You’re sitting on your couch, scrolling through your phone, when a buzz interrupts your rhythm. It’s a text. The sender looks official, or maybe it’s just a random string of numbers that doesn't immediately set off alarm bells. The message says there's a problem with your package. Maybe the address is "incomplete" or a "delivery fee" is pending. It sounds plausible because, honestly, who isn't waiting on a package these days?
Stop. Don't click.
That text message from USPS you just got is almost certainly a "smishing" attempt. Smishing is just a nerdy way of saying SMS phishing. It’s a massive problem that has exploded in the last few years, and the United States Postal Service is one of the most impersonated brands on the planet. The scammers aren't just looking for a couple of bucks for a "redelivery fee." They want your full name, your home address, and most importantly, your credit card details.
The Anatomy of a USPS Text Scam
The United States Postal Inspection Service (USPIS) has been shouting from the rooftops about this for a long time. They’ve seen every variation under the sun. Usually, the text follows a very specific psychological script. It creates urgency. It tells you that your package is sitting in a warehouse somewhere, gathering dust, and it’ll be returned to the sender if you don't act right now.
The link usually looks a little "off." It might be something like usps-delivery-update.com or redelivery-usps.help. It’s close enough to the real thing that your brain, in its hurried state, fills in the gaps.
🔗 Read more: Why Your Mean Median Mode and Range Calculator Might Be Lying to You
Here’s the thing: USPS does not send you these texts out of the blue.
If you didn’t specifically sign up for tracking updates on a specific tracking number on the official USPS.com website, they aren't going to message you. Period. They don't have your phone number unless you gave it to them for a specific shipment. They certainly don't go hunting for your mobile digits because they found a box with a smudged label.
Why the "Incomplete Address" Trick Works
It's clever. We’ve all lived in apartments with weird numbering or moved to a new build where Google Maps gets confused. When a text message from USPS claims your address is "missing a house number," it feels like a realistic administrative error.
You click the link. You’re taken to a website that looks identical to the real USPS homepage. The colors are right. The logo is there. It asks you to "verify" your address. Then, the trap snaps shut: it asks for a $0.30 or $1.25 "re-processing fee."
📖 Related: Factory reset on MacBook: What most people get wrong about wiping their Mac
It’s a tiny amount. Most people think, whatever, it's just a dollar. But the dollar isn't the point. Once you enter those digits, the scammers have your card number, your CVV, and your expiration date. They’ll sell that data on the dark web or go on a shopping spree before you’ve even finished your morning coffee.
How USPS Actually Communicates
Real communication from the Postal Service is predictable and boring. That’s how you want it.
If you actually requested a text alert, it’s going to come from a five-digit short code. Specifically, 28777. If the text message from USPS is coming from a standard 10-digit phone number or a weird email-looking address, it’s fake. Real alerts also won't contain links that ask for money. They usually just contain the status of the package and a link back to the official tools.usps.com domain.
Check your mail.
If a package truly can't be delivered, the carrier leaves a physical piece of paper. The PS Form 3849. It’s that peach-colored slip that we all hate seeing on our front doors. That is the gold standard for USPS communication. They leave physical trails because they are a physical service.
The Technology Behind the Scam
Scammers are getting sophisticated. They use "SMS gateways" to send out thousands of these messages at once for almost zero cost. It’s a numbers game. If they send 100,000 texts and only 0.1% of people click and enter their card info, that’s still 100 sets of credit card data.
✨ Don't miss: Stop the Spam: How to Block a Number Verizon Users Actually Need to Know
In many cases, the links use "URL shorteners" or redirects to hide the final destination. You might see a bit.ly link or something similar. USPS will never use a third-party shortening service to communicate with you about your mail.
What to Do If You Clicked
First, don't panic. If you just clicked the link but didn't enter any information, you’re likely okay, though your phone might now be flagged as an "active" number, meaning you'll probably get more spam in the future.
If you entered your credit card information, you need to move fast.
- Call your bank. Tell them you were a victim of a phishing scam. They need to cancel that card immediately and issue a new one.
- Report it to the USPIS. Send an email to
spam@uspis.gov. - Copy the message. Don't just delete it. Copy the text and the sender's info.
- Forward to 7726. This is the universal "SPAM" reporting number for most major cell carriers in the US.
Protecting Yourself for the Long Haul
The best defense is a healthy dose of skepticism. If you are actually expecting a package and you get a suspicious text message from USPS, go directly to the official website. Manually type usps.com into your browser. Paste your tracking number there. If there’s a real problem, the official tracking page will tell you.
Also, consider using the USPS Informed Delivery service. It’s a free tool that sends you a daily email with grayscale images of the mail arriving in your box that day and tracking info for incoming packages. It lives inside a secure dashboard. If a package is stuck, you'll see it there first, no sketchy text messages required.
Identifying Red Flags
- The sender's number: It's a full phone number, often from a different country or an area code that doesn't make sense.
- The greeting: It’s generic. "Dear Customer" or "Valued Citizen."
- The URL: It has hyphens, weird extensions (.top, .info, .help), or misspellings of "USPS."
- The "Fee": USPS will never ask for a redelivery fee via text.
Final Steps for Security
To truly insulate yourself from these attacks, go into your phone settings. Both iOS and Android have features to "Filter Unknown Senders." This will tuck these messages away into a separate folder so they don't pop up on your lock screen and catch you off guard.
Stay vigilant. The Post Office is a government agency, and government agencies move slowly and formally. They don't text you like a frantic friend who lost their keys. If the message feels like it's trying to scare you into clicking, it's a lie.
- Delete the message after reporting it to
spam@uspis.gov. - Block the sender on your device immediately.
- Update your phone’s OS to ensure you have the latest security patches for your browser.
- Enable Two-Factor Authentication (2FA) on your postal accounts and banking apps.
The scam works because it preys on our desire for convenience. We want our stuff. We want the problem fixed. But taking thirty seconds to verify the source can save you months of headache dealing with identity theft.