Friday, November 13, 2026 Official warnings, in plain English

Cyber Safety Today

Is this real? · Texts and calls

Is that text about a package real?

The short answer

Do not tap the link. USPS says its tracking texts never contain one. If you are expecting a package, track it on the carrier’s or the store’s own website.

Published November 13, 2026Checked against sources November 13, 2026Written by software from the sources listed

A text says the Postal Service, FedEx or DHL has a package for you, and there is a problem. It tells you to tap a link to learn more or fix it. The Federal Trade Commission (FTC) says there is a good chance a text like this is really from a scammer.2

The link takes you to a copy of a real website, where you are told to type in personal or financial information. If you pay, the money and everything you entered go straight to the scammer.2 The Postal Service does not text or email customers unless they first asked for tracking with a tracking number, and its messages do not contain a link.1

The messageAn example of the pattern, not a real message

USPS: We could not deliver your package because of unpaid postage. Tap here to fix the problem: [link]

How to tell

  • You did not ask for it. To get USPS tracking texts, you have to register online or start the text yourself, and give a tracking number.1
  • It has a link. A real USPS tracking message will not contain one.1
  • It names a problem. Scam texts may confirm an order, say a package is out for delivery, or claim unpaid postage, a missed delivery, or a need to update your shipping preferences.2
  • It asks for money. USPS does not charge for its tracking tools.1
  • It asks for personal or account details. Legitimate companies will not ask for information about your account by text.3
  • Check the sender. USPS uses 5-digit short codes to send and receive texts.1

What to do

  1. Do not tap the link, and do not reply.1
  2. If you are expecting a package, look it up yourself. Go to the store website or account where you placed the order and check the shipping and tracking there.2 For a Postal Service package, go to USPS.com for tracking.1
  3. Report the text. The places are listed at the end of this page.
  4. Delete the text.1
  5. See what options your phone has to filter and block texts from unknown senders.2

If you already clicked or paid

  1. If you opened the link, tell your bank or card company, even if you did not press “submit”.1
  2. If you paid with a credit card, report it to the card issuer right away and ask for a refund. If you paid with a debit card, report it to your bank or credit union and ask for a refund. Use the number on the back of the card, or log in to your account online or in the app.4
  3. If you typed in a username and password and can still log in, create a new, strong password for that account. If you use the same password on another account, change it there too. Then turn on two-factor authentication.4
  4. If you gave your Social Security number and it was used, go to IdentityTheft.gov to report it and get a recovery plan. If it was not used or you are not sure, go to IdentityTheft.gov/databreach and follow the steps there.4
  5. When you report the text, say what happened: that you clicked, lost money or gave personal information.1

Where to report it

  • US Postal Inspection Service. For texts that claim to be from USPS, send an email to [email protected]. Without tapping the link, copy the body of the text and paste it into a new email. Add your name and attach a screenshot that shows the sender’s phone number and the date. The Postal Inspection Service will contact you if it needs more.1
  • 7726. Copy the message and forward it to 7726 (SPAM). This helps your wireless provider spot and block similar messages.3
  • Your messaging app. Look for the option to report junk or spam.3
  • The FTC. Report it at ReportFraud.ftc.gov.2
  • The FBI. Texts that do not involve USPS can also be reported to the FBI’s Internet Crime Complaint Center at ic3.gov.1