How to spot USPS scam texts

Fake USPS texts exploit peoples’ fear of missing a delivery. Scammers impersonate the United States Postal Service (USPS) to gain your trust and get you to click phishing links and share sensitive information.

Fake package delivery texts were the most common type of text scam in 2024 according to data from the Federal Trade Commission. So, even if you haven’t encountered one yet, there’s a good chance you eventually will.

With that in mind, here’s how to spot these scams and protect yourself.

How do USPS text scams work?

USPS text scams impersonate automated delivery updates, hoping to trick recipients into thinking they’ve missed a package delivery or need to take action to ensure a delivery moves ahead on time. This type of scam is known as smishing, or SMS phishing, where attackers use text messages to direct you to fake websites that attempt to steal your information.

USPS scams generally start with pretexting, or creating a believable scenario, like the USPS needing additional information before your package can be delivered. To seem more legitimate, criminals may use SMS spoofing to disguise their sender ID or phone number, making the message look trustworthy.

The text will include an explicit request, like “Please confirm your address” or “Click here to confirm the delivery date.” These requests are part of the scam, designed to fool you into clicking links to malicious websites where the scammer will attempt to collect personally identifiable information (PII), such as your name, address, email, or login credentials, which could be sold on the dark web or used for identity theft.

Other times, these scam texts may direct you to a fake payment portal that captures your card details, or even ask you to pay a “redelivery” or “order processing” fee that goes directly to the scammer.

What does a scam USPS text look like?

Scam USPS texts might look like a legitimate shipping update but they’ll typically have key warning signs, like making a delivery issue seem urgent, encouraging you to act quickly, being vague about delivery details, or including suspicious links.

To help spot them, look out for common pretexts used in USPS scam texts, like:

• “Your package is being held at a warehouse.”
• “Address confirmation needed.”
• “Delivery failed, click here.”

The messages can vary in tone, with some sounding threatening while others appear friendly or helpful. But if a message seems to have been designed with the intention of getting you to click or respond quickly without thinking, it’s a red flag.

What happens if you click a USPS scam link?

Clicking a USPS scam link can put you at risk of accidentally exposing your personal information to scammers, or infect your device with malware.

Here’s a closer look at some of the risks:

• Credential harvesting: Scammers create fake websites that prompt you to enter login details which they can use in account takeover attacks.
• Financial fraud: You may be asked to pay bogus delivery fees directly, or unknowingly give up credit card information.
• Malware infections: Clicking a link in a fake message can trigger downloads that install malicious software on your device.
• Identity theft: Scammers can use stolen personal information to open accounts or commit fraud in your name.
• Ongoing scam targeting: Once scammers have your contact details, they may target you with more phishing attempts.
• Device compromise: In some cases, attackers can gain deeper access to your device, putting your data and accounts at risk.

How to spot a USPS scam text

Illegitimate USPS texts typically contain outbound links and invalid tracking numbers for packages. Traditionally, bad grammar has been another tell, although AI has made it easier for scammers to mimic the professional tone of the USPS.  Here are some things to look out for when spotting USPS text scams:

• Outgoing links: The USPS never includes outgoing links in its texts, even to the official USPS website. Avoid clicking links from texts claiming to be from the organization.
• Unexpected messages: You will only receive USPS messages if you specifically request them. If you never ordered a package or aren’t expecting a gift, you shouldn’t be receiving notifications.
• Bad grammar: Misspellings or awkward phrasing can signal a scam, but don’t rely on this alone. Scammers now use AI to create polished, professional messages that look legitimate.
• Invalid tracking number: Tracking codes sent to you via text message that can’t be verified in the USPS Tracking tool are scams. Official tracking numbers are usually 20-22 digits long, with international packages using a different format.
• Sense of urgency: Fake messages are designed to make you think that you’ll lose a package unless you click a link and act quickly, often claiming delivery has been attempted multiple times.
• Redelivery fees: USPS does not charge redelivery fees. You can schedule a free redelivery on the official USPS website.
• Unusual URL structure: Scam links often use misspelled domains, extra characters, or unrelated web addresses instead of a clean “usps.com” URL.
• Incorrect sender ID: Legitimate USPS texts usually come from a short code or a clearly labeled sender. Messages from random phone numbers or email-like addresses are suspicious.

Do not respond to any suspected USPS scam texts. Engaging with these scam messages signals to scammers that your phone number is active, which can lead to more scam attempts.

Does USPS send text messages?

USPS will only send texts if you sign up for SMS notifications on the USPS site or request them by texting 28777 (2USPS). For example, if you text “Delivery” along with your tracking number to 28777, USPS will send you a text with your package’s scheduled arrival time. USPS will never send you texts unless you ask for them.

If you request an SMS notification about a package delivery, USPS will include the following information:

• Who’s delivering the package (USPS).
• The package’s tracking number.
• The delivery status of the package.
• The date, time, and location for pickup.
• Instructions on how to stop further texts.

This message will not contain any links.

Below is an image showing what a legitimate USPS text looks like.

What to do if you fall for a USPS text scam

If you fall for a USPS text scam and expose your personal information, lock down your USPS account, change passwords on any accounts where you used the same credentials, and contact your bank. To open a potential investigation, report the incident to the USPS, the Federal Trade Commission (FTC), and your local police department.

Here is a to-do list of actions to take if you fall victim to a USPS delivery scam:

• Change non-unique passwords: If you provided account credentials to the scammer, update other accounts where you reused them. Create unique, secure passwords, and use a password manager to manage them.
• Activate 2FA: Turn on two-factor authentication to secure your accounts against attempted takeovers. With 2FA, even if hackers steal your password, they still need access to your secondary verification method, such as an authentication app, to get into your account.
• Contact your bank: If you exposed sensitive payment information, contact the card provider to cancel your card. Dispute any unusual charges with your financial institution.
• Freeze your credit: Cybercriminals can attempt to use exposed PII to steal your identity. To mitigate this risk, you can temporarily freeze your credit report to prevent new accounts from being opened in your name.
• Scan for viruses: Use a virus removal tool to scan for malware you might have downloaded from an unsafe website or infected link.
• File a report with the FTC: Report the incident using the Federal Trade Commission’s official reporting site. They can use this information to take action on a broader scale, helping protect other potential scam targets.
• File a report with the USPIS: Inform the United States Postal Inspection Service of the incident via their official reporting page. The USPIS is USPS’s official investigative authority, so they’re equipped to address mail delivery fraud.

While falling for USPS scam texts can be a scary experience, quickly securing your accounts and reporting the scammer will give you the best chance of mitigating the damage.

How to protect yourself from USPS scam texts

The best way to protect yourself from USPS smishing attempts is to verify every message and never click any links in texts. If you suspect a scam text, block and report the message. Here are some more details on how to stay safe:

• Double-check if the text is real: Recall if you’ve placed any orders lately. If you have, verify the tracking number using the official USPS Tracking tool.
• Don’t click links in USPS messages: Texts from the USPS never contain links. Links in scam messages will likely lead you to an unsafe site.
• Don’t open attachments: Opening an attachment included with a scam text could install malware on your device. USPS doesn’t include attachments in text messages.
• Block spam numbers: You can help reduce or stop spam texts over time by blocking numbers that call or text you without permission. Over time, this can discourage spammers, helping them realize you won’t engage.
• Don’t reply: Don’t even respond with “no” — doing so confirms that your phone number is active, and you’ll likely receive more spam. While real USPS text messages always allow you to opt out of notifications, it’s safer to do so via their official site.
• Install antivirus software: Install a reliable Cyber Safety solution, like Norton 360 Deluxe, to help keep malware off your device. Using AI-powered scam detection technology, Norton 360 Deluxe will also help block malicious sites that could steal your passwords or other sensitive information.
• Remove your phone number from the web: Make sure your social media is private and check to see if your data is visible on people search sites to remove your information from the web. Norton’s Privacy Monitor tool can help you do this.
• Register for Do Not Call: Adding your number can help reduce legitimate telemarketing calls, making scam attempts easier to spot.
• Use mobile carrier protections: Many carriers offer built-in spam filters and call-blocking tools to help screen suspicious messages.

Stay safer from delivery scams

USPS text scams are a persistent threat, and even the most vigilant among us can accidentally click a malicious link. Norton 360 Deluxe helps keep you safe from threats even when your guard is down.

Norton’s advanced anti-scam technology can identify hidden SMS scam patterns, helping alert you to USPS scam texts. It also includes Privacy Monitor to help you remove your information from the web, so scammers have less chance to target you in the first place.

FAQs

What number will USPS text me from?

USPS texts its customers using five-digit short codes to send and receive delivery notifications.

Does USPS charge a redelivery fee?

No, USPS does not charge a redelivery fee. Scheduling redelivery with USPS is free, so any fee requests are a sign you’re dealing with a scammer.

What does a USPS tracking number look like?

A standard USPS Tracking number has 20 to 22 digits (for example, 9400 1000 0000 0000 0000). Priority Mail starts with 94, 93, or 92, followed by 20 digits. Certified mail starts with the number 7 and is 20 digits long. You can type this number into the USPS website to confirm it’s a legitimate tracking number.

How do I report a text as spam?

You can report a text as spam by forwarding it to 7726, which spells out “SPAM” on a number keypad. This lets your phone provider spot and block similar messages going forward.