December fills phones with automated notices, and scammers know it. A text saying your package is stuck and needs a new address or a small fee lands easily when three boxes are already on the way. The Postal Inspection Service calls this smishing, which is phishing by text message. A few plain questions can sort most of these messages quickly.

Four checks before you tap anything

  1. Did you ask for it? USPS says it sends tracking texts or emails only after a customer requests them using a tracking number. If you never signed up for updates on that parcel, treat the message as unsolicited.
  2. Where did it come from? USPS says it uses 5-digit short codes to send and receive texts. That detail is useful context, but the sender's number alone does not settle the question, so do not rely on it by itself.
A phone lying face-down beside a printed checklist and a pen on a sunlit kitchen counter, with a shipping box out of focus behind.
A phone set face-down next to a printed checklist, with a shipping box behind it on the kitchen counter.
  1. Is there a link? According to USPS, its tracking texts do not contain a link. The agency's page describes an unsolicited text with an unfamiliar link about a delivery that needs a response as likely smishing. That guidance covers USPS messages. The sources reviewed do not say how other carriers format theirs.
  2. What does it want from you? Passwords, a Social Security number, a date of birth, card numbers and PINs are all things scammers go after, USPS says. A delivery notice has no reason to ask for any of them.

None of these checks takes long. The first one does most of the work. If you cannot remember asking for the alert, stop there and move on to verifying the package yourself.

Why these texts work in the holiday rush

The pretext is believable. Many households have several orders in motion at once, so a message about a delayed box does not feel strange. Scammers also borrow authority. USPS says they often pose as a government agency, a bank or another company so the claim seems legitimate. A familiar logo or company name in a message proves nothing, since anyone can type a name.

The payoff for the scammer is information. USPS says the data collected, from usernames and passwords to card numbers, is used for other crimes such as financial fraud. One form filled out in a hurry can cause trouble well after the packages arrive. AARP has also published an article about scam delivery texts that imitate USPS, UPS and FedEx. That headline suggests the problem is not limited to one carrier, though the article's details were not available for this piece.

If you are expecting a package

The awkward case is the text that arrives while you really are waiting on something. USPS advice is direct. Do not click any links. Report the message, then check the status by going to USPS.com on your phone or computer. If you have a tracking number from the retailer, type it in yourself.

USPS also says its package-tracking tools are free and it does not charge for them. So a text demanding payment to release a package through the USPS tracking system should raise an alarm. For other carriers, check the fee claim on the carrier's own website or app instead of through the message. Open your order confirmation email, find the carrier name and tracking number, and look it up there. That route takes about a minute and does not depend on the text at all.

A practical habit helps here. Keep order confirmations in one folder during the season. When a questionable alert arrives, you can compare it against what you actually bought and from whom.

If you already tapped or typed something in

The sources reviewed for this article do not cover what to do after clicking a link or sharing information. What follows is general, commonly given advice, not drawn from the USPS page, so confirm details with the agencies named.

  • If you entered card or bank details, call your card issuer or bank using the number printed on the card, not a number from the text.
  • If you gave a password, change it on the real site, and change it anywhere else you reused it.
  • If you shared a Social Security number, look at the FTC's identity theft guidance and ask about a fraud alert or credit freeze.
  • Report the message. USPS asks for reports of suspect texts, and the FTC takes scam reports as well.

Acting quickly matters more than feeling embarrassed. Scam operators count on people staying quiet.

Travel alerts deserve the same pause

The FTC has published advice titled "Avoid Scams When You Travel," and its holiday alerts cover fake shipping notices by email and text. The page text for those was not available here, so this article does not describe specific travel scams such as hotel, airline or rental car schemes. The basic habit still carries over. If a message about a flight change or booking problem arrives unprompted, skip its link. Open the airline, hotel or booking site yourself, or call the number on your confirmation, and see whether the problem exists there.

Please seek a professional. This article is general information, not financial, tax or insurance advice. Please seek a licensed financial, tax or insurance professional about your own situation.