"USPS: Your package is on hold due to an incomplete address. Please update your details within 24 hours or it will be returned to sender. Reply Y, then reopen this message to activate the link." It's December, you've ordered half your gifts online and you really are waiting for a box. That's the whole trick.
The fake USPS text is one of the most common scam messages in the country, and it gets busier every holiday shipping season. The FTC says a text message was the top reported way scammers first reached people in 2025, among reports that named a contact method. Package texts are a big reason why: almost everyone is expecting something, so the message never feels random.
Most advice tells you to look for spelling mistakes, odd links or a sloppy website. We think that advice is out of date. The fake sites now look exactly like the real ones. The only test that works every time is this: did you give this company your phone number for this package? If not, the text isn't from them.
How the "package on hold" scam works
The script barely changes. A text says delivery failed, your address is incomplete or a small redelivery fee is due. It includes a link and a deadline, usually 12 to 48 hours. The link opens a copy of a carrier's tracking page, often with the real logo, a fake tracking number and a progress bar stuck at "Exception".
Then come the forms. First your name and address, which feels harmless because you're "fixing" a delivery. Then a card number for a fee so small that nobody thinks twice. That small fee is the bait. The card number, expiration date, security code and billing address are what the scammers actually want.
The "reply Y" line is there for a reason. On many phones and messaging apps, links in texts from unknown senders aren't clickable. Replying makes the conversation look like an exchange with a known contact, which can switch the link on. It also confirms that your number is active and answered by a real person, which is useful to the next scammer too.
Why the tracking-number test beats spotting typos
Here's the thing about the classic warning signs. Scammers have fixed them. The texts are written cleanly, the web addresses contain words like "usps" or "tracking" and the pages copy the real design down to the fonts. Asking people to spot a fake by its looks is asking them to win an arms race they can't win on a 6-inch screen.
The tracking-number test doesn't care how good the fake looks. According to the U.S. Postal Inspection Service, USPS doesn't send text messages or emails unless a customer first requested the service with a tracking number, and those messages don't contain a link. USPS also doesn't charge for tracking updates. So if you never signed up for texts about that specific package, the message didn't come from the Postal Service. No other check is needed.
USPS, UPS, FedEx and Amazon: what a real notice looks like
The same scam rotates through every big brand. Each company's own rules give you a quick way to check.
| Brand in the text | How real updates reach you | Where to check instead |
|---|---|---|
| USPS | Texts only after you request them with a tracking number, with no link and no fee | Type usps.com yourself and enter the tracking number from your order |
| UPS | UPS says it doesn't ask for payments, personal or financial information in an unsolicited way, and a real UPS contact can always give you a tracking number | Check that tracking number on ups.com |
| FedEx | FedEx has said it doesn't send unsolicited texts or emails asking for money or personal information about a package | Use the FedEx app or fedex.com, not the link |
| Amazon | Amazon says it will never ask you to pay outside its website or for remote access to your device | Open the Amazon app and look at Your Orders |
Notice what all four have in common: the safe path always starts with you opening the app or typing the address yourself, never with a link someone sent you.
Before you tap anything: a 20-second checklist
- Did you sign up for text alerts for this exact package? If not, it's fake.
- Does the message ask you to reply, then reopen it? Real carriers don't need that.
- Is there a fee to redeliver, update an address or release a package? Treat it as a scam.
- Does it come from a regular 10-digit number or an email address instead of a known short code? That's a common sign of a scam text.
- Is there a countdown, such as "within 24 hours"? Urgency is the scammer's tool, not the carrier's.
- Still unsure? Open the carrier's app or website yourself and paste in the tracking number from your order email.
If you already tapped the link or paid the fee
Lots of careful people do. The page looked real and the fee was small. What matters now is speed.
- Call your card issuer right away using the number on the back of your card. Tell them you entered the card on a phishing site and ask for a new card number. Don't wait to see if strange charges appear.
- Change any password you typed in, and change it anywhere else you reuse it. Turn on two-step verification for your email first.
- Expect a follow-up call. Your name, address and card details are now a ready-made script. The next contact is often a fake call from "your bank's fraud department" about suspicious charges. Our guide to the fake bank fraud department call explains how that one plays out.
- Report the text. Forward it to 7726 (SPAM), which works on the major US carriers. For USPS-themed texts, the Postal Inspection Service also asks you to email the message text and a screenshot showing the sender's number and date to spam@uspis.gov, without clicking the link. You can report losses to the FTC at ReportFraud.ftc.gov.
- Delete the conversation once you've reported it, so nobody in your household taps it later.
Wondering whether forwarding to 7726 is worth the effort? Our FAQ on whether reporting spam to 7726 does anything answers that honestly.
Why you got the text in the first place
You weren't singled out because of a package. These texts go out in huge batches to lists of numbers, and the senders count on the fact that at any moment millions of people are waiting for a delivery. During the holidays the odds are in their favor. The same kind of operation also sends unpaid toll texts, which is why the two scams look so alike.
Blocking the sender won't help much on its own. The numbers and links change constantly. The habit that protects you is ignoring links in delivery texts entirely and checking deliveries only through the carrier's own app or website. If a number keeps texting you, you can look it up on Who Called This? and see what other people reported about it.
Package text questions
Does USPS ever text about a delivery problem?
Only if you signed up for text tracking for that package, and even then the message doesn't include a link or ask for payment. An unrequested USPS text with a link is a scam.
I'm really expecting a package. How do I check it safely?
Find the tracking number in your order confirmation from the store, then type the carrier's website into your browser or open its official app. Don't use the link or number in the text.
Is the unpaid toll text the same scam?
It's the same playbook with a different costume: a small fee, a deadline and a lookalike payment page. Our FAQ on the toll text scam covers that version.
The bottom line
You can't out-spot a well-made fake on a phone screen, so stop trying. Ask one question instead: did I give this company my number for this package? If the answer is no, the text is not from them, no matter how real it looks. Check your deliveries through apps and websites you open yourself, and let every delivery link go.