on text scam losses
The federal figures are published by year, and they are worth taking in that order. In a press release dated April 16, 2025, the FTC said consumers reported losing $470 million in 2024 to scams that started with text messages, five times the 2020 total even though the number of reports declined, and that “The most commonly reported type of text scam was fake package delivery”. The accompanying Data Spotlight ranked the top text scams by hand-coding a random sample of 1,000 text fraud reports from 2024 that carried a narrative, and recorded the share of text scam reports mentioning a loss rising from 5% in 2020 to 4%, 6%, 9% and 11% through 2024.
For 2025 the picture is about reach rather than totals. In testimony to the Joint Economic Committee on March 25, 2026, the FTC said “receipt of a text message was the top reported contact method in 2025” when consumers identified one, while social media led by aggregate reported losses, and that consumers filed 3 million fraud reports with $15.9 billion in reported losses that year. A Data Spotlight of April 27, 2026 breaks down the 2025 reports that indicated a loss by contact method: website or app 31%, social media 28%, phone call 11%, email 10% and text 7%. The FTC notes in the same place that reports were not collected during the 2025 government shutdown, and that people reported far more money lost on Facebook alone than to text or email scams.
Impersonation is where delivery texts land in the FTC’s categories. A release of June 15, 2026 reported $3.5 billion lost to imposter scams in 2025, including nearly $1 billion to business impersonators and about $920 million to government impersonators. An earlier FTC spotlight noted that many Postal Service delivery reports are categorized as government imposters in its public data.
The phishing kits behind the texts
What is known publicly about the operators comes mainly from two lawsuits Google filed in the Southern District of New York, and the claims in them remain allegations. In its post of November 12, 2025, Google described the stuck-package and unpaid-toll texts as “the calling card of a sophisticated, global scam” and said the Lighthouse service “has harmed over 1 million victims across more than 120 countries”, with between 12.7 million and 115 million credit cards stolen in the United States alone, a range the complaint attributes to outside security research and which spans an order of magnitude. The complaint alleges 32,094 distinct USPS phishing websites launched with Lighthouse from July 2023 through October 2024, roughly 200,000 fraudulent sites in a 20-day period drawing “well over 1,000,000 potential victims” in at least 121 countries, an average of 50,000 page visits a day, and more than 600 website templates imitating over 400 organizations. It calls the parcel-delivery text spoof “among the most prolific cyberattacks currently in operation”, and Google brought claims under the Racketeer Influenced and Corrupt Organizations Act, the Lanham Act and the Computer Fraud and Abuse Act.
The second case, filed June 12, 2026, concerns a kit Google calls Outsider. Google says the network is based in China, coordinates through Telegram and distributes kits that let customers blast out fake text campaigns imitating trusted brands, with a subscription the complaint prices “as low as $88 a week”. Google’s figures for the group are hundreds of thousands of victims with losses estimated in the millions, 9,000 fake websites and over a million fraudulent URLs, 55,000 spam texts flagged by Android users in two weeks that May, and 2.5 million messages sent to Android users with links to Outsider-generated sites in the same two weeks. Google said it was coordinating with the FBI and working with AT&T, T-Mobile and Verizon to block the texts.
The complaint’s description of the USPS scheme matches what the agencies warn about: a fake text about a missed package, a link to a fake USPS site demanding a small redelivery fee, and no redelivery to schedule, because “payment” of the “fee” only channels the victim’s payment information to the operators. The same filing records the lures moving on: where earlier campaigns used missed packages or overdue highway tolls, the newest ones claim a problem with a brokerage account or rewards from a mobile carrier.
Where AI comes in
The clearest primary statement is an allegation in the Outsider complaint, which says “The Enterprise encourages scammers to use AI platforms, such as Google’s Gemini” to write the shell website code, which members then paste into the kit to produce a duplicate of a real site in minutes. On their own, the complaint notes, those prompts look like ordinary programming questions.
The statements Google collected in its June 2026 post point the same way without naming package texts. Brett Leatherman of the FBI’s Cyber Division said criminals increasingly use AI “to make fraud like this more convincing and harder to detect”, and T-Mobile and Verizon both describe AI-driven text-message fraud in the same announcement. The Postal Inspection Service’s 2026 warning covers AI scams broadly, voice clones and deepfake video included, saying they “make old cons and tricks appear more real”; Chief Postal Inspector Gary Barksdale said “today’s scammers have many tools at their disposal”.
The same tools are running on the filtering side. Google said in November 2025 that it was using AI to flag common scam messages such as fake toll fees and package deliveries, said in June 2026 that its built-in messaging defenses intercept more than 10 billion malicious messages monthly, and quoted AT&T saying it blocks or labels billions of robocalls and spam texts every month using AI.
How we checked this
Facts checked on October 12, 2026. The sources are primary: USPS and Postal Inspection Service pages, including the Text Tracking FAQs, the Informed Delivery page and the USPS scam FAQ; FTC consumer alerts, data spotlights, press releases and congressional testimony; FCC guidance on package delivery scams; an FBI IC3 public service announcement; and the two complaints Google filed in the Southern District of New York, whose assertions are allegations. Figures appear only in the years and the wording the issuing body used.
