Key Takeaways
- Spot Fake Tracking: A USPS text scam uses a fake address problem, redelivery fee, or customs charge to get your details. Real USPS tracking texts come from 28777 after you request updates, contain no links, and never ask you to pay for redelivery.
- Act After Clicking: If you opened a USPS scam link, close it and contact your bank. Replace any exposed card, dispute charges, ask your payment app or bank to reverse transfers, freeze your credit if you shared personal details, and change any passwords you entered.
- Report and Filter: If a USPS text scam costs you money, file at ReportFraud.ftc.gov. Report the text to spam@uspis.gov and 7726, track packages directly at USPS.com, and use Screen Unknown Senders on iPhone or Spam Protection in Google Messages since scammers rotate numbers.
You get a text saying USPS can’t deliver your package unless you fix your address or pay a small fee. If it came out of the blue and asks you to tap a link, it’s almost certainly a USPS text scam. Real USPS tracking texts come from 28777 after you request updates for a specific tracking number. They carry no links, and USPS never demands a fee to redeliver your package.
The timing can make the text feel real if you’re expecting a holiday order. You can check on your package, report the text, and filter future messages without touching the link. If you already clicked or paid, what you do next depends on what you shared.
How to Tell a Real USPS Text From a Fake One
Look at who sent the text and what it asks you to do. Then think back to whether you asked USPS to text you about that package.
USPS Only Texts You After You Sign Up
Text your tracking number to 28777 to get an update. If you sign up for the first time on USPS.com, reply YES to the welcome text.
If you never requested texts for that tracking number, treat the message as suspicious. A tracking request lasts up to two weeks and ends when the package arrives.
Real Tracking Texts Never Contain a Link
The U.S. Postal Inspection Service says real tracking texts have no links. A normal update can tell you where your package was scanned, when that happened, and what its current status is.
A lookalike web address can lead to a fake page, a trick you’ll also see in phishing emails. If a supposed USPS tracking text contains a link, check your package separately.
USPS Does Not Charge Redelivery Fees by Text
The Federal Trade Commission says USPS never demands payment to redeliver a package. If you missed a delivery, go directly to USPS.com or follow the instructions your carrier left.
A fee of a dollar or two might feel too small to worry about. Once you enter your card details, the scammer can use them to make much larger charges.
The Fake USPS Texts Going Around This Holiday Season
A delivery alert can seem real when you’re waiting on several orders. The text gives you a reason to act fast, and a problem with your address is a common excuse.
The Wrong Address or ZIP Code Message
The text says your parcel is sitting in a warehouse because the address is incomplete or the ZIP code is wrong. It may give you 24 or 48 hours to update your details through a link.
These messages have come from numbers starting with +63, U.S. numbers, and random email addresses. Even if the sender looks local, go to your order email for the real tracking number.
The Customs or Tariff Fee Message
This version says you owe customs duty before your package can be delivered. It borrows from a real change to U.S. tariff rules for imports under $800 that took effect in August 2025.
The claim can sound convincing when you’re expecting a holiday order from an overseas seller. Check the order with the seller through a channel you already use, and leave the payment link in the text alone.
The Reply Y to Activate the Link Message
On an iPhone, iMessage can leave links from unknown senders inactive. A scammer may tell you to reply Y and reopen the message so the link becomes tappable.
The message may also tell you to paste the address into Safari to get around the inactive link. Leave the link alone and skip the reply. Even a single letter confirms your number is active.
The same playbook drives the unpaid toll text scam, so the warning signs carry over.
Why These Texts Keep Coming
You can block today’s sender and get nearly the same text from another number tomorrow. The people behind these campaigns rotate numbers and replace the sites their texts point to.
Palo Alto Networks’ Unit 42 linked a U.S. package and toll text campaign to Smishing Triad, a network that provides phishing tools to other scammers. USPS was the single most impersonated service in that campaign, with more than 28,000 domain names tied to it. Nearly three in ten domains across the campaign were active for two days or less.
Texting was the most commonly reported way scammers contacted people in FTC reports for 2025. Your phone’s spam filters can catch messages from senders you haven’t blocked. You may recognize the same tactics in an unpaid toll text scam.
What to Do If You Clicked the Link
What you do next depends on what you entered or paid. If the page is still open, close it before dealing with any money or information you handed over.
Close the Page Without Typing Anything Else
Close the browser tab and leave any file or app the page offers alone. If you only opened the page and didn’t enter anything or download a file, the risk is lower.
The Postal Inspection Service advises contacting your financial institution after any interaction with the link. Tell your bank whether you entered anything.
Call Your Card Issuer If You Paid the Fee
Call the number on the back of the credit or debit card you entered. Ask the issuer to cancel and replace the card, and dispute the payment and any charges you didn’t authorize.
Federal law limits your liability for unauthorized credit and debit card charges, and reporting quickly helps protect you. Keep checking your statements for small charges you don’t recognize, since a scammer may use one to test your card.
Report a Payment App or Bank Transfer Straight Away
If you paid through PayPal, Venmo, or Cash App, report the payment to the app right away. Ask whether it can reverse the transaction and refund your money.
For Zelle or another bank transfer, ask your bank to reverse the payment right away. Keep the receipt or transaction record so the app or bank can identify the payment.
Freeze Your Credit If You Gave Personal Details
If you typed in your date of birth, Social Security number, or full address, check IdentityTheft.gov/databreach for steps based on what you shared. You can place a free credit freeze with each of the three credit bureaus.
If someone has already misused your Social Security number, file a report at IdentityTheft.gov. The site gives you a recovery plan based on what happened.
Change Any Password You Typed
If the page asked you to sign in to USPS or enter your email password, go directly to the real account and change the password you typed. Do the same on any other account where you used that password.
Turn on two-factor authentication for those accounts when it’s available. If you can no longer sign in, use the account provider’s recovery process from its real site.
Expect Follow-Up Calls and Texts
Be careful if a caller claims to be from your bank’s fraud team after you entered card details. A follow-up call or text can be another attempt to get information from you.
Hang up and call the number on the back of your card. That lets you ask the issuer directly whether it contacted you or saw any charges that need your attention.
How to Report a USPS Scam Text
You can report the message even if you never opened the link. Keep it long enough to capture the sender and date for the Postal Inspection Service.
Send It to spam@uspis.gov and 7726
Copy the text without tapping its link and paste it into a new email to spam@uspis.gov. Include your name and a screenshot that shows who sent it and when.
Say whether you clicked, paid, or gave the page any personal details. Then forward the original text to 7726, which spells SPAM, so your mobile carrier can review it and block the sender.
File With the FTC or IC3 If You Lost Money
If you lost money, report the scam at ReportFraud.ftc.gov, even if the charge was only a few dollars. For a larger loss, you can also file a complaint with the FBI’s Internet Crime Complaint Center at ic3.gov.
Keep the screenshot and payment receipts. They show when the text arrived and how much you paid.
How to Check on a Real Package Safely
You can check on your package without going back to the text. Find the tracking number in your retailer’s shipping email and use it to look up the delivery yourself.
Type usps.com into your browser or open the USPS Mobile app, then paste in the tracking number. Sign up for Informed Delivery to see which packages are expected. You can also text your tracking number to 28777 to request updates.
| What to check | Real USPS tracking text | USPS scam text |
|---|---|---|
| Sender | 28777 | May be a regular phone number or email address |
| When it arrives | After you request updates | Can arrive when you have no package coming |
| Links | None | Often point to a lookalike site |
| Payment requests | None | May ask for redelivery or customs fees |
| What it asks for | No action to release your package | May ask you to update your address or enter card details |
Stop Most Scam Texts Before They Reach You
Your phone can move some suspicious texts out of your main inbox. On an iPhone, start with the two filters in Messages.
Turn On Screen Unknown Senders on iPhone
On iOS 26, go to Settings > Apps > Messages > Unknown Senders > Screen Unknown Senders and turn it on. It’s off by default, though it carries over if you had Filter Unknown Senders on in iOS 18.
Filter Spam is on by default on iOS 26 and later. You can see what it caught under Messages > Filter > Spam. Links in that folder stay inactive unless you move the message back to your inbox.
Keep Spam Protection On in Google Messages
Google Messages has Spam Protection on by default. In the U.S., its Scam Detection feature checks conversations with people outside your contacts on your phone and can warn you when it sees signs of a scam.
To report a message from the conversation list, touch and hold it, then choose Block > Report spam > OK. The report goes to Google and may also send the sender’s number and latest message to your carrier.
On Android you can also turn on Android scam detection for calls and messages.
Never Reply Even to Say Stop
Even a STOP reply can tell a scammer your number is active. Report the message and delete it.
If scam texts keep coming from email addresses, call your carrier at 611. Ask if it can block texts sent to your number by email.
Scam emails use the same tricks, as our phishing email examples show.
FAQs
USPS sends its tracking texts from 28777. You can start a request by texting your tracking number to that short code or by signing up for updates on USPS.com.
Simply reading a USPS scam text is unlikely to compromise your phone. The bigger risk comes from following its link, downloading something, or typing information into the page. If you opened the link, the Postal Inspection Service advises contacting your financial institution even if you submitted nothing.
Yes, a scammer can use the card details you entered to make more charges. Call your card issuer using the number on the back, ask for a replacement card, and dispute any unauthorized charges. Keep checking your statements for charges you don’t recognize.
USPS doesn’t charge to redeliver your package, though import duty can apply to an order from abroad. A text asking you to pay customs duty through a link isn’t a USPS tracking update. Check the order directly with your seller if you’re unsure.
Scammers can send fake USPS notices to your number even when you haven’t ordered anything. They’re counting on the message reaching people who happen to be expecting a delivery. The next text can come from a different number even after you block the first one.
No, don’t text STOP back to a fake USPS message. That can confirm your number is active. Save STOP for genuine tracking updates you requested from 28777, and report and delete the scam text.
