The USPS Text Scam: Why You're Getting 10 a Week and How to Train Your Family to Delete Them

Check your messages right now. If you’re an average American adult in 2026, there’s a 50/50 chance you’ve received a fake USPS text this week. Maybe more than one.

“USPS: Your package is being held at our facility. Please update your address: [link]”

“U.S.Postal: Delivery failed. A $1.99 re-delivery fee is required: [link]”

Every American recognizes this text by now. It is, without exaggeration, one of the most common forms of fraud in the country. And despite USPS, the FTC, and the FBI shouting about it from every rooftop, Americans lost $470 million to package-delivery smishing texts in 2024 alone, according to the FTC.

If you’re a family member who’s worried about parents or grandparents clicking one of these, or you’re a parent trying to make sure your teen doesn’t — this is for you.

Why it works: timing, familiarity, low friction

The USPS smishing scam is effective because it rides on three pieces of modern life:

• Everyone is expecting a package. In 2026, the average American household receives 4–5 packages a month. When you get a text about a delivery problem, it feels plausible because one is almost always in flight.
• USPS is a federal agency, and we extend it government-agency trust. Unlike a text from “your bank,” a text from USPS doesn’t immediately trigger skepticism.
• The ask is small. The classic scam starts with a $1.99 or $3.50 re-delivery fee. It’s specifically small enough that victims enter a credit card without a second thought. The real theft happens after that — the credit card is used elsewhere, or harvested for identity theft.

USPIS — the U.S. Postal Inspection Service — has stated clearly and repeatedly: USPS does not send unsolicited texts about delivery problems. If you did not sign up for USPS Text Tracking (which requires you to initiate from usps.com), every text claiming to be from USPS is a scam. Full stop.

The exact patterns to teach your family

Pattern 1: The “missing information” text

The most common variant. Examples:

• “USPS: Your package couldn’t be delivered due to incomplete address. Please verify: bit.ly/xxxxx”
• “U.S.P.S: Package on hold — update delivery details: usps-trackupdate.info/id=[randomcode]”

Red flags: shortened URL (bit.ly, tinyurl), fake USPS domain (usps-trackupdate.info, not usps.com), generic greeting, a sense of urgency.

Pattern 2: The re-delivery fee text

“Redelivery attempt failed. $1.99 fee required to reschedule: [link]”

Red flags: USPS doesn’t charge re-delivery fees by text. The real cost of a second delivery attempt is zero. This is a pure credit-card harvesting pattern.

Pattern 3: The customs / import fee variant

“USPS: Import duty of $3.47 required for international package release. Pay here: [link]”

Red flags: USPS handles duties by physical notice, not text. And if you didn’t order anything international, why would this be landing in your phone?

Pattern 4: The survey / reward variant

“USPS: Thank you for being a valued customer! Claim your $50 reward: [link]”

Red flags: this one is almost comical. USPS does not run reward programs. Anyone offering you free money by text is lying.

The identical scam, wearing different logos

USPS is the most common, but the exact same playbook runs under dozens of brands:

• FedEx / UPS / DHL — identical pattern, different carrier name
• Amazon — “Your Amazon package requires address verification”
• Apple — “Your Apple ID has been locked”
• PayPal / Venmo / Zelle — “Unusual login attempt detected”
• E-ZPass / toll authorities — a huge 2025 variant: “You have an outstanding toll charge, pay now or face a fine”

Train your family to recognize the pattern, not the specific brand: unsolicited text + urgency + a link to click. That’s the scam. The brand on top is interchangeable.

Exactly what to do with a suspicious text

1. Don’t click the link. Even if you just want to “look.” Some links auto-execute malware or harvest your phone number for resale.
2. Don’t reply. Even “STOP.” Replying confirms to the scammer that your number is active and tells them you’re a human who reads your texts.
3. Forward the text to 7726 (SPAM). This is your carrier’s spam reporting shortcut. It costs nothing. It helps the carriers build filters.
4. Report it to USPIS. For USPS-branded scams specifically, email spam@uspis.gov with a screenshot. For the FTC: reportfraud.ftc.gov. For the FBI: ic3.gov.
5. Delete the message. Don’t block the number (scammers spoof numbers, so blocking is useless), just delete and move on.

How to real-track a real package

Teach your family this as a ritual: if you want to know about a package, go to the carrier’s website directly. Don’t click texts. Don’t click emails. Type usps.com, fedex.com, or ups.com into the address bar (or use the official app). Enter the tracking number that came from the merchant’s order confirmation.

If that ritual is established, USPS smishing texts become instantly useless — because even when your parent isn’t sure whether a text is real, their trained first response is to check on usps.com rather than click the link.

The larger smishing landscape

Package smishing is the volume leader, but the same techniques are powering a broader surge in text-based fraud:

• Bank fraud alerts (“Chase: unusual activity detected, reply YES to confirm or NO to cancel”). Replying triggers a call from a “fraud officer” who social-engineers your account access.
• IRS tax texts (“You have an outstanding balance of $XXX”). The IRS communicates by mail, never by text.
• E-ZPass / state toll authority texts — new in 2025, surging nationwide. Same pattern: click link, pay tiny fee, credit card harvested.
• Wrong-number texts (“Hey Sarah, it’s been a while!”) — the opening move of pig butchering scams. See the full warning signs of a pig-butchering crypto scam.

Training your family to delete on sight

Knowing about smishing doesn’t stop someone from clicking one at a weak moment. The only reliable fix is rehearsal — getting your family members to practice the “delete without thinking” reflex enough times that it becomes automatic.

This is the core of the family phishing simulation approach: send your parents and teens realistic fake smishing texts on a rotating schedule, so they build up the antibodies before a real one arrives. When they click on a drill, they see a kind, friendly page that walks them through what they missed. When they delete it correctly, they see a small celebration. After 6–8 weeks of this, most family members report they can spot a smishing text within three seconds of receiving it.

The one conversation to have this weekend

Text your parents, siblings, and teens a single message:

“Quick favor. USPS, FedEx, Amazon, E-ZPass, and your bank will NEVER send you a text with a link. If you get one, it’s a scam, delete it. If you’re ever unsure, text me a screenshot first — no shame, ever.”

That message, sent to your family group chat, is probably the highest-leverage 30 seconds of scam protection you can deliver this month. Send it now.

For the broader context on why families should run ongoing phishing drills, see our full guide to family phishing simulation. For protecting aging parents specifically, see the complete playbook for protecting elderly parents from scams. Teens are also a heavy target for delivery and gaming smishing — see our age-by-age guide to teaching kids about online scams without scaring them.