How to Avoid the Package-Didn't-Fit Text Scam

Scam delivery texts are designed to create urgency, such as claiming your parcel did not fit in the mailbox or needs a quick redelivery choice. The FTC warns that fake texts may include package delivery notices and links that lead to spoofed websites or malware, so do not tap an unexpected link or give personal information through it. Read the message calmly and treat it as unverified until you check it another way.

Ask yourself whether you signed up for text updates for that exact package. The U.S. Postal Inspection Service says USPS does not send tracking texts or emails unless the customer first requests the service with a tracking number, and those USPS messages will not contain a link. If you never requested tracking updates, that is a strong reason to ignore the message.

Look for an unfamiliar phone number, misspellings, odd punctuation, or a link that does not match the courier's real domain. Cybermalveillance.gouv.fr notes that phishing pages can imitate trusted organizations and may differ by only one character in the web address. If the link uses a strange domain, shortened URL, or pressure language, leave it alone.

Open a browser or courier app yourself instead of using the text link. The FTC recommends contacting a company through a phone number or website you already know is real when a message might be legitimate. For USPS, you can check tracking by going directly to USPS Tracking or by using the official text-tracking process described by USPS.

Do not enter card details to pay a small redelivery fee, customs fee, or mailbox surcharge from the message. The FTC says legitimate companies will not text or email a link asking you to update payment information. If a payment is real, it should appear after you log in through the courier's official site or contact the seller through a known channel.

Use your phone's report junk option if it is available, then forward the suspicious text to 7726, which the FTC says helps wireless providers identify and block similar messages. For USPS-related smishing, the Postal Inspection Service asks people to email details to spam@uspis.gov and include a screenshot showing the sender and date. You can also report cyber-enabled fraud to the FBI's IC3 if money or sensitive data was involved.

If you clicked but did not submit anything, close the page and avoid entering more information. If you gave card, bank, password, or identity details, the FTC recommends contacting the relevant bank or company quickly, changing compromised passwords, and checking accounts for unauthorized activity. Save the message, screenshots, and any charge details in case your bank or law enforcement asks for evidence.

Enable your phone's spam filtering tools, keep your device software updated, and use multi-factor authentication on important accounts. The FTC lists phone updates and multi-factor authentication as practical ways to reduce the damage from phishing attempts. These protections will not stop every fake delivery text, but they make a mistaken tap less likely to become a bigger problem.