You are waiting for a package when a text arrives saying the address needs attention. The timing feels right. The message asks you to open a link, correct a detail or pay a small amount before delivery can continue. This scenario is often associated with fake delivery texts.

That sense of familiarity is exactly why it is worth pausing. A message can describe a real part of your life without coming from the company handling your order.

The U.S. Postal Inspection Service warns about package-tracking text scams, often called smishing. The term means phishing through text messages. The goal is to lure someone into giving up personal or financial information, visiting a fake website or taking another harmful step.

Use one rule before studying the message

If an unexpected delivery text asks for information or payment through a link, do not use that link to decide whether it is genuine. Open the retailer’s or carrier’s app yourself, or visit a website you already know is real.

Being aware of fake delivery texts can help you avoid scams and protect your personal information.

The Federal Trade Commission’s text-message guidance recommends contacting a company through a known phone number or website, not through the details in the message. This works even when you are genuinely expecting a delivery.

You do not need to prove a text is fake before choosing the independent route. The point is to verify the package without giving the message control over where you go next.

For a Mohawk Valley household waiting for school supplies, household goods or a gift, the useful habit is the same: check the order where you normally manage it, rather than rushing because a text claims the delivery is at risk.

What official USPS tracking guidance says

The Postal Inspection Service says USPS text tracking is requested for a specific package using a tracking number. Its scam guidance says USPS tracking texts do not contain a link and that the Postal Service does not charge for those tracking tools.

That is USPS-specific guidance. Do not turn it into a claim that every text from every private delivery company follows exactly the same format. For another carrier, check its own official resources and your order records.

If an unfamiliar message claims to be USPS and contains a link demanding action, do not click it. The Postal Inspection Service directs customers to visit USPS.com independently for tracking and information.

A sender name, logo or official-sounding phrase is not enough to settle the question. The FTC’s phishing guidance explains that scammers can imitate organizations people recognize and use websites that look legitimate.

Notice the request, not just the spelling

Look at what the text wants you to do. Is it asking for card details, an account password or sensitive personal information? Is it steering you to a new page to fix a problem you have not independently confirmed?

Bad spelling can be a warning sign, but polished wording is not proof of authenticity. A careful household process should not depend on finding a typo.

Here is a made-up scenario: a message says a parcel cannot move forward until you pay a small redelivery charge. You remember ordering something, so the request seems plausible. The next useful step is to check the actual order and carrier information, not to decide that a small payment is too minor to worry about.

The risk is not limited to the amount shown on the screen. A fake payment page may be trying to collect the details you enter. Do not test the message by supplying a card or other information just to see what happens.

Build a short package-check routine

Start with the order record in the retailer account or app you normally use. Check which carrier is listed and find the tracking number there. If you use a shipping confirmation, make sure it is the confirmation for an order you actually placed, not another unexpected message that arrived at the same time.

Then open the carrier’s official tracking service independently. Compare the status there with the problem claimed in the text. If you need help, use the contact options found through the trusted account or official site.

If another household member placed the order, ask them to check their own account. You do not need their password or payment details to pass along a warning. Keep the suspicious link out of the conversation where possible, or share a screenshot that does not expose private information.

If the official information does not match the text, stop interacting with the text and report it. If the official service shows a real delivery problem, handle it through that service’s instructions, not through the unverified message.

Do not reply just to investigate

The Postal Inspection Service advises not replying to suspicious messages or clicking their links. A reply is not a reliable way to verify a sender.

Do not call a number included in the suspicious text to ask whether it is legitimate. That keeps you inside the same unverified contact path. Find the company’s contact information independently.

If you ask a family member for help, describe what happened and what information, if any, you entered. Avoid sharing passwords or full card numbers in a household group chat. The person helping you needs the situation, not a fresh copy of every sensitive detail.

If you clicked, focus on what happened next

A click does not by itself tell you everything about the outcome. Do not assume nothing happened simply because you closed the page, and do not assume the phone is definitely infected without evidence.

The Postal Inspection Service says to notify your financial institution if you interacted with the URL in a suspicious USPS message, even if you did not press a submit button. Contact the institution using its official app or a number you already know, such as the one on your card, rather than a number from the message.

If you entered account credentials, use the real service’s account-security or recovery instructions and explain the situation to its support team if needed. Do not return to the suspicious page to “undo” the entry.

If you think personal information such as a Social Security number, bank account number or card number reached a scammer, the FTC directs people to IdentityTheft.gov’s lost-or-stolen information guidance for steps based on the information involved.

If you believe harmful software was downloaded, follow the FTC’s security guidance and the device maker’s support instructions. The FTC recommends updating security software and scanning affected computers when malicious software may have been downloaded. Avoid installing a supposed repair tool offered by the same suspicious page.

Report the message through official channels

The FTC lists three ways to report unwanted texts: forward the message to 7726, use the messaging app’s junk or spam reporting option, or report it at ReportFraud.ftc.gov.

For USPS impersonation, the Postal Inspection Service also gives reporting instructions for spam@uspis.gov. Its guidance asks for the message body, a screenshot showing the sender and date, and relevant details such as whether you clicked or shared information. Copy or preserve the message without opening its link.

Use the reporting page’s instructions and then delete or block the suspicious message as appropriate. Reporting is useful, but it does not replace contacting a financial institution or securing an affected account.

Make the pause a household habit

Agree on a simple phrase: check the package outside the text. Keep official retailer and carrier apps or bookmarks available, and follow the FTC’s advice to keep devices updated and use multifactor authentication where offered.

If someone in the household clicks, focus on helping them respond. A calm explanation makes it easier to identify what information was shared and reach the right official support.

You do not have to become an expert in every scam. A repeatable route is enough: pause, verify independently, protect any affected accounts and report the message.

Official Postal Inspection Service and FTC guidance reviewed October 20, 2026. Reporting and device-menu options can change. Use the current instructions from the relevant agency, carrier and device maker.