Fake package delivery text: how to spot it and what to do

You get a text: “Your package could not be delivered. Confirm your address within 24 hours to avoid return.” There is a link. If you were not expecting a package, this is almost certainly smishing, which is phishing by SMS.

Why it works

Most of us order things online, so a delivery message feels normal. Scammers send these in bulk and only need a small number of people to click.

The red flags

• You were not expecting a package. Start here.
• The link is not the carrier’s real domain. Real carriers use their own well-known domains. Look-alikes such as usps-redelivery.top are fake.
• A deadline. “Within 24 hours” is pressure, designed to stop you thinking.
• A request for a small fee or card details. A real redelivery rarely needs your card on a random page.
• An unknown number or an email address as the sender.

What to do instead

1. Do not tap the link.
2. Open the carrier’s official app or type their website into your browser yourself, then enter your tracking number.
3. Check your order confirmation emails for a real tracking number.
4. Report the text. In the US you can forward spam texts to 7726 (SPAM).
5. Delete it.

If you already tapped

• Do not enter anything further. Close the page.
• If you entered a password, change it on the real site and anywhere you reuse it.
• If you entered card details, call your bank and ask to block and replace the card.

Check the link without opening it

If you want to see where a link really goes, paste it into LinkGuard. It follows the redirects and checks the destination against threat databases, so you get a verdict without visiting the page.