What Is the Fake USPS Text Redelivery Scam?
The fake USPS text redelivery scam is a large-scale smishing (SMS phishing) operation in which criminals send text messages impersonating the United States Postal Service, claiming that a package is being held and requires a small fee or address confirmation for redelivery. The texts contain a link to a fake USPS website that harvests victims' personal information, payment card details, and sometimes installs malware.
This scam is not new, but it has reached unprecedented scale in 2025–2026. The USPS itself issued multiple public warnings about the surge in fake text messages, and the Federal Communications Commission (FCC) has flagged postal service smishing as one of the fastest-growing text-based fraud categories. The scammers operate from outside the US and use spoofed phone numbers, rotating domains, and automated mass-texting infrastructure to reach millions of phones.
The scam is effective because almost everyone has a package in transit at any given time — from Amazon, Temu, Shein, or any other online retailer. When a text arrives saying "USPS: Your package is on hold," a significant percentage of recipients assume it's about a real order and click through without verifying.
How the Scam Works, Step by Step
The fake USPS text scam follows a precise, automated pipeline that security researchers have mapped across thousands of domains and millions of text messages:
Step 1 — The text message. You receive a text that appears to be from USPS. It typically says something like: "USPS: Your package with tracking number [random number] is on hold due to an incomplete address. Please confirm your address and pay a $0.03 redelivery fee at [link] to avoid return to sender." The message creates urgency and includes a link that often looks like a shortened URL or a domain designed to resemble USPS (e.g., usps-redelivery.com, usps-package-hold.com).
Step 2 — The fake website. Clicking the link takes you to a website that closely mimics the real USPS.com design — the same blue and gray color scheme, the USPS eagle logo, and the same layout. The page asks you to enter your address to "confirm" the redelivery. Some versions ask for your name and phone number first, building a profile of personal data.
Step 3 — The payment capture. After entering your address, the site asks for a small "redelivery fee" — typically between $0.03 and $1.99 — and requests your credit or debit card details. The tiny amount is deliberate: it seems too small to be a scam, and victims are more likely to enter their card information for a nominal fee than for a large one.
Step 4 — The data theft. Once you enter your card details, the scammers have everything they need. The card number, expiration date, CVV, and billing address are captured and sold on the dark web or used directly for fraudulent purchases. The "redelivery fee" may or may not be charged — the real value is the card data, which can be used for far larger purchases.
Step 5 — The escalation (optional). Some versions of the scam go further, asking for your Social Security number for "identity verification" or prompting you to download a "USPS app" or "tracking update" that is actually malware. These variants aim for full identity theft or device compromise, not just card fraud.
Why This Scam Is So Effective
The fake USPS text scam works because it exploits three powerful psychological factors simultaneously:
Expectation. Most people shop online regularly and have at least one package in transit at any time. A text about a package problem feels relevant and timely, not suspicious. The scammer doesn't need to know what you ordered — they just need you to assume the text is about a real order.
Authority. The USPS is a trusted government institution. Texts and websites that mimic its branding borrow that trust. The USPS eagle logo, the official-sounding language, and the .com-style domain all signal legitimacy to a recipient who isn't checking closely.
Urgency. The text creates a deadline: confirm your address or the package will be "returned to sender." This manufactured urgency pushes victims to act quickly without pausing to verify — and the small redelivery fee makes the action feel low-stakes, even inconsequential.
The combination is devastatingly effective. According to the FCC, smishing complaints surged by over 500% between 2022 and 2025, with postal service impersonation being one of the top categories. The scammers send millions of texts knowing that even a 1% click-through rate yields thousands of victims.
Red Flags: How to Spot a Fake USPS Text
The warning signs are consistent across all variants of this scam. Learn these red flags and you'll recognize the entire family of postal smishing attacks:
1. USPS does not text you about package problems unsolicited. The real USPS sends delivery updates through its official tracking system, which you opt into by entering your tracking number on USPS.com or through the Informed Delivery service. If you didn't sign up for text notifications, USPS did not text you.
2. The tracking number doesn't match. Real USPS tracking numbers follow a specific format: they start with certain prefixes (e.g., 9400, 9205, 9370) and are 22 digits long. The tracking number in the scam text is often a random string of numbers that doesn't follow USPS formatting. You can verify any tracking number directly at USPS.com.
3. The link domain is not USPS.com. Real USPS links always go to usps.com — nothing else. If the link goes to usps-redelivery.com, usps-package-hold.net, or any other domain that includes "usps" but isn't exactly usps.com, it is a scam. Scammers register lookalike domains to fool quick glances.
4. A fee is required for redelivery. USPS does not charge redelivery fees via text message. The real USPS redelivery service is free and is arranged through your account on USPS.com or by visiting your local post office. Any text asking for payment is a scam.
5. The text comes from an unfamiliar number. USPS sends official notifications from short codes (like 28777) that you can verify on USPS.com. A text from a random 10-digit phone number claiming to be USPS is almost certainly a scam.
6. Requests for sensitive information. USPS never asks for your Social Security number, full credit card details, or account passwords through a text message link. Any site reached through a text that asks for this information is a phishing page.
What to Do If You Clicked the Link or Entered Information
If you clicked a fake USPS text link or entered information on the fake website, take these steps immediately:
1. If you only clicked the link but entered nothing: You're likely fine. Simply close the page and delete the text. Do not enter any information. Run a malware scan on your device if the page prompted a download.
2. If you entered your credit or debit card details: Contact your card issuer immediately and report the card as compromised. Request a new card. Monitor your statements for unauthorized charges. Your card issuer can reverse fraudulent transactions if reported promptly.
3. If you entered your Social Security number: This is more serious. Place a fraud alert or credit freeze with all three major credit bureaus (Equifax, Experian, TransUnion). File a report with the FTC at IdentityTheft.gov, which will create a personalized recovery plan.
4. Report the scam. Forward the suspicious text to 7726 (SPAM) — your carrier's spam reporting service. Report the phishing attempt to the USPS at [email protected] (the US Postal Inspection Service). File a complaint with the FTC at reportfraud.ftc.gov.
5. Verify the URL with Scam Detective. If you're unsure whether a link is legitimate, don't click it — copy the URL and paste it into Scam Detective for an instant risk assessment. For more on package delivery scams, read our guide on fake package delivery scams.
How to Protect Yourself from Smishing Scams
The fake USPS text scam is part of a broader wave of smishing attacks that also impersonate FedEx, UPS, Amazon, and other delivery services. Here's how to protect yourself across all variants:
1. Never click links in unsolicited text messages about packages. If you think a delivery might actually be held, go directly to the carrier's official website (USPS.com, FedEx.com, UPS.com) and enter your tracking number there.
2. Be skeptical of any text about a package you weren't already expecting. If you didn't order anything recently, the text is a scam. If you did order something, check the tracking information in your original order confirmation or the retailer's app — not the text link.
3. Never enter payment information on a website you reached through a text message link. Go to the official website directly by typing the URL into your browser.
4. Enable spam filtering on your phone. Both iOS and Android have built-in spam text filtering that can catch many smishing attempts. Your carrier may also offer spam protection.
5. When in doubt, verify the URL before you click. Paste it into Scam Detective and get an instant 0–100 risk score, a plain-English verdict, and the top red flags — including domain age, phishing markers, and impersonation signals. For more on delivery-related fraud, read our guide on fake package delivery scams.