Package Delivery Problem? Maybe Not. Americans Are Swamped With Scam Texts

“Like all phishing, they’re trying to create the idea that there’s something you need to deal with right away,” says Steve Weisman, a professor of white-collar crime at Bentley University in Waltham, Massachusetts, and an expert in scams, identity theft and cybersecurity.   

It’s not always clear what the criminals do with the personal information they collect through smishing, Weisman says, but they may sell it to other bad actors or plan to use it in the service of future scams. You are more likely to trust future communications from them if they can provide personal details about you, he notes.  

Warning signs of smishing

You receive notice about a problem with the delivery of your USPS package when you haven’t made a tracking request (or haven’t even mailed one). Unless you explicitly sign up for status alerts on a package, you won’t receive a text from USPS, says Donna Harris, public information representative with the United States Postal Inspection Service (USPIS). “That’s not how the Postal Service connects with the customer,” she says. And if you never signed up for a USPS tracking request for a specific package, a text message citing one is undoubtedly a fake.  

The message has misspellings or awkward grammar. These are classic signs of a scam attempt (UPS also cites “excessive use of exclamation points”). However, note that with the advancement of artificial intelligence technology, scammers are becoming increasingly sophisticated in their replication of legitimate communications.

The text and/or the website lead to a request for payment and/or unnecessary information.  As FedEx says on its site, “FedEx does not request, via unsolicited mail, email, or text, any personal information about your account credentials or identity.”

There is no tracking number when one should be present. UPS states on its website, “If UPS contacts you regarding a package, the UPS representative will always be able to provide a tracking number, which you can verify on our website.”

How to thwart delivery-related smishing attempts 

• Don’t click on any link unless you can verify that it’s legitimate. (See warning signs above.)    
• If you’re suspicious of a tracking number, check it out. If the text cites a tracking number, copy and paste it into the search engine on the delivery service’s actual website. You’re likely to find that it’s a fake (note that USPS tracking numbers are extremely long).
• Go to the source. If you’re concerned that there might be a problem with a package you’re receiving or have sent, contact the service directly, rather than through the link. Sometimes scammers will use an address very similar to a real business’s, such as Fedx.com instead of FedEx.com. So if UPS is handling the package in question, for example, go to “ups.com” rather than clicking a link embedded in the text.
• Guard your personal information carefully. “Don’t ever offer it unless you’ve absolutely confirmed [that the request] is legit,” says Weisman.

Where to report package-delivery smishing

If it’s USPS-related smishing, send an email to spam@uspis.gov, including a screenshot of the text, your name and other relevant details (USPS offers more information here).

If you receive a suspicious text message that claims to be from UPS or FedEx, forward it to either fraud@ups.com or abuse@fedex.com.

Also, report smishing to the FBI’s Internet Crime Complaint Center (ic3.gov) or your state attorney general. Not every complaint leads to enforcement action, but the information can help officials spot trends and sometimes identify the criminals.

The free AARP Fraud Watch Network Helpline, 877-908-3360, has trained fraud specialists who can provide support and guidance on what to do next and how to avoid future scams. The AARP Fraud Watch Network also offers free online group support sessions.

This article, originally published in 2023, has been updated with new statistics and information on reporting scams.