That "We Couldn’t Deliver Your Package" Text Is the Most Reported Text Scam in America. Here Is the Five-Second Test.

It lands at the worst possible moment, which is not an accident. "We couldn’t deliver your package — confirm your address" or "a small redelivery fee is required to release your parcel," arriving in the exact week you are waiting on three things you actually ordered. You half-know better. You tap anyway, because the message is plausible and you genuinely do have a package out there somewhere.

This is the most reported text scam in the country, and we mean that in the narrow, countable sense rather than as a figure of speech. In its April 2025 Data Spotlight on the top text scams of 2024, the Federal Trade Commission put fake delivery problems at number one: "Messages about package deliveries, usually from someone pretending to be from the U.S. Postal Service, were the most reported text scam last year." The fake toll texts that got all the news coverage — and that we have written up separately — came in fourth.

The good news is that this particular con has an unusually clean kill switch. Because the real USPS publishes exactly how and when it will text you, you can settle almost every one of these messages in about five seconds, without tapping anything. Everything below about the Postal Service’s own behaviour comes from USPS and the U.S. Postal Inspection Service’s published pages, which we fetched and read rather than summarised from somebody else’s article.

Why this one is #1 — and the number the FTC leaves in a footnote

The headline figure is the money. In 2024, the FTC reports, "people reported $470 million in losses to these scams, more than five times the 2020 number." That is text scams of all kinds, not delivery alone, and the Spotlight’s framing of the trend is the part worth sitting with: "reported losses to text scams have skyrocketed even as the number of reports declined."

Read those two halves together, because they only fit one way. Fewer people are reporting, and more money is going out the door. That means the per-victim take went up, and it means the thing that improved was not the volume of texts but their success rate — which the FTC quantifies, in a footnote almost nobody reads: "The share of text scam reports indicating that money was lost increased as follows: 5% (2020), 4% (2021), 6% (2022), 9% (2023), 11% (2024)."

In 2020 roughly one text-scam report in twenty involved a loss. By 2024 it was better than one in nine. The messages got more than twice as good at taking money, and anyone who has looked at a recent one knows why: the spelling is fixed, the branding is right, and the page the link opens is a clean copy. The FTC describes the destination plainly — "a website that looks like the real USPS site – but isn’t." The old advice to watch for broken English and blurry logos is now worse than useless, because it tells you to trust anything well-made.

Two honest limits on these numbers, because we would rather hand you the caveats than have you find them later. The ranking is a sample, not a census: the FTC says "The top text scams were identified by hand-coding a random sample of 1,000 2024 text fraud reports containing a narrative description," and it notes that in its broader data "most toll and delivery scams are classified as imposter scams" rather than counted as their own category. And the whole dataset is a fraction of reality — the Spotlight cites research showing "only 4.8% of people who experienced mass-market consumer fraud complained to a Better Business Bureau or a government entity." So treat $470 million as a floor and the #1 ranking as a well-made estimate. Neither is the reason to be careful; the mechanics below are.

The five-second test, straight from USPS’s published rules

Here is what makes delivery texts easier to settle than almost any other scam: the Postal Service has written down the conditions under which it will text you, and they exclude essentially every message of this kind. Three facts, each from a first-party page.

One, it only texts you if you asked. The Postal Inspection Service states the rule and the reason together: "The Postal Service offers free tools to track specific packages, but customers are required to either register online, or initiate a text message, and provide a tracking number." Tracking is a service you switch on for a specific parcel, using a number you already have. It is not something USPS does to you because a package exists.

Two — and this is the one that does the real work — a genuine USPS tracking text contains no link. In the Inspection Service’s own words: "USPS will not send customers text messages or e-mails without a customer first requesting the service with a tracking number, and it will NOT contain a link." A real tracking reply is a line of status text. The entire category of "USPS texted me a link" is therefore settled before you examine the link at all, which is the point — you are not being asked to judge a URL, a skill the scam is specifically built to defeat.

Three, the real texts come from a short code, not a phone number. USPIS notes that "USPS utilizes the 5-digit short codes to send and receive SMS to and from mobile phones," and USPS’s own Text Tracking page names it: "Send a text to 28777 (2USPS) with your tracking number as the content of the message." 28777 spells 2USPS on a keypad, which is a handy thing to know because it makes the number memorable. A delivery text from a ten-digit mobile number, an overseas number, or an email-to-text gateway is not USPS, whatever the message says.

So the test is: did I ask for this, does it contain a link, and did it come from 28777? Any one of those three answers the question on its own. None of them requires you to tap, reply, or look anything up.

And there is a fourth check that costs nothing and covers every carrier, not just USPS: if you are genuinely expecting something, go to the carrier’s own site yourself and paste in the tracking number you were given when you ordered. The FTC’s version of this is the whole scam in one sentence — "contact the company using a phone number or website you know is real. Don’t use the information in the text message." USPIS says the same thing for the specific case where you are waiting on a parcel and the text might be real: "If you suspect the text message you have received is suspicious but are expecting a parcel, please do not click on any links."

The one honest exception, because a rule you cannot trust is worse than no rule

You will see "USPS will never text you" stated flatly all over the internet, and taken literally it is wrong in a way that will eventually bite someone. USPS does text, by design, and one of the things it texts can look alarmingly like the scam.

If you request tracking through the website rather than from your phone, USPS’s own page says that "if you make your request via usps.com, you will be required to reply ‘YES’ to a welcome message to confirm that you do, in fact, want to participate." So a USPS text asking you to reply YES is a real thing that really happens. The same page notes you do not need an account to use it — "To participate in Text Tracking, you do not need a usps.com account" — but that "upon your first use of the USPS Text Tracking service, you will be asked to opt-in to the service."

This matters for two reasons. The first is that an over-broad rule gets abandoned the moment it misfires: somebody who has been told USPS never texts, and then gets a legitimate USPS text, stops trusting the rule entirely. The precise version survives contact with reality. The second is that "reply YES" is itself a scam pattern in a different costume — the FTC’s number-three text scam is fake fraud alerts that "say to reply YES or NO to verify a large transaction," which connects you to a fake fraud department. The discriminator is sequence, not wording: a real USPS welcome message arrives seconds after you signed up on usps.com, because you just signed up on usps.com. An unprompted one does not.

One more piece of fine print, since it is the only money USPS mentions anywhere in this: "Standard Message and Data Rates may apply." That is your carrier charging you for a text, which is a different thing from the Postal Service charging a fee — and on the service itself, USPIS is emphatic to the point of exclamation mark: "USPS does not charge for these services!"

The "redelivery fee" is not a fee. It is a card-harvest.

The most common money version asks for a trivial amount — a dollar or two, sometimes under a dollar — to release a held parcel. The smallness is engineered. A $2 charge does not feel like a decision, and the whole design is to get a card number typed into a form without the reader ever experiencing the moment of handing over something valuable.

The FTC is explicit about what the fee is actually for: "Many people reported paying a small ‘redelivery fee’ that turned out to be a trick to get their credit card or even Social Security number." The fee is not the revenue. It is the pretext that makes a payment form look reasonable.

Which reframes the right response completely, and this is the part people get wrong. If you paid a fake redelivery fee, the $1.95 is not the loss and chasing it is not the task. You typed a card number, an expiry, a CVV and probably a billing address and postcode into a stranger’s form — that is a complete, ready-to-sell card record, and it does not expire when the charge settles. Worse, a small charge that goes through is useful to them in itself: it confirms the card is live and the details are correct. Treat the card as compromised and get it replaced, rather than waiting to see whether anything else happens. Your card’s own fraud process exists for exactly this and costs you nothing.

As for whether USPS would ever ask: we went and looked at the actual Redelivery request page on usps.com. It asks for a tracking or barcode number, confirms the address details, asks you to accept the terms and conditions, and then offers to sign you up for Informed Delivery notifications. There is no payment step anywhere in it. We are describing the form we fetched rather than quoting a price, because the useful fact here is structural: the official route to rescheduling a delivery never reaches a card field, so a card field is the answer.

The version that only wants your address is the one to worry about more

A large share of these texts never mention money at all. They ask you to "confirm your delivery address" or "update your details," and because that request is so modest it clears the suspicion bar that a payment demand would trip. People who would never type a card number will happily retype their own address, which they reasonably think of as public information.

It is not what the form is collecting. The Postal Inspection Service spells out the shopping list: "The criminals want to receive personally identifiable information (PII) about the victim such as: account usernames and passwords, Social Security number, date of birth, credit and debit card numbers, personal identification numbers (PINs), or other sensitive information." Name, full address, date of birth and a Social Security number is not a delivery correction. It is an identity, and the FTC’s own wording on this scam — after "their credit card" comes "or even Social Security number" — says the same thing.

The practical difference between the two versions is the remedy. A card can be cancelled and reissued in a morning; it is a genuinely solvable problem. A date of birth and a Social Security number cannot be reissued, which is why that version deserves the stronger response. If you gave up either, start at identitytheft.gov, which is the FTC’s own service and exists to get ahead of this before anything is opened in your name rather than after.

There is a tell in the request itself, too, and it is worth a second’s thought because it generalises. A courier that genuinely has your parcel already has your address — that is how the parcel got to the point of being out for delivery. An organisation asking you to supply information it must already hold is not correcting a record. It is building one.

If you already tapped the link, the threshold for acting is lower than you would guess

This is the single most useful line we found in the official guidance, and it is much more cautious than what people usually tell themselves. From the Postal Inspection Service: "If you have already interacted with the URL provided (even if you did not click ‘submit’), please notify your financial institution."

Note where that bar sits. Not "if you lost money." Not even "if you submitted the form." Interacting with the page at all is enough to warrant a call to your bank. That is a deliberately low threshold and it reflects something real: these pages can capture what you type as you type it, field by field, so an abandoned form is not necessarily an empty one. If you got halfway through entering a card number and thought better of it, you are inside the Inspection Service’s own definition of someone who should make the call.

In order, and none of it costs anything. Call the number on the back of your card or the one on your bank’s real website — not a number from the text — and tell them you entered card details on a page you now believe was fraudulent; ask about replacing the card rather than just watching it. If you entered a password that you also use anywhere else, change it at those other places first, because that is where the actual damage usually happens. Then turn on two-factor authentication on your email account before anything else, since email is the reset route for everything else you own.

The part that reaches our bench: what tapping a link actually leaves behind

Most of this con is a form on a web page, and most of the time the fallout is financial rather than technical. But two technical things come up often enough that they are worth naming, because customers routinely assume both are handled when they are not.

The first is your browser. If you typed a card number into that page on your computer, your browser may well have offered to remember it, and if you had autofill on, the form may have been pre-populated with more than you intended to give — name, address, a second card. Clearing history does not touch saved payment methods or saved addresses; those live in the browser’s settings and have to be removed deliberately. Worth checking on every browser profile on the machine, including the one nobody uses any more.

The second is the assumption that a link cannot do anything on its own. Usually, on an up-to-date device, that is true — the page needs you to type something. But "I only opened it" is also the exact sentence we hear before finding a browser full of notification permissions, a new search provider, and an extension nobody installed on purpose. If the machine behaved oddly after the visit — pop-ups outside the browser, a homepage that changed, a slowdown that started that day — that is worth a proper look rather than a reassurance, and it is the kind of thing we can sort out in one visit.

What we cannot do is anything to the phone the text arrived on; we work on computers, networks, printers and email rather than handsets. The work on our side of this is the part that outlives the text message: the accounts, the saved cards, the email security, and the machine you did your banking on.

How to report it so the report actually counts

Reporting these feels pointless and is not — the FTC’s own ranking above exists because people filed, and the carrier blocking that stops the next wave is driven by forwarded messages. There are three routes and they do different jobs.

Forwarding to 7726 is the one that affects your own phone traffic: in the FTC’s words, "Forward messages to 7726 (SPAM). This helps your wireless provider spot and block similar messages." That goes to your carrier, not to a government agency. We have a separate guide on the blocking and reporting mechanics on iPhone and Android, including the in-app report buttons, so we will not repeat the steps here.

The USPS-specific route is an email, and it has requirements most people miss, which is presumably why so many reports are useless. USPIS asks you to send it to spam@uspis.gov, and then: copy the body of the message without clicking the link, "Provide your name in the email, and also attach a screenshot of the text message showing the phone number of the sender and the date sent," and "Include any relevant details in your email, for example: if you clicked the link, if you lost money, if you provided any personal information, or if you experienced any impacts to your credit or person." The screenshot requirement is the one to note before you delete the text — it has to show the sender’s number and the date, so capture it first and tidy up afterwards.

And the general fraud report goes to the FTC at reportfraud.ftc.gov. If money actually moved, the FBI takes those at ic3.gov as well. None of these will get your $2 back and that is not what they are for.

The costume rotates; the con does not

The delivery story is currently the most reported, but it is one outfit on a con that changes clothes constantly — which is the real reason to learn the shape rather than the script. The same playbook arrives as an unpaid toll, a parking notice, a utility shut-off, a bank fraud alert, a Social Security or Medicare problem, a job offer, a QR code stuck over a real one, or a support number sitting at the top of your own search results. We have written most of those up individually, and the links below go to them.

Underneath all of them sits one rule that needs no expertise and no judgement call: a message that arrives unasked and wants you to act inside it is the thing to distrust, regardless of how well made it is. Go to the organisation yourself, by a route you chose — an app you already have, a number on a card in your wallet, a domain you typed. Nothing legitimate is ever lost by doing that, which is what makes it a free test. And in the weeks when you really are expecting four parcels, which is exactly when these land, that habit is the only one that still works when the message is good enough to fool you.