USPS or FedEx text says your package is held up and needs $2.99 to release
A text impersonating USPS, FedEx, UPS, or DHL claims your package cannot be delivered without an updated address or a small fee. The link leads to a fake site that steals your address, phone, card number, and sometimes plants a phishing app.
Also known as: USPS smishing, FedEx delivery text scam, missed package text
What to do right now
- 1 Do not click. Delete the text
- 2 If you are expecting a package, go to the carrier's real app or type the official URL into your browser to check its status
- 3 If you already clicked and entered card information, call your bank to dispute charges and replace the card
- 4 Forward the text to 7726 (SPAM) to report to your carrier
- 5 Report to the FTC at https://reportfraud.ftc.gov and the FBI's IC3 at https://www.ic3.gov.
Red flags
- ⚠ USPS does not send unsolicited texts asking for money to release a package
- ⚠ The link uses unofficial domains like 'usps-pkg.com', 'fedex-update.net', or random-looking shortlinks
- ⚠ Tiny fee amounts ($1.99 to $5) designed to seem too small to bother questioning
- ⚠ Pressure to act within hours or your package 'will be returned to sender'
Delivery smishing is one of the most common scam texts in the US, partly because almost everyone has a real package in transit at any given time. The scammers do not need to know what you ordered — they just need a small fraction of recipients to click.
If you receive several of these texts in a row, that is not coincidence. Scammers send these to millions of numbers at once.
If you entered payment info on a fake delivery site: contact your card issuer immediately to dispute and replace your card. Change passwords on any other account you used the same card for.