If you have received a text claiming your USPS package could not be delivered and asking you to click a link, you are looking at a scam. The United States Postal Inspection Service has published a definitive rule that makes these texts easy to filter: "USPS will not send customers text messages or e-mails without a customer first requesting the service with a tracking number, and it will NOT contain a link."
That rule covers it entirely. An unsolicited USPS text is fraudulent. A USPS text containing a link is fraudulent, even if you did sign up for tracking updates. The FTC issued a dedicated consumer alert about this scam in April 2025, and the Postal Inspection Service reports it as one of the most prevalent impersonation scam types in the country.
How the scam works
The mechanic is straightforward. You receive a text claiming USPS attempted to deliver a package but could not complete the delivery because of an incomplete or unconfirmable address. The message creates urgency, warning that your package will be returned or held if you do not act quickly. It provides a link to "confirm" your address or pay a small processing fee to release the delivery.
The link does not go to USPS. It goes to a fake USPS page designed to harvest your personal information: your address, date of birth, card number, or Social Security number. Whatever you enter goes directly to the scammer and can be used for identity theft, financial fraud, or sold to other criminal operations.
The reason this works so well is timing. Virtually everyone is expecting a package at any given time. The pretext is inherently plausible, and the urgency discourages the pause needed to check whether the message is real.
Since 2024, scammers have also begun using AI tools to generate more convincing text wording and lookalike branding, making visual inspection of the message content less reliable. The binary test above is more dependable than trying to judge whether the text "looks legitimate."
Three red flags that appear in real scam texts
Analysed samples of real USPS smishing texts consistently show the same three tells:
1. The sender number is not a US short code. USPS uses 5-digit short codes for any legitimate SMS communication. Scam texts frequently originate from standard 10-digit phone numbers or, in a common variant, from +44 numbers (the UK's international dialling code). Neither matches how USPS actually sends messages.
2. There is no real tracking number. Legitimate delivery notifications include the actual tracking number for the shipment. Scam texts refer generically to "the USPS package" or "your package" because the sender has no knowledge of any real delivery.
3. The logic does not hold. The message claims the delivery failed because your address is incomplete or missing, yet the sender somehow obtained your mobile number to contact you. If they had your phone number, they had enough contact information to reach you through other means. The premise falls apart on inspection.
What to do if you receive a suspicious USPS text
Do not click the link. If you want to check whether there is a real delivery issue, go directly to usps.com by typing the address into your browser, or use the USPS app, and enter your tracking number there. Do not use any link or phone number from the suspicious text.
To report the text: take a screenshot, then forward the text to spam@uspis.gov and include the screenshot, the sender's phone number, the date received, and any relevant details. Also forward the text to 7726 to report the number to your carrier. Then delete the message.
You can also paste any suspicious link into ScamInfo's ScamCheck Validator to check it without visiting the site.
What to do if you already clicked the link
Your next steps depend on how far you went.
If you clicked but entered nothing: Your device may still have been exposed to a malware attempt through the link itself. Clear your browser history and cache, run a security scan on your device, and monitor your accounts for unusual activity over the following weeks.
If you entered personal information (name, address, date of birth): Change the passwords on your email and financial accounts immediately, since scammers frequently use partial personal information to answer security questions or access other accounts. Monitor your credit reports at AnnualCreditReport.com for any new accounts you did not open. Consider placing a free fraud alert with one of the three credit bureaus (Experian, Equifax, or TransUnion) - they are legally required to notify the other two.
If you entered financial details (card number, bank account, or made a payment): Contact your bank or card issuer immediately. Explain that you may have provided your details to a scammer and ask them to freeze the account and dispute any unauthorised transactions. Speed matters here.
In all cases, report the incident to USPIS at spam@uspis.gov and file a report with the FTC at ReportFraud.ftc.gov.
How to report a USPS scam text
USPIS: Email spam@uspis.gov with a screenshot, the sender's number, and the date received
Carrier spam reporting: Forward the text to 7726
FTC: ReportFraud.ftc.gov
FBI IC3: ic3.gov (for financial loss)
USPIS phone: 877-876-2455
ScamInfo: Report through ScamInfo's reporting dashboard