How to Spot a Fake Package Delivery Text Scam

If you've gotten a text lately saying a package couldn't be delivered, you're not alone. These messages show up around the holidays especially, when more of us are expecting boxes on the porch. Most of them aren't from UPS, FedEx, or the Postal Service at all — they're a package delivery text scam designed to get you to tap a link.

The good news is that once you know what to look for, these texts get easy to spot. This article walks through what the scam looks like, why it works, and what to do if you've already tapped the link.

What the scam looks like

A typical message says something like "Your package could not be delivered. Please confirm your address" or "USPS: Your parcel is on hold. Update your info here," followed by a link. It often arrives even if you aren't expecting a delivery, because the scammers send it to thousands of phone numbers at once and simply hope you're waiting on something.

The link usually goes to a website made to look like a real delivery company's site. It will ask you to "confirm" your address, pay a small redelivery fee, or log in with an account. Behind the scenes, it's collecting your name, address, and credit card number — or trying to install harmful software called malware, which just means software designed to cause harm or steal information, onto your phone or computer.

Some versions arrive by email instead of text, and a newer version uses a QR code — a small black-and-white square you scan with a camera — printed on a fake "delivery notice" slip left at your door. Scanning it takes you to the same kind of fake website.

Why these texts are convincing

Real delivery companies do sometimes text you, which is exactly what makes this scam work. The message copies real logos, real-sounding tracking numbers, and the same kind of wording a real carrier uses. It also creates a small sense of urgency — a package stuck "on hold" feels like something you should deal with right away, so you tap before thinking it through.

Scammers also know that most households get real deliveries constantly, so a vague message about "your package" has a good chance of landing on someone who actually is expecting something.

Signs of a package delivery text scam

A few details give it away almost every time:

It asks you to pay a fee to receive your package. Real carriers don't charge a surprise fee by text to release a package that's already on its way to you.
The link doesn't match the company. Real UPS, FedEx, and USPS links use their actual website addresses. A scam link often uses a long, odd string of letters and numbers, or a web address that's almost — but not quite — the real one.
You weren't expecting anything, or the tracking number means nothing to you. If you can't match the message to an order you actually placed, treat it as suspicious.
It asks for personal or payment information. Real tracking pages don't need your credit card number or a login just to tell you where a package is.
The message has slightly off wording or formatting, like unusual capitalization or a greeting that doesn't use your name.

What to do when one arrives

Here's how to handle it safely:

Don't tap the link. Just leave the text alone, the same way you'd ignore a stranger knocking with an odd story.
Check tracking directly instead. If you're genuinely expecting a package, go to the carrier's real website yourself — by typing the address you already know, not by tapping anything in the text — or use the tracking number from your actual order confirmation email.
Delete the text. You don't need to reply, even to say "stop." Replying just confirms a real person reads that number.
Report it, if you want to. On an iPhone, you can report junk text messages right from the Messages app. Forwarding spam texts to 7726 (which spells "SPAM") also reports them to your phone carrier.

What to do if you already tapped the link

If you tapped a link like this and it asked for a password, card number, or other personal details, don't panic, but do act soon:

If you entered a password anywhere, change that password right away, and change it anywhere else you used the same one.
If you entered a credit card number, call your card company and tell them what happened. They can watch for or block fraudulent charges.
If you're not sure whether anything was installed on your device, that's a good moment to get a second set of eyes on it rather than guessing.

What to do if you're stuck

If you're not sure whether a text is real, or you've already clicked something and want help sorting it out, you don't have to handle it alone. We can help in your home or remotely — call (916) 521-0065 and we'll walk through it with you calmly.

A quieter way to stay ahead of these

Package scams are just one kind of scam link, and new ones show up constantly. PorchswingProtect is made for seniors, works quietly in the background on Windows and Mac, and blocks scam, lookalike, and dangerous websites before they can do any harm — including the fake tracking pages these texts link to. It comes with a real US-based Porchswing person to call if something still feels wrong, and a 30-day money-back guarantee. It pairs with, and doesn't replace, our hack and scam cleanup service for computers that already need help.

If you want quiet protection on your Windows or Mac computer — with a real Porchswing person to call — learn about PorchswingProtect. Or call us at (916) 521-0065 and we'll help you set it up.

Common questions

Can a text message actually install something on my phone just by me opening it?

Simply opening or reading a text is very low risk. The danger comes from tapping a link inside it or downloading something the link offers, so the safest habit is to never tap links in unexpected delivery texts.

What if the text has my name and a tracking number that looks almost right?

Scammers can buy leaked names and phone numbers, and tracking numbers can be guessed or copied to look plausible. Having your name in the message doesn't make it real — always verify through the carrier's real site instead of the link in the text.

Is it safe to just block the number that sent it?

Yes. Blocking the number is a normal, safe step, though keep in mind scammers often send from a different number each time, so blocking one number won't stop every future attempt.