Package Delivery Scams: Fake Notices, Fees, and Tracking Links

How the fake delivery notice works

A package delivery scam is a message that imitates a shipping notice in order to get you onto a page that collects a payment or a login. It usually arrives as a text, sometimes as an email, and it almost always contains a link labeled as tracking.

The message works because of timing, not persuasion. Between online orders, gifts, and returns, most households have something in transit most weeks, so a delivery notice lands on fertile ground. The scammer does not need to know what you ordered. Sending the same message to a very large number of phones means some of them belong to someone waiting for a box.

The U.S. Postal Inspection Service calls the text version smishing and states the rule that settles most of these: the Postal Service will not send customers text messages or emails without a customer first requesting the service with a tracking number, and it will not contain a link. That is from its page on package tracking text scams. A message you did not sign up for, containing a link, already fails.

Why the fee is always small

The amount is deliberate. A few dollars for redelivery, a small customs charge, a shipping adjustment: an amount low enough that arguing with it costs more attention than paying it, and low enough that you are unlikely to call anyone before you pay.

The fee is not the payday. The card number, expiry date, security code, name and billing address you type to pay it are the payday. Those details can be used elsewhere, sold, or tested with small charges before a larger one. The few dollars that actually left your account is the cheapest part of the transaction for you and the least interesting part for them.

Some versions skip the fee and ask you to log in to a carrier account, a retailer account, or an email account to reschedule the delivery. That version is after the password. Some ask you to confirm your address and date of birth to release the package, which is after identity details rather than money.

The Federal Communications Commission tracks how this adapts. Its guidance on package delivery scams notes versions that claim your order is stuck in customs and that a tariff must be paid before it can be delivered. The story changes with the news. The request does not.

What carriers actually do

Carriers communicate about deliveries, but not the way these messages do, and the differences are usable.

The Postal Service sends tracking texts only when a customer has asked for them for a specific tracking number, and those messages do not carry a link. Private carriers say the same about unsolicited messages: the FCC’s guidance notes that two of the largest parcel companies state they do not seek payment or personal information through unsolicited texts and emails. A real redelivery notice from a carrier is more likely to be a slip left at your door or a notice in an account you already have.

The companies being imitated are victims here too. A carrier whose name appears in a fraudulent text did not send it, does not profit from it, and generally finds out about it from customers. The same goes for the retailer whose order confirmation the message is pretending to continue. USPS publishes its own scam and scheme alerts, and the Postal Inspection Service documents the email version of the same thing.

Carriers also do not need your date of birth, your Social Security number, or your online banking login to hand you a box. If a page asks for those in order to release a package, that is the whole answer.

How to check a tracking number without touching the link

The method is to leave the message entirely and start from the carrier. Typing a tracking number into a site you navigated to yourself is the check, and it takes about a minute.

1. Do not tap the link. Leave the message open if you want the number, but do not open anything it offers.
2. Find the tracking number you already have. Look in the order confirmation from the retailer, in your account’s order history, or in the carrier’s own app if you use one. If the only tracking number you have is the one in the suspicious message, treat it as unverified and go to the order instead.
3. Go to the carrier’s site yourself and type the number in. Open a browser and type the carrier’s address by hand, or use the carrier’s app that you installed. For the Postal Service that is usps.com. Do not search for the carrier and tap the first result, since sponsored results can be bought by anyone.
4. Compare what you see to what the message claimed. If the carrier’s own site shows the parcel moving normally, or shows nothing at all for that number, the message was not about a real problem.
5. If there really is a held parcel, deal with it through the carrier. Use the options inside the carrier’s own site or app, or the number printed on a physical notice left at your address. Do not use a phone number from the text.

The same logic applies to a code on a printed delivery notice or on a slip in a package, which hides the address until you scan it. Our guide to QR code scams covers how to read the destination before you open it.

Other versions of the same scam

The fake fee is the most common, but the delivery story gets reused for several different asks, and recognizing the family helps.

The call that follows

Some versions follow the text with a phone call from someone presenting themselves as the carrier, the retailer, or the fraud department of your bank, saying they noticed a suspicious charge related to the delivery. That is a different scam wearing the same costume, and it is covered in our guide to impostor scams.

The package you did not order

A parcel arrives with no explanation, sometimes followed by a message asking you to pay for it or to scan a code inside. Merchandise you did not order is generally yours to keep and you are not required to pay for it, according to the FTC’s page on being billed for things you never got. A demand for payment afterward is a claim to verify, not a bill.

The missed delivery at the door

A printed slip left at a home can be faked as easily as a text, with a phone number or a code that leads to the same page. A genuine carrier notice can be verified against the carrier’s own tracking for the parcel, which brings you back to the same check.

What to do if you already paid or entered your details

Treat the card you typed as exposed, even if the charge was tiny and even if it looks like it went through normally.

1. In the first hour, call your card issuer or bank using the number on the back of the card or in your banking app. Say the details were entered on a fraudulent page, ask for the card to be replaced, and ask them to watch for charges. Under Regulation Z, liability for unauthorized credit card use is capped at the lesser of fifty dollars or the amount charged before you notify the issuer, and the FTC’s comparison of card protections shows that a debit card gives you less room the longer you wait.
2. Change the password for any account you logged into, going to the real site directly rather than back through the message, and change it anywhere you reused it. Turn on multi-factor authentication on that account.
3. Check your statements for small test charges. A one or two dollar charge you do not recognize is often a probe before something larger, so report it rather than ignoring it.
4. If you gave identity details such as your Social Security number or date of birth, use the FTC’s free recovery service at IdentityTheft.gov, which builds a recovery plan and generates the letters.
5. Keep the message. Screenshot it before deleting, including the sending number and the address of the page, because reports are more useful with that attached.

Where to report a fake delivery notice

Forward the text to 7726, which spells SPAM on a phone keypad. That reports the sending number to your wireless carrier, and the FCC points to it in its guidance on smishing. You can also file a complaint with the FCC.

If the message imitated the Postal Service, send it to the Postal Inspection Service. Its smishing page asks for suspicious USPS-related texts to be sent to its reporting address with a screenshot of the message, and it takes reports of mail fraud at uspis.gov/report. If a private carrier’s name was used, that carrier has its own fraud reporting address, which you can find on the carrier’s real site.

Report the scam itself to the FTC at ReportFraud.ftc.gov and, if you lost money, to the FBI’s Internet Crime Complaint Center. Phishing and spoofing was the most reported crime type in the Internet Crime Complaint Center’s 2025 Internet Crime Report, with 191,561 complaints, and fake delivery notices are part of that traffic. Our guide to how to report a scam covers the order and what each agency does with the report.

What this check cannot do

Going to the carrier yourself is reliable, but it is worth being clear about where it stops.

It does not stop the messages. Numbers are cheap and rotate constantly, and forwarding to 7726 helps carriers block a sender without preventing the next one. Expect to keep receiving these, particularly in the weeks around holidays.

It does not tell you whether a parcel is genuinely delayed. Carriers lose things and scans fail, so an unhelpful tracking page is not proof of fraud. It only tells you that the message was not how you should have found out.

And it does not recover money already sent. A card payment can be disputed with the issuer, which is a real process but not a promise of a refund. A payment made by gift card, wire transfer, cryptocurrency, or a transfer through a payment app to a person is rarely recovered at all. Reporting quickly gives you the best chance available, which is not the same as a good chance.

These messages are designed to be read in three seconds while you are doing something else. Responding to one says nothing about you except that a plausible message arrived on a day you were expecting a package.

Package delivery scam FAQ