Is that delivery text a scam? How to check USPS, FedEx and UPS messages

A text says your package couldn't be delivered and asks you to tap a link. There's a good chance it's a parcel text scam: the FTC says delivery messages, usually posing as the U.S. Postal Service, were the most reported text scam of 2024. Real delivery texts exist too, so here's how to tell them apart without touching the link.

What do fake package delivery texts say?

The FTC and FCC describe the same few stories:

• A problem with the delivery: a missed attempt, unpaid postage, or an address or shipping preference to update.
• A small "redelivery fee," which the FTC says many people found was a trick to get their credit card or even Social Security number.
• A package "stuck in customs" or held until a tariff is paid, a version the FCC says plays on confusion about tariffs.
• A deadline: respond right away or the package goes back to the sender.

The link takes you to a look-alike of a real website, the FTC says, where anything you enter goes to the scammer, and it could also install malware. Some notices give a phone number instead. The FCC says never to call back a number from an unexpected delivery notice: you may reach a scam "operator," or an international number with high connection fees.

How can you tell a real delivery notice from a fake one?

None of the three big carriers says it never texts, and all three offer text updates you can sign up for. What each says about unexpected messages is narrower.

Is it a USPS scam text?

The U.S. Postal Inspection Service says USPS won't text or email you unless you first requested the service with a tracking number, and that those messages "will NOT contain a link." USPS's own pages add one more route: if you use Informed Delivery and turn on package tracking notifications, USPS says you'll automatically get text or email alerts about your packages. Either way, you'd have started this yourself, by registering online, turning on those alerts or texting a tracking number to 28777 (2USPS). USPS also says it "does not charge a fee for redelivery."

Is it a FedEx scam text?

FedEx says it doesn't ask for personal details about your identity or account credentials through unsolicited mail, email or text. On a phone, the same page puts it differently: FedEx says it never asks for money or personal information as the price of releasing a package. It warns of emails and SMS messages pointing to a URL with the .shop domain, and of misspelled addresses like fedx.com or fed-ex.com.

FedEx does send real texts, though. It offers text alerts if you sign up for FedEx Delivery Manager. And for an international package, FedEx says it may contact you by email or SMS "with a secure link to pay applicable duties and taxes," and that you can verify those messages and amounts in the FedEx Import Tool. Open the tool from fedex.com, not from the text.

Is it a UPS text scam?

UPS says it doesn't request payments or personal information in an unsolicited way through email, mail, phone or fax; text isn't on that list. It does send texts you sign up for: its profile page lets you turn on shipment notifications by email or text, and its SMS terms cover status texts for packages you asked about.

UPS says fake messages may claim a package is waiting and ask for personal information or a payment, and that links in those texts may contain malware or lead to a fraudulent website. If UPS contacts you about a package, it says its representative can always give you a tracking number to verify on its website. Only a few packages require money for delivery, UPS says: collect on delivery, duties or taxes.

What else gives a fake away?

• You're told to pay by gift card, store credit card or cryptocurrency. The FCC says anyone insisting on those as the only options is a scammer.
• The tracking number or order details don't match what the merchant gave you, a check the FCC suggests.

A polished text proves nothing. The FTC says not to assume a text from a known company is legit.

How do you check a delivery safely?

Leave the text alone. If you ordered something, the FTC suggests looking up the shipping and tracking information on the retailer's site or in your account there. Or go straight to the carrier, typing the address yourself or opening its app:

• USPS: USPS.com or the USPS Mobile app. The Postal Inspection Service says to skip the links and visit USPS.com for tracking if you're expecting a parcel.
• FedEx: fedex.com or the FedEx Mobile app. FedEx says to always verify information using legitimate FedEx channels.
• UPS: ups.com or the UPS App. UPS calls tracking your package the safest way to see if any fees are due.

Still unsure? The FTC says to contact the shipping company using a phone number or website you know is real, not the details in the message.

How do you report a fake delivery text?

Keep the text until you've finished, since the USPS report asks for a screenshot and reporting on iPhone deletes the message. Do the messaging-app report last.

• Any delivery text: forward it to 7726 (SPAM), which the FTC says helps your wireless provider spot and block similar messages. Report it in your messaging app too, and to the FTC at ReportFraud.ftc.gov.
• USPS text scam: email spam@uspis.gov. Without clicking the link, paste the body of the text into a new email, add your name and a screenshot showing the sender's number and the date sent, and say if you clicked, lost money or shared personal information.
• FedEx scam text: forward it to abuse@fedex.com.
• UPS text scam: UPS's fraud page has an Email UPS button, but when we tried it on Nov. 2, 2026, it opened a UPS sign-in page. Without a login, use 7726 and ReportFraud.ftc.gov. UPS's page links to the FTC's site.
• If you lost money: FedEx says to contact your bank immediately and consider the FBI's Internet Crime Complaint Center (www.ic3.gov) or your state attorney general's office.

What if you already tapped the link?

What to do depends on how far you got. These steps come from the FTC unless noted.

You tapped but didn't enter anything

The Postal Inspection Service says to notify your financial institution if you interacted with the link, even if you never clicked submit.

You entered card details or paid a fee

Report it to the card issuer immediately, using the number on the back of your card or its website or app, and ask for a refund. With a debit card, do the same with your bank or credit union. Keep checking your statements, and follow up in writing. Federal law protects you from unauthorized use of your card, but with a debit card, what you owe depends on how quickly you report it. Our credit card fraud guide explains the limits.

Paid another way, such as a gift card, payment app, wire transfer or cryptocurrency? Contact that company immediately and ask for your money back. The FTC's What To Do if You Were Scammed page lists the steps for each.

You entered your Social Security number

If a scammer used it, report it at IdentityTheft.gov and follow the recovery plan. If it wasn't used or you aren't sure, go to IdentityTheft.gov/databreach.

You entered a password

Create a new, strong password for that account, change it anywhere else you use it and turn on two-factor authentication. If you can't log in, the FTC's How To Get Back Into Your Hacked Account page has recovery links.

You installed something, or think the link downloaded something

Stop logging into online accounts, update your security software (or download some if you have none), run a scan if your software offers one and delete anything it flags. Then change your passwords and turn on two-factor authentication. On Android, Google says Google Play Protect periodically scans your device and may deactivate or remove harmful apps.

Do these texts spike around the holidays?

We didn't find an official count by season. The FTC's December 2024 alert gives the reasoning: you might expect more deliveries during the holidays, and scammers are counting on that. FedEx says fake "delivery failure" emails in its name tend to rise as the holidays approach. The FTC also notes that these messages go out "all year long."

Got a package you didn't order? It could be a different scam

A real box you never ordered could be a brushing scam, especially if you don't recognize the sender, though it might also be a surprise gift. Recent reports to the FTC say it usually holds something cheap and random, like baby wipes, toothpaste or seeds, and the scammer uses the delivery as "validation" to post fake reviews in your name. It could also be a sign that someone has, or wants to steal, your personal information.

• You don't owe anything. The FTC says the law doesn't require you to return or pay for things you didn't order, but says to be cautious about using the product.
• Unwanted and unopened, with a return address? If USPS delivered it, the Postal Inspection Service says you can mark it "RETURN TO SENDER" and USPS will return it at no charge. For seeds, food, plants or an unknown liquid or substance, it says to notify the proper authorities.
• Already opened it? The Postal Inspection Service says you may throw it away if that's safe, or keep it.
• Don't scan a QR code in the package. The FTC says it could take you to a phishing site. USPS tells its own employees not to engage with the sender, or they may verify their address.
• Change passwords on your online shopping accounts, and check your credit for free each week at AnnualCreditReport.com.
• Report it to the FTC at ReportFraud.ftc.gov or the Postal Inspection Service at www.uspis.gov/report, and to the marketplace if it came through one.

Can a security app catch these texts?

Your phone already does some of this. Apple's guide for iOS 26 and later says spam filtering is on by default in Messages, and you can turn on Screen Unknown Senders, which moves messages from unknown senders into another folder. Google says spam protection is turned on in standard protection mode in Google Messages, where the setting is available.

Some security suites add their own check:

• Norton lists Safe SMS in AntiVirus Plus and all Norton 360 plans, though it says not all features are in every plan, including plans bought through third parties. It works only on Android and iOS. On iPhone it filters SMS and MMS from unknown senders, and Norton notes iMessages aren't supported.
• McAfee Scam Detector is in all McAfee plans, with automatic alerts for text, email and video scams. McAfee says it doesn't detect every scam and currently supports English-language scams and videos, and that video scam checks aren't available on iOS or newer Android installations.
• Avast SMS Guard is a paid feature of Scam Guardian Pro on Android and iOS, included with paid Avast Mobile Security and Avast Premium Security. It scans texts in your default messaging app, and Avast says it doesn't support iMessages.

An app may cut down what reaches you, but no filter catches everything, and none can tell you whether your own package is really held up. Tracking it yourself can.

Looking the package up yourself takes a minute, and it tells you what the text can't: whether anything is actually wrong.