You’re probably expecting a package. Maybe it’s that sweater for your aunt or a last-minute gadget for yourself. Then, your phone buzzes. It’s a text message that looks official. "USPS: Your package is on hold due to an incomplete address. Please click here to update your info."
Stop right there.
Honestly, it feels so real because we’re all in "delivery mode" this time of year. But the United States Postal Service (USPS) and the U.S. Postal Inspection Service (USPIS) are sounding the alarm. They’ve launched a massive "Cut Out Crime" campaign for the 2025-2026 holiday season because these "smishing" (SMS phishing) attacks are hitting record levels.
USPS Warns of Smishing Scams During the Holidays: The Anatomy of the Trap
Cybercriminals aren’t just sending random texts anymore; they’re getting sophisticated. They know you’re distracted. They know your porch is probably full of boxes. A smishing scam is basically a digital mugging that starts with a simple SMS.
The goal? They want your Personally Identifiable Information (PII). We’re talking credit card numbers, Social Security digits, and even your login credentials.
💡 You might also like: Wisconsin Judicial Elections 2025: Why This Race Broke Every Record
What a "Real" Scam Text Looks Like
You might see messages like these hitting your inbox right now:
- "Dear Team Member, your account has been compromised. Click this link to verify your credentials. — USPS Leadership." (This one actually targets employees, too!)
- "Your USPS package has arrived at our warehouse but cannot be delivered. Confirm your details here: [shady link]"
- "A $1.99 redelivery fee is required. Pay now to avoid the package being returned to sender."
Here is the kicker: USPS does not send unsolicited text messages. If you didn’t sign up for a specific tracking alert on their website, any text you get is a lie. Period.
Why This Holiday Season is Different
The 2024 holiday season was bad, but 2025 has seen these scammers evolve. They aren't just using weird email addresses anymore. They are using Amazon’s bulk SMS services and other legitimate-looking platforms to bypass your phone’s spam filters.
According to the FBI’s Internet Crime Complaint Center (IC3), non-delivery and non-payment scams cost people over $785 million in a single year recently. During the holidays, that number spikes because our guard is down. We're rushing. We're stressed. We just want the package to arrive.
📖 Related: Casey Ramirez: The Small Town Benefactor Who Smuggled 400 Pounds of Cocaine
The "Redelivery Fee" Myth
One of the most successful lies is the "small fee" trick. Scammers ask for $1.99 or $2.50 to "fix" a delivery issue. It sounds so small that most people don't think twice. But the moment you enter your card info, they don’t just take the two bucks. They sell your card details on the dark web or drain your account within minutes.
USPS will never ask for a redelivery fee via text. If a package truly can't be delivered, they leave a physical PS Form 3849 (that we've all seen, the peach-colored slip) on your door.
Beyond Smishing: The Rise of "Quishing" and Brushing
It’s not just texts. The USPS is also warning about quishing—which is phishing via QR codes.
Imagine you get a package you didn't order. This is called a "brushing" scam. Inside, there’s a cheap item and a QR code that says, "Scan to see who sent this gift!" If you scan it, you’re directed to a fake site that steals your data. It’s a clever, physical-to-digital trap that’s catching a lot of people off guard this year.
👉 See also: Lake Nyos Cameroon 1986: What Really Happened During the Silent Killer’s Release
How to Tell if a USPS Text is Legitimate
There are a few "telltale" signs that the message you just got is a total fake.
- The Missing Tracking Number: A real USPS alert will always have the tracking number in the text.
- The Link: This is the big one. Legitimate USPS tracking texts do not contain links. If there is a clickable URL, it is a scam.
- Grammar Disasters: Look for weird commas, lowercase "usps," or phrases like "dear customer." Professional organizations have editors. Scammers usually don't.
- Urgency: If the text says you only have "4 hours" or "24 hours" before your package is destroyed, it’s fake. They want you to panic so you don't think.
What to Do if You Already Clicked
It happens. Don't beat yourself up, but you've got to move fast.
First, if you entered any credit card info, call your bank immediately. Don't wait for a suspicious charge to show up. Freeze the card. Second, if you entered a password, change it on every site where you use that same password.
You should also report it. The Postal Inspection Service actually investigates these. You can forward the scam text to 7726 (which spells "SPAM"). This helps carriers block the number. Then, take a screenshot and email it to spam@uspis.gov.
Actionable Steps to Protect Your Holidays
- Use the Informed Delivery App: This is the official USPS app. It shows you photos of the mail coming to your house and tracks packages without you needing to click on sketchy links.
- Manual Tracking Only: If you get a text that makes you worried, don't click the link. Instead, copy the tracking number (if there is one), go to USPS.com yourself, and paste it into the search bar.
- Filter Unknown Senders: Most iPhones and Androids have a setting to "Filter Unknown Senders." It shoves these texts into a separate folder so you don't even see the notification.
- Never Pay via Text: USPS doesn't do business that way. Any request for money via SMS is a 100% guarantee of fraud.
The holidays are busy enough without having to deal with identity theft. Stay skeptical, keep your info to yourself, and remember: if the Post Office really needs you, they’ll probably just leave a note on your door.
Next Steps for Your Security
To stay ahead of the latest threats, you should register for USPS Informed Delivery directly on the official .gov website. This gives you a secure dashboard to monitor your mail and packages, effectively making those scam texts irrelevant since you'll already know exactly what is (and isn't) arriving.