USPS scam texts: How to identify fake delivery messages

Fake USPS texts manipulate their recipients by taking advantage of the fear of missing out on a package delivery.

One Reddit user received a fake USPS text claiming their package had arrived at the warehouse, but their address couldn’t be verified. Trusting the link, they entered their address, phone number, and email before realizing their mistake. Seeking advice, they turned to the Reddit community, where they discovered they weren’t alone — others admitted to falling victim to similar text scams.

How do USPS text scams work?

USPS text scams impersonate automated messages from the United States Postal Service (USPS), tricking recipients into thinking they’ve missed a package delivery. These fraudulent texts often include messages like “Please confirm your address” to fool you into clicking links to malicious websites.

These fake texts usually rely on two forms of social engineering:

• Pretexting: This is when cybercriminals create a fake identity or scenario to make their story more believable. In a USPS scam, the pretext is often a supposed package that needs additional information for delivery.
• SMS Spoofing: Cybercriminals use SMS spoofing technology to alter their sender ID or otherwise mask their phone number, making text messages seem legitimate.

These fake texts are a type of smishing, or SMS phishing, a technique to steal information through texts that guide users to spoofed sites mimicking the official USPS site.

These bogus pages aim to collect personally identifiable information (PII), such as your name, address, and card details. Scammers could then sell any information you enter on the dark web or use it to steal your identity. Other times, they’ll ask you to pay small redelivery fees through fake payment portals.

How to spot a USPS scam text

Illegitimate USPS texts tend to contain bad grammar, invalid tracking numbers, and outgoing links. Here are some things to look out for when spotting USPS text scams:

• Outgoing links: USPS never includes outgoing links in its texts, even to the official USPS website. Avoid clicking links from texts claiming to be from the organization.
• Unexpected Messages: You will only receive USPS messages if you request them specifically. If you never ordered a package or aren’t expecting a gift, you shouldn’t be receiving notifications.
• Bad grammar: A professional organization like USPS won’t text you with bad grammar. Misspelled words or unusual syntax are red flags you’re receiving texts from a scammer.
• Invalid tracking number: Tracking codes sent to you via text message that can’t be verified in the USPS Tracking tool are scams. Official tracking numbers are usually between 20 and 22 digits, with exceptions for international packages.
• Sense of urgency: Fake messages make users believe they will lose packages unless they click a link and act quickly. These messages may claim they’ve attempted delivery multiple times.
• Redelivery fees: USPS does not charge redelivery fees. You can schedule a free redelivery on the official USPS website.

Do not respond to any suspected USPS scam texts. Engaging with these messages signals to scammers that your phone number is active, which can lead to more scam attempts.

Below is an image comparing a legitimate USPS text (left) and a fake one (right), with some telltale signs that the text is genuine or a scam.

Does USPS send text messages?

USPS will only send texts if you sign up for SMS notifications on the USPS site or request them by texting 28777 (2USPS). For example, if you text “Delivery” along with your tracking number to 28777, USPS will send you a text informing you when your package is scheduled to arrive. USPS will never send you texts unless you ask for them.

If you request an SMS notification about a package delivery, USPS will include the following information:

• Who’s delivering the package (USPS).
• The package’s tracking number.
• The delivery status of the package.
• The date, time, and location for pickup.
• Instructions on how to stop further texts.

This message will not contain any links.

What to do if you fall for a USPS text scam

If you fall for a USPS text scam and expose your personal information, lock down your USPS account, change passwords on any accounts where you used the same credentials, and contact your bank. To open a potential investigation, report the incident to the USPS, the Federal Trade Commission (FTC), and your local police department.

Here is a to-do list of actions to take if you fall victim to a USPS delivery scam:

• Change non-unique passwords: If you provided account credentials to the scammer, update other accounts where you reused them. Create unique, secure passwords, and use a password manager to manage them.
• Activate 2FA: Turn on two-factor authentication to secure your accounts against attempted takeovers. With 2FA, even if hackers steal your password, they still need access to your secondary verification method, such as an authentication app, to get into your account.
• Contact your bank: If you exposed sensitive payment information, contact the card provider to cancel your card. Dispute any unusual charges with your bank or credit card.
• Freeze your credit: Cybercriminals can use PII you expose to steal your identity. Temporarily freeze your credit report to prevent new accounts from being opened in your name.
• Scan for viruses: Use a virus removal tool to scan for malware you might have downloaded from an unsafe website or infected link.
• File a report with local law enforcement: Inform your local authorities of the fake USPS scam so they can open an investigation.
• File a report with the FTC: Report the incident using the Federal Trade Commission’s official reporting site. They can use this information to take action on a broader scale, helping protect other potential scam targets.
• File a report with the USPIS: Inform the United States Postal Inspection Service of the incident via their official reporting page. The USPIS is USPS’s official investigative authority, so they’re equipped to address mail delivery fraud.

While falling for USPS scam texts can be a scary experience, quickly securing your accounts and reporting the scammer will give you the best chance of mitigating the damage.

How to protect yourself from USPS scam texts

The best way to protect yourself from USPS smishing attempts is to verify every message, and never click a link in a text. If you suspect a scam text, block and report the message.

Here are some more details on how to stay safer:

• Double-check if the text is real: Recall if you’ve placed any orders lately. If you have, verify the tracking number using the USPS tracking tool.
• Don’t click links in USPS messages: Texts from the USPS never contain links. Links in scam messages will likely lead you to an unsafe site.
• Don’t open attachments: Opening an attachment could install malware on your device. USPS doesn’t include attachments in text messages.
• Block spam numbers: Stop spam texts by blocking spam numbers when they call or text you. Over time, this discourages spammers when they realize you won’t engage with them.
• Don’t reply: Don’t even respond with “no” — doing so confirms that your phone number is active, and you’ll likely receive more spam. While real USPS text messages always allow you to opt out of notifications, it’s safer to do so via their official site.
• Install antivirus software: Install a reliable antivirus solution, like Norton 360 Deluxe, to help keep malware like viruses and spyware off your device. Using AI-powered scam detection technology, Norton 360 Deluxe will also help block fake sites that could steal your passwords or other sensitive information.
• Remove your phone number from the web: Make sure your social media is private and check to see if your data is visible on people search sites to remove your information from the web. Norton’s Privacy Monitor tool can help you do this.

Stay safer from delivery scams

USPS text scams are a persistent threat, and even the most vigilant can accidentally click a malicious link. Norton 360 Deluxe offers powerful online security to help protect against scammers and malware.

Featuring AI-powered scam detection capabilities that can warn you about potential USPS scams, Norton’s advanced anti-scam technology can identify hidden scam patterns in texts through real-time analysis of suspicious messages. It also includes Privacy Monitor to help you remove your information from the web, so scammers have less chance to target you in the first place.

FAQs

What number will USPS text me from?

USPS texts its customers using five-digit short codes to send and receive delivery notifications.

Does USPS charge a redelivery fee?

No, USPS does not charge a redelivery fee. Scheduling redelivery with USPS is free, so any fee requests are a sign you’re dealing with a scammer.

What does a USPS tracking number look like?

A standard USPS Tracking number has 20 to 22 digits (for example, 9400 1000 0000 0000 0000). Priority Mail starts with 94, 93, or 92, followed by 20 digits. Certified mail starts with the number 7 and is 20 digits long. You can type this number into the USPS website to confirm it’s a legitimate tracking number.

How do I report a text as spam?

You can report a text as spam by forwarding it to 7726, which spells out “SPAM” on a number keypad. This lets your phone provider spot and block similar messages going forward.