You get a text that looks exactly like the Postal Service. Your package is on hold. There’s a redelivery fee — usually under three dollars — and a clock. Your stomach drops. Here’s the calm version: most of these texts are scams, not USPS.
Why package smishing exploded
Everyone expects deliveries. A $1.99 fee feels too small to be dangerous, so people tap before thinking. Scammers only need a fraction of recipients to enter a card or login. The same playbook appears as UPS, FedEx, Amazon, and Walmart texts — different logo, same trap.
Real carriers want you inside their official app or website. They do not run random SMS checkout pages on lookalike domains.
7 signs it’s fake
- You weren’t expecting a package — or the timing doesn’t match any order you placed
- Tiny fee + big urgency — “12 hours,” “final notice,” “return to sender”
- The link isn’t usps.com — extra words, hyphens, .co/.net stand-ins, or misspellings
- The page asks for a card to “release” mail — that’s not how normal redelivery works
- Generic “Dear Customer” with no real tracking detail you can verify in-app
- Same message hits several people in your family — blast campaigns
- After you tap, it wants a login — credential theft, not postage
What real USPS communication looks like
When in doubt, open the official USPS app or type usps.com yourself. Informed Delivery and tracking live there. A cold SMS with a pay link is not a trusted channel for card details.
What to do instead
- Do not tap the link or enter a card number
- Open the real USPS app or usps.com and check tracking there
- If you already typed a password on the fake page, change it and watch bank accounts
- If you entered a card, call your bank or issuer and report the site
- Paste the full text into ScamCheck for a free score
- Forward a one-line warning to family — these waves hit whole neighborhoods
UPS, FedEx, and Amazon variants
Swap the logo and the story still holds. “Customs fee,” “address correction,” “account locked,” “shipping difference” — all aim for the same outcome: a rushed payment or login. Use our USPS check, UPS check, FedEx check, or Amazon check if you want a type-specific page, or paste anything into ScamCheck.
If you already paid
Act the same day. Call the number on the back of your card. Tell them it was a phishing site. Change passwords you reused. Save screenshots of the text and the page for the dispute. You are not foolish for wanting your package — the scam is designed to feel routine.
How to read a suspicious link without tapping it
On iPhone, touch and hold the link to preview the URL. On Android, similar long-press options exist in many messaging apps. You are looking for the real hostname — the part before the first slash after https://. Logos lie; hostnames are harder to fake well. Anything like usps-deliver-fee.co or usps-support-secure.net is not the Postal Service.
If the preview looks wrong, you already have your answer. Delete the message. You do not need to “check just in case” on their website.
What scammers do with a stolen card
Small test charges, larger purchases, or selling the number. That is why even a $1.99 phishing page matters. Report fast, monitor statements for a few weeks, and do not reuse passwords from that fake site anywhere else.
Talking points for family group chat
Copy something short: “USPS will not text you a random $2 redelivery link. If you get one, don’t tap it — open the real USPS app. Free checker if you’re unsure: yoyosup.com/tools/scamcheck/” Specificity beats vague “be careful online” advice.
FAQ
- Can a real tracking number appear in a scam text? Scammers invent plausible strings. Only the official app is authoritative.
- What if I use Informed Delivery? Great — use that official channel, not SMS pay links.
- Is email safer than text? Phishing exists in email too. Same rule: navigate to usps.com yourself.