Fake Shipping Texts: What to Check Before Opening the Link

A text says your package has an address problem. Perhaps postage is due, a delivery attempt failed, or the carrier needs you to “verify” your preferences. Conveniently, the message includes a link and a ticking clock. How thoughtful of the criminals to manufacture both the emergency and the button that supposedly fixes it.

Do not open that link to investigate. Verify the delivery from outside the message instead. The safest routine is short: find the original order, obtain the tracking number there, visit the carrier through its official app or an address you enter yourself, and compare the real shipment status with the text’s claim.

This is not a fringe trick. The Federal Trade Commission’s 2024 text-scam spotlight identified fake package-delivery problems as the most-reported text scam covered by its review. Common stories involved address trouble, missed deliveries, postage, customs charges and requests to confirm delivery preferences. The objective may be card details, personal information, account credentials or simply getting the recipient onto a fraudulent website.

Use this verification routine before touching anything

Leave the text alone. Do not open its link, call a number it supplies or reply to it.
Open the retailer’s app or website independently and find the order in your purchase history. Check whether it has shipped, which carrier has it and what tracking number the seller recorded.
Reach the carrier independently. Use its official app, type its known website address yourself or use contact information from a trusted account or receipt. Enter the tracking number obtained from the order record—not one supplied only by the text.
Compare the official tracking status with the claim. If the order page shows no problem, the carrier does not recognize the number or the supposed fee does not appear through the carrier’s legitimate channel, do not pay or provide information.
If uncertainty remains, contact the seller or carrier using independently located details. Ask about the specific shipment without forwarding the suspicious link.

A convincing carrier page is still not proof

A familiar name, logo, color scheme or legal disclaimer proves very little. UPS warns that fraudulent messages and websites can copy its branding and convincing visual details. It recommends checking a purported tracking number independently on the UPS website. A polished imitation is still an imitation; scammers have access to logos and spell-checkers too.

Urgency is another warning sign. The message may threaten to return the parcel, cancel delivery or impose a fee unless you act immediately. The Cybersecurity and Infrastructure Security Agency’s phishing guidance flags urgent or emotionally loaded language, requests for personal or financial information and untrusted shortened links as phishing indicators. UPS similarly warns about unexpected demands for immediate payment or data connected to a delivery.

No single typo, country code, logo or strange web address conclusively settles the matter. Some scam texts are sloppy; others are polished. Some legitimate notices are awkward. Treat the combination of an unexpected message, pressure, a supplied link and a request for money or information as a reason to stop and verify—not as an invitation to conduct forensic archaeology inside the message.

An unexpected fee deserves verification, not automatic payment

Small redelivery charges are effective bait because the amount can seem too trivial to question. FTC materials describe fake package texts using a small redelivery payment to obtain card information, and the agency says USPS does not demand redelivery payment through an unsolicited package notification. Paying a tiny amount can expose far more valuable card details. That is quite a surcharge for the privilege of being robbed.

However, “delivery fee” does not automatically mean fraud. UPS says collect-on-delivery charges, duties or taxes can legitimately be due. FedEx says an international recipient may receive an email or text concerning duties and taxes. Both tell recipients to verify the shipment and amount through legitimate carrier channels. The correct response is neither blind payment nor blind dismissal. Check the real shipment independently.

What to do if you already interacted with the message

Match the response to what happened. Clicking, installing software, sharing a password and entering card details create different problems. Do not waste time feeling embarrassed; that emotion is useful mainly to the thief.

If you only received the text

Use your phone’s spam-reporting function, notify the impersonated organization through contact details you found independently, and delete the message. CISA recommends those steps for a suspicious text that was not acted upon. The FTC also accepts reports at ReportFraud.ftc.gov. A suspicious message is not necessarily confirmed fraud, so describe what you received and what occurred rather than guessing at the sender’s identity.

If you clicked but shared nothing

Stop interacting with the page. Do not reply, open another link or use an “unsubscribe” option in the suspicious message. If the click caused a download, app installation or device-access permission, update your security software, run a scan and remove anything identified as malicious.

If you entered a username and password

Change the password immediately through the real account or official app. Replace it anywhere else you reused it, use a strong unique password, and enable two-factor authentication. Check the account for altered contact details, unfamiliar sessions or transactions.

If you entered card or bank information, or paid

Contact the card issuer, bank or credit union immediately using the number on the card, its official app or another trusted account channel. Report the transaction or exposed details and ask what can be blocked, reversed or refunded. The FTC and FedEx both advise prompt contact with the financial institution after money or payment information is involved.

If you shared a Social Security number or identity information

Use IdentityTheft.gov for a recovery plan if the information has been misused. If you do not yet know whether it was used, follow the FTC’s data-breach guidance. Immediate measures may include changing affected logins and PINs, contacting businesses where fraud occurred, and placing a free one-year fraud alert through one of the nationwide credit bureaus.

Report carrier impersonation through the real carrier

Carrier-specific reporting can help route the evidence correctly. For USPS impersonation texts, the U.S. Postal Inspection Service directs recipients to forward the message to 7726 and report it to spam@uspis.gov. It asks for the message without opening its link, a screenshot showing the sender number and date, and an explanation of whether the recipient clicked, paid or disclosed information. FedEx directs recipients to forward suspicious messages to abuse@fedex.com. Check the carrier’s current fraud page before reporting because instructions can change.

The text does not get to choose the verification channel

The essential rule is brutally simple: a message claiming to be from a carrier does not earn the right to prove itself using its own link. Start with the purchase you actually made, retrieve the tracking details from the seller, and approach the carrier independently.

Real delivery problems can survive that check. Fake ones usually depend on preventing it by rushing you toward a payment form or a data grab. Refuse the manufactured panic. Your package can wait while you spend two minutes verifying whether the problem exists at all.