USPS Text Scam in 2026: How to Spot the Fake Delivery Text (Real Examples)

Your phone buzzes. The text says 'USPS: Your package is on hold. Please confirm your address to arrange redelivery' with a link that looks almost — but not quite — like usps.com. You weren't expecting a package, but maybe your daughter sent something? You tap the link. That single tap can hand a scammer your credit card number, your home address, and enough personal data to open accounts in your name.

USPS text scams (also called 'smishing' — SMS phishing) exploded in 2025 and are one of the most-reported scams to the FBI's Internet Crime Complaint Center in 2026. The U.S. Postal Inspection Service has warned publicly that the real USPS does not send unsolicited texts about package delivery unless you signed up for USPS Text Tracking first. This guide shows the exact wording fake USPS texts use, the four red flags in every message, what actually happens if you clicked the link, and how to report the text so the sender's number gets shut down.

Is that USPS text a scam? Short answer: almost certainly yes.

The real United States Postal Service only sends you a text if you asked it to. You either have to enroll in USPS Informed Delivery on usps.com, or text a 20-digit tracking number to the shortcode 28777 (which spells 2USPS). Every other 'USPS' text — from a regular 10-digit phone number, an international number, an email-address sender, or a shortcode you don't recognize — is a scam.

In 2024, the Federal Trade Commission (FTC) reported that Americans lost more than $470 million to text-message scams, and fake delivery notifications were the single most common type. USPS impersonation makes up the biggest slice because everyone gets packages, and a two-line text feels less suspicious than a phone call.

What does a real USPS scam text look like? (5 examples)

Scam texts change wording every few weeks to slip past spam filters, but the templates repeat. Here are five of the most common fake USPS messages circulating in 2026 — collected from FTC complaint data and the U.S. Postal Inspection Service warnings. Read them once so you recognize the pattern the next time one lands on your phone.

1. "USPS: Your package has been held at our warehouse due to an incorrect address. Please update within 24 hours: usps-tracking-update[.]com/xyz"
2. "[USPS] Delivery attempt failed. Package returning to sender unless address is confirmed: usps.redeliver-package[.]info"
3. "US Postal Service: A $1.99 shipping fee is required to release your parcel. Pay now to avoid return: uspspay[.]top/verify"
4. "USPS Alert: Your package USPS9214XXX is waiting. Track & schedule delivery: informed-delivery-usps[.]net"
5. "United States Postal Service: We couldn't deliver your item because the recipient information is incomplete. Complete here: usps-help[.]co/redeliver"

Notice what every example has in common: urgency (24 hours, 'now', 'today'), a fake-looking web address that includes 'usps' but ends in something other than usps.com, and a request for either an address, a payment, or a login. Those three ingredients are the whole scam.

The 4 red flags in every fake USPS text

1. The link is not usps.com

The only real USPS website is usps.com. Anything else — usps-redeliver.com, usps.tracking-info.co, us-postalservice.net, usps.help-desk.xyz — is a scam. Scammers register lookalike domains for a few dollars a month. Look at the last part before the first single slash: that is the real domain. If it isn't exactly 'usps.com,' don't tap.

2. It came from a regular phone number or an email address

Legitimate USPS text tracking comes from the shortcode 28777. Scam texts come from full 10-digit phone numbers (often with area codes you don't recognize), international +63 or +44 numbers, or long strings that look like an email address ('4573829@sms-carrier.com'). If the sender isn't 28777, it isn't the real USPS text-tracking system.

3. It asks for a small payment (usually $1 to $3)

The scammer's real goal is your credit card number, not the $1.99. Once you enter your card to 'release the package,' they charge whatever they want, sell the card details on the dark web, and often try to enroll you in a $49-a-month recurring 'membership' buried in fine print. USPS does not charge redelivery fees by text.

4. You weren't expecting a package

If you didn't order anything and no family member mentioned sending you a gift, the odds any real delivery text is genuine are essentially zero. Even if you are expecting a package, verify by opening the shipper's app (Amazon, Etsy, the store you bought from) directly — never through a text link.

What happens if you clicked the link?

Clicking the link alone rarely infects your phone with a virus — modern iPhones and Android phones are hard to install software on without your permission. The real damage comes from what you did next on the fake page. Match your situation to the list below.

You only tapped the link, then closed the page

You are almost certainly fine. Close the browser tab, delete the text, and move on. As a precaution, watch your phone for slowness or pop-ups over the next 48 hours. If you're on Android and were prompted to install an app or 'update your USPS app,' see the section below on removing scam apps.

You entered your name and address

Your address alone is not a disaster — it's already public in most records. The bigger risk is that the scammer now knows this phone number belongs to a real person who answers scam texts, which means you'll get more. Delete the text and consider blocking the sender's number (see instructions below).

You entered your credit card or debit card number

Call the number on the back of your card right now — before you finish reading this article — and tell the bank you gave your card number to a phishing text. Ask them to cancel the card and issue a new one. Federal law (the Fair Credit Billing Act) limits your liability to $50 on credit cards and often to $0 if you report quickly. Debit cards have weaker protection, so speed matters.

You entered your Social Security number, bank login, or Apple/Google password

Assume the scammer has it. Change the password immediately on any account that reused it, place a free credit freeze at all three bureaus (Equifax, Experian, TransUnion), and file a report at IdentityTheft.gov — the FTC's free recovery tool that generates a personalized action plan. Full step-by-step instructions are in the recovery section below.

How to report a USPS scam text (2 minutes, from your phone)

Reporting a scam text is fast, free, and actually works — it feeds the U.S. Postal Inspection Service database used to shut down scam domains. Do all three steps below for the biggest impact.

1. Forward the text to 7726 (which spells SPAM). This is a free service from every major U.S. carrier — AT&T, Verizon, T-Mobile — that reports the sender for analysis and blocking. You'll get an automated reply asking for the sender's number; reply with that number.
2. Forward a copy to the U.S. Postal Inspection Service at spam@uspis.gov. Include a screenshot if you can. Postal inspectors use these reports to take down the fake domains.
3. Report it to the FTC at ReportFraud.ftc.gov. This is what powers the government's annual scam-tracking reports and helps regulators fine the payment processors that scammers rely on.

How to check if a USPS text is real (in 30 seconds)

If you're truly expecting a package and want to be sure, don't tap the link in the text. Instead, do one of these three things — each one takes less than a minute and will always give you the real answer.

• Open the USPS Tracking page directly by typing usps.com/go into your browser (never through the text link), then paste your tracking number.
• Open the app of the store you bought from (Amazon, Walmart, Etsy, etc.) — the real tracking information is always there.
• Call USPS Customer Service at 1-800-275-8777 (Monday–Friday, 8 a.m. to 8:30 p.m. Eastern) and read them the tracking number. A live agent will confirm whether the package exists.

The 3 lookalike USPS scams you'll see next

The FedEx / UPS version

The same scam runs under FedEx and UPS branding — 'FedEx: Your shipment #FX2938 is on hold' or 'UPS delivery attempt failed.' The rule is identical: real FedEx tracking texts come from shortcodes 48773 (FedEx) or 69877 (UPS), never from a 10-digit phone number. When in doubt, open the shipper's website directly.

The 'delivery driver needs your address' phone call

A live person calls saying they're a USPS or Amazon driver stuck outside your neighborhood and need you to 'verify the last four digits of your card to release the package.' Real delivery drivers never ask for card information. Hang up and, if a package is genuinely expected, check the shipper's app.

The fake USPS email (same scam, different channel)

You'll get the same 'package on hold' message as an email from something like tracking@usps-notice.com. Forward it to spam@uspis.gov and delete. The real USPS uses @usps.gov addresses only for official correspondence — never for tracking updates.

I gave a scammer my card. What now? (5 steps in the next hour)

1. Call the number on the back of your card. Say: 'I entered my card into a phishing text. Please cancel this card and issue a new one.' Ask them to reverse any charges you don't recognize.
2. Change any password you reused on that fake page. If it was your Apple ID, Google, or bank login, change it right now on the real website.
3. Freeze your credit — free, and it stops anyone from opening new accounts in your name. Do it at equifax.com/personal/credit-report-services, experian.com/freeze, and transunion.com/credit-freeze. Takes about 10 minutes total.
4. File a report at IdentityTheft.gov. The FTC's tool creates a personalized recovery plan with pre-filled dispute letters.
5. Tell someone you trust — a spouse, adult child, or friend. Scammers count on shame keeping victims silent so they can come back with the 'you owe us more' follow-up scam.

USPS scam text: quick answers

Is every USPS text a scam?

No — but almost. The only legitimate USPS texts come from the shortcode 28777 and only after you enroll in Informed Delivery or text a tracking number in. Any other 'USPS' text is a scam.

What does a real USPS text look like?

Short and boring. Example: 'USPS: Item 9400111... is out for delivery today, Tuesday, in ZIP 30301.' No links, no urgency, no requests for payment. Real messages come from 28777.

Can I get hacked just by opening the text?

Opening the text itself is safe on iPhone and modern Android. The risk starts when you tap the link and enter information. Text messages cannot install software just by being read.

Why does USPS keep sending me these texts?

USPS isn't — scammers are pretending to be USPS. They send millions of texts at a time using stolen phone-number lists. Reporting each one to 7726 helps carriers shut down the sending numbers faster.

How do I stop USPS scam texts for good?

You can't stop them entirely — scammers rotate numbers daily — but you can cut the volume by forwarding every one to 7726, blocking the sender, and never replying (even 'STOP' confirms your number is active). Most iPhones and Androids now have a built-in 'Filter Unknown Senders' setting that sends unknown-number texts to a separate folder.

The 30-second rule that stops every delivery-text scam

Before you tap any link in a text claiming to be from USPS, FedEx, UPS, Amazon, or any delivery service, pause for 30 seconds and answer three questions: (1) Did I actually order something? (2) Is the sender a recognized shortcode? (3) Does the link end in the real company's domain? If the answer to any of those is 'no' or 'I'm not sure,' delete the text. A real package will still be delivered — the U.S. Postal Service does not throw away mail because you ignored a text.