Is that delivery text real? How to spot a fake
"Your package could not be delivered. Update your address here." Texts like this pretend to come from the Postal Service, UPS, FedEx, or Amazon, and they arrive by the millions, especially as holiday shopping picks up. The link leads to a fake website that asks for a small "redelivery fee," your card number, or your personal details.
The one rule
Don't tap links in delivery texts you didn't ask for. The Postal Service says it won't text or email you unless you signed up for tracking with a tracking number, and even then its messages won't contain a link. If you're expecting a package, check on it yourself, using the store's app or website or the tracking number from your order confirmation.
Warning signs
- You weren't expecting anything, or the text doesn't name what you ordered.
- It asks for money. A small "redelivery" or "customs" fee is the most common trick. Never pay through a link in a text; if you think a fee might be real, look up your package on the carrier's own website.
- It rushes you. "Respond within 12 hours or your package will be returned."
- The link looks odd: misspellings, extra words, or strange endings instead of usps.com, ups.com, fedex.com, or amazon.com.
- It comes from a regular phone number or an email address instead of a short 5- or 6-digit number (like 28777) from a service you signed up for.
- It asks you to reply "Y" and reopen the message so the link works. That's a trick to get around your phone's protections.
What to do with one
- Don't tap the link and don't reply, not even "STOP."
- Report and delete it on your phone. On iPhone, tap Report Junk under the message if you see it, or press and hold the message and choose Delete. On Android, press and hold the conversation, then tap Block and choose Report spam.
- If it claimed to be the Postal Service, you can also email it to spam@uspis.gov, with a screenshot (a picture of your screen) that shows the sender's number and the date. On an iPhone, press the side button and the volume-up button at the same time (on iPhones with a Home button, press the side button and the Home button). On Android, press the power button and the volume-down button at the same time.
If you already tapped the link
Don't panic. Tapping alone rarely does harm, but if you typed in anything:
- Card or bank details: call the number on the back of your card right away and ask them to block it and send a new one.
- A password: change it, and change it anywhere else you used the same one.
- Your Social Security number or other personal details: visit IdentityTheft.gov for a step-by-step recovery plan.
Then report it at ReportFraud.ftc.gov. It takes a few minutes and helps investigators spot patterns.
Sources: U.S. Postal Inspection Service, FTC. Menu names vary slightly by phone model.
