Shipping tracking phishing scam

A text message or email impersonates USPS, UPS, FedEx, DHL, or a national post. The notice says a package is delayed because the address is incomplete, customs requires a small fee, or redelivery needs to be scheduled. Clicking the link leads to a phishing page that captures address details and credit card information for "the small fee."

The card is then used for fraud charges, and the personal info feeds future scams. The "package" never existed — most victims weren't even expecting a delivery.

This is the highest-volume SMS phishing category in the US, sometimes called "smishing."

"USPS: Your package #US9514961251 is on hold due to incomplete address. Please update your information within 24 hours to avoid return-to-sender: usps-redelivery.co/track"

"FedEx: A 0.99 customs fee is required to release your shipment. Pay now: fedex-track-delivery.net/pay"

• You're not expecting a package.
• The link is not the carrier's real domain (usps.com, ups.com, fedex.com).
• The tracking number format doesn't match the carrier.
• The "fee" is implausibly small (under $5) — designed to feel safe.
• The text has urgency ("within 24 hours" or "before return-to-sender").
• The shortened URL hides the real destination.
• The page asks for full credit card details for "customs" or "redelivery."

1. Carriers never ask for fees by text or email link. Real customs and redelivery fees are paid at the post office or through the carrier's official site.
2. If you have a real shipment, track it directly on the carrier's site by entering the tracking number yourself.
3. Long-press the link on mobile to preview the URL. Anything that isn't the carrier's exact domain is suspect.
4. Forward suspicious USPS texts to 7726 (SPAM) to report them to your carrier.
5. Block the sender after reporting.

• Don't enter any information. Closing the tab before entering data limits the damage.
• If you entered card details, call your bank, cancel the card, and dispute any charges that appear.
• Change passwords on any account where you reuse the credentials you entered.
• Run a malware scan if the page tried to install anything.
• Report to the FTC and the relevant carrier (USPS Postal Inspection Service has an online form).
• Watch for follow-up scams — your number is now on a list.

• Do not pay any "customs fee" or "redelivery fee" by clicking an SMS link.
• Do not enter card or address details on pages reached from texts.
• Do not reply to the text, even to say "stop." Replies confirm the number is active.
• Do not trust the carrier logo. Logos are trivial to copy.

• FTC: reportfraud.ftc.gov — the broadest US fraud intake; reports flow to thousands of law-enforcement agencies.
• FBI IC3: ic3.gov — the right destination when the scam is internet-enabled (phishing, BEC, romance, crypto).
• CFPB: consumerfinance.gov/complaint — for complaints about banks, money transmitters, payment apps, credit cards, debt collection.
• IdentityTheft.gov — if any identity information (SSN, driver's license, account credentials) was shared.
• Your bank or payment platform. Call the number on the back of your card or use the app's in-product help. Time matters — wires can sometimes be recalled within hours; ACH and Zelle are harder but worth trying.