USPS / Package Text Scams: 3 Variants and the One Rule That Defeats Smishing

The most-reported text-scam category in the FTC's 2024 dataset. A text claims USPS has a delivery problem and asks for a $1.99-$3.99 redelivery fee paid by credit card on what looks like the USPS website. The credit card data is immediately used for tens to hundreds of dollars in unauthorized charges or sold on darknet markets.

A r/Scams victim describes the canonical loss in the thread "Fell for USPS text scam 😭" (80 upvotes). The author received the standard text — package delayed, please update delivery information at the linked URL. They were expecting a package. The page they landed on was, by their own description, indistinguishable from the real usps.com on a phone screen — same logo, same navigation, same tracking-number entry field. They entered the address and paid the $1.99 redelivery fee with their primary credit card. Within four hours, three transactions had appeared on the card: $89 at a gas station two states away, $217 at an electronics retailer, $89 again at a different gas station. The card was clearly being card-tested before resale.

The mechanism the FTC documented in its 2024 top-text-scams spotlight is identical: "Many people reported paying a small 'redelivery fee' that turned out to be a trick to get their credit card or even Social Security number." The fee is small precisely because it is a credential-harvest vehicle, not a payment scam in the traditional sense — the scammer does not care about the $1.99; they care about the 16-digit card number, expiration date, and CVV that the victim types in to "pay" it. Once the card data hits the scammer's database, it is tested with small probe charges (gas stations are common because of low-friction approval), then either used for larger purchases the same day or batched and sold to other operators within 24-72 hours.

The fix is upstream of the click. If you are expecting a package and want to check delivery status, type usps.com into your browser and use the tracking number from your purchase confirmation email. Real USPS does not send delivery-problem texts that include payment requests; the agency's official position, repeated on the USPIS smishing alert page, is that tracking texts only confirm status and never request payment or personal information. If you have already entered card information: call your card's issuing bank's fraud line on the number printed on the back of the card (not any number from the suspicious text), report the compromise, and request a card replacement. Most issuers can freeze the card within minutes and reverse pending unauthorized charges within hours.

The USPS variant is the volume play because USPS is the most-recognized U.S. carrier brand. The next variant runs the identical script with the brand swapped out — and works for the same reason.

The same script with FedEx, UPS, DHL, or Amazon branding instead of USPS. Identical harvest pattern: fake delivery problem text, lookalike domain (fedex-redelivery.com, ups-tracking-update.com, amazon-orders.support), credit card or identity capture. Picks whichever carrier the recipient most likely actually uses.

The brand-swap variant exists because no single carrier dominates 100% of U.S. package volume. USPS handles roughly 40% of last-mile package deliveries; FedEx, UPS, and Amazon Logistics divide the remainder. A scammer running a USPS-only campaign reaches a fraction of recipients who happen to be expecting a USPS package; running USPS, FedEx, UPS, DHL, and Amazon variants in rotation increases the addressable base proportionally. The infrastructure is shared — same SMS gateways, same hosting, same lookalike-domain registrars, same credit-card-harvest backend — only the brand assets and URL pattern change.

The Amazon variant deserves separate attention because Amazon's volume is enormous and the brand exposure is daily for many recipients. The Amazon-impersonation text typically claims an order verification problem, a delivery exception, or a refund issue — anything to drive a click to a lookalike Amazon login page. Once the victim enters their Amazon username and password, the credentials harvest unlocks not just Amazon order history (which contains addresses, payment methods, and purchase patterns) but often other accounts as well — the same email-and-password combination is frequently reused on banking, retail, and email accounts. The Federal Communications Commission's package-delivery scam guidance specifically calls out Amazon-impersonation texts as a parallel category to the carrier-impersonation variants, with the same defense pattern.

What works is the same upstream rule with one extension. For any carrier — USPS, FedEx, UPS, DHL, Amazon — type the official URL into your browser yourself and use the tracking number from your purchase confirmation. Never tap a link in any package text, regardless of which carrier is named. If a text references "your Amazon order" but you do not currently have any open Amazon orders, that itself is the diagnostic — Amazon does not text recipients about orders that do not exist. The brand variation is the scammer's adaptation to carrier diversity; the defense does not adapt because the underlying mechanic is identical across all five major brands.

The first two variants harvest payment information. The third variant trades the credit card harvest for a slower, more dangerous identity harvest.

The slower, more damaging variant. Instead of asking for a credit card and a small redelivery fee, the lookalike page asks for "address verification" requiring full name, DOB, and Social Security information. The harvested identity feeds new-credit-line fraud, fraudulent tax returns, and darknet identity markets — surfacing weeks or months later, often when the victim no longer remembers the original text.

A r/phishing victim describes the variant in the thread "I think I just fell for a USPS text scam, let me know what I should do!" (41 upvotes). The author tapped the link in a USPS-branded text expecting the redelivery-fee variant — they had read about the credit-card harvest pattern and were prepared to abandon if a payment screen appeared. Instead, the page asked for "USPS account validation" requiring full name, complete address, date of birth, and Social Security number "to confirm postal-service eligibility." The framing was different enough from the credit-card variant to bypass their pattern recognition. They entered the information, then realized within minutes that USPS does not require Social Security numbers for any consumer service. They placed credit freezes the same evening, but the harvested identity bundle had already moved.

The identity-harvest variant is more damaging than the credit-card variant for two reasons. First: the attack surface is wider. A credit card can be canceled within hours; a Social Security number cannot be changed, and the harvested identity feeds fraud pipelines that can run for years. Second: the damage surfaces slowly. New credit lines opened in the victim's name may not appear on the credit report for 30-60 days; fraudulent tax returns may not surface until the victim files their own return and is rejected. The FTC's smishing data bundles this variant under the same package-delivery category, but the FBI tracks identity-fraud follow-on losses separately — and the per-victim losses on the identity-harvest variant are typically 10-50× the credit-card variant once the long tail plays out.

If you have already entered identity information on a fake USPS page, the response is structural and time-sensitive. Place a credit freeze with all three bureaus (Experian, Equifax, TransUnion) the same day — free, takes 5 minutes per bureau, prevents new credit lines from being opened in your name. File an IRS Form 14039 Identity Theft Affidavit before the next tax-filing season to flag your account. Sign up for free credit monitoring through one of the bureaus or through a service like AnnualCreditReport.com. File at uspis.gov/report and at identitytheft.gov (the FTC's dedicated identity-fraud portal) — the latter generates a personalized recovery plan based on what you entered. Watch your bank, credit card, and IRS accounts for at least 12 months; identity-fraud follow-on can take that long to surface.