Fake delivery texts before the holidays: how to check them

From late October to the end of December, most households have at least one parcel somewhere in transit, and the people who send fake delivery texts know it. The message doesn't need to be clever. It only needs to land on the afternoon you are waiting for a box.

In its analysis of text scam reports from 2024, the FTC found that fake package delivery problems were the most reported text scam of the year. The pattern it describes is plain: a text says there's a problem with a delivery and links to a site that looks like the real Postal Service site. Many people reported paying a small "redelivery fee" that turned out to be a way to collect their card number, and sometimes their Social Security number. The FTC put reported losses to all text scams that year at 470 million dollars, more than five times the 2020 figure.

Here are the messages you are likely to see before the holidays, what each one is after, and a check that takes less than a minute.

The four lures, and what each one wants

The wording changes every few weeks. The shape doesn't. The examples below are made up, but they follow the patterns the FTC and the US Postal Inspection Service describe.

The missed delivery

USPS: Your parcel could not be delivered due to an incomplete address. Update your details within 24 hours or it will be returned: [link]

What it wants: your name, address and phone number on the first page, and a card number on the second, "for a small redelivery fee". The fee is tiny on purpose. Nobody thinks hard about a dollar or two, and the card number is the real prize. Some versions also ask for a date of birth or a Social Security number "to confirm your identity", which no carrier needs in order to deliver a box.

The tell: the deadline, and the link. The Postal Inspection Service says USPS will not text or email you unless you first asked for updates with a tracking number, and that those messages will not contain a link.

The customs fee

Your international package is being held at customs. A duty payment is required before release: [link]

What it wants: the same card number, with an official-sounding reason. It works best on people who really did order something from abroad, which in December is a lot of people.

The tell: real duty and tax bills on imports do exist, but they belong to a specific shipment with a tracking number from the store you bought from, and you can confirm them by typing that number into the carrier's own website. A text that names no store and no order is not a bill.

The address check

We were unable to verify your delivery address. Please confirm your details below so your order can ship.

What it wants: whatever you type, plus proof that the number works. A filled-in address form is useful to a scammer even without a card number. It confirms your name, your address and the fact that you open links from strangers, which makes your number more valuable on the next list it is sold on.

The tell: it never says which order, from which store.

"Reply Y"

Reply Y, then close and reopen this message to activate the link.

This one is the most interesting technically. Apple's Messages app disables links in messages from unknown senders, and replying to the message, or adding the sender to your contacts, turns them back on. Scammers noticed, so many fake delivery texts ask for a reply first. Any reply also tells the sender that the number is live and that a person reads it.

The tell: no real carrier needs you to reply before it will show you a tracking page.

You will also see cousins of these four: unpaid toll notices, "your account is on hold" messages that seem to come from a big online store, and fake fraud alerts that look like they came from a bank. The FTC listed bogus toll notices and fake fraud alerts among the top text scams of 2024 as well. The check further down works for all of them.

How the real messages arrive

The right-hand column is the whole method. You check by going around the message, never through it.

Privacy kit

• NordPassCreates and stores a unique password for every account.Start with NordPass
• Yubico Security Key NFC (USB-A)Phishing-resistant sign-in at a lower cost than the full YubiKey.On Amazon

Chosen from specifications, policies and published reviews; we have not tested these ourselves. More in the Privacy kit

The 30-second check

1. Don't tap the link, and don't reply, not even with STOP. A reply to a scam number confirms that it reached someone.
2. Ask whether you are actually expecting something. If you aren't, you're done: report the text and delete it.
3. If you are, find the order confirmation in your email by searching for the store's name, not the carrier's. The tracking number you want is the one in that email.
4. Open the carrier's app, or type its web address into your browser, and enter that tracking number. If there's a real problem with the delivery, it will show up there.
5. If the tracking page says everything is on schedule, the text was fake, even if it used your name or named the right carrier.

That last point matters. A scam text that knows your name is not more believable, only better informed. Names and phone numbers travel together through marketing lists and breached data, which is one reason your number deserves more care than most people give it. I went into how much a single number connects in the piece on what your phone number links to.

If you already tapped

Skip the embarrassment. These pages are built to look exactly like the real thing, and careful people tap them on busy days. What matters is what you did after the page opened.

You opened the page and closed it

Don't go back to it. On a phone that is up to date, a page you only looked at is usually the smallest of these problems. Install any pending system and browser updates, and treat the next few texts from strange numbers with extra suspicion, because the visit may have told the sender your number is active.

You typed a card number

Call the number on the back of the card, never a number from the text or the page. Say the number was entered on a scam site, ask the issuer to cancel the card and send a new one, and go through any charges you don't recognize. The FTC's advice for anyone who paid a scammer by card is to report it to the issuer right away and ask for the money back. With a credit card, the FTC explains, you aren't responsible for charges you didn't authorize when only the number was taken. With a debit card, your protection depends on how quickly you report, so make the call the same day.

You typed your Social Security number, date of birth or address

Go to IdentityTheft.gov, which builds a recovery plan around what was exposed, and place a free credit freeze at Equifax, Experian and TransUnion. The steps, and the order to do them in, are in the first hour after a data breach letter. They apply just as well when you were the one who typed the data into the wrong page.

You typed a password or signed in

Some fake pages ask you to "sign in to reschedule". Change that password on the real site, and everywhere else you used the same one, then turn on two-step sign-in for the account. If it was your email password, do that account first, because your email can reset almost everything else.

You installed something

A few fake delivery pages push an app or a "tracking tool". Delete it, update your security software and run a scan, which is the FTC's advice whenever a scammer may have reached your device. If you typed more than one kind of information into that page, our breach checklist sorts the next steps by the type of data involved.

Privacy kit

• YubiKey 5 NFC (USB-A)Stops phished passwords from opening your email and bank accounts.On Amazon
• Thin sliding webcam cover (2 pack)Keeps the camera covered when you are not on a call.On Amazon
• Identity-blocking roller stamp (3 pack)Hides your name and address on labels and letters before they go in the bin.On Amazon

Chosen from specifications, policies and published reviews; we have not tested these ourselves. More in the Privacy kit

Reporting takes two minutes

Reporting won't get your money back, but it helps the carriers and the FTC catch the next wave sooner.

• Forward the text to 7726 (SPAM). The FTC says this helps your wireless provider spot and block similar messages.
• Use the "Report Junk" or "Report Spam" option in your messaging app.
• Report it to the FTC at ReportFraud.ftc.gov, especially if you lost money.
• If the text pretended to come from USPS, the Postal Inspection Service asks people to email spam@uspis.gov with the text of the message, the sender's number and the date it arrived.
• Then delete it.

The FTC's guide to recognizing and reporting spam texts walks through the report options on iPhone and Android.

Before the next box ships

A few habits make the season quieter.

• Set up tracking yourself. When a store emails you a tracking number, add it to the carrier's app or sign up for alerts on the carrier's site. Real updates then arrive somewhere you trust, and a stranger's text has nothing to compete with.
• Keep order confirmations in one place. A mail folder or label called "Orders" turns step 3 of the check into a five-second search.
• Filter unknown senders. iPhones can sort texts from numbers that aren't in your contacts into a separate list, and Google's Messages app flags suspected spam. Neither catches everything, but both cut the volume.
• Tell the people you shop with. Parents and grandparents sending presents across the country get these texts too, and a two-line explanation ("check through the carrier's own app, never the link") can save someone a replacement card in December.

The one thing to remember: the text is never the place to check the text. Go around it, to the store or the carrier you already know, and the scam has nothing left to work with.

Your next three steps

1. Take the exposure quiz to see how much a scammer could know before the first text.
2. Let a password manager such as NordPass fill your logins: it will not fill them on a fake site.
3. Forward the text to 7726 (SPAM), report it at ReportFraud.ftc.gov, then delete it.