November 6, 2026
Updated: November 6, 2026
A plain-English guide to USPS smishing: how to verify a message, what to do by exposure level, and where to report it.
Mohammed Khalil
A USPS scam text is a fake message that pretends to come from the U.S. Postal Service, usually claiming a package has an address problem, a missed delivery or an unpaid fee. It is a form of smishing, or SMS phishing. USPS says it won't text you unless you requested tracking for a specific package, and that those texts won't contain a link. If you didn't ask for it, don't tap or reply. Check tracking by typing USPS.com yourself, then report the text. If you entered card details, call your card issuer now.
Already tapped the link? Skip to "What to Do If You Clicked or Entered Your Details."
DeepStrike is a cybersecurity company. We aren't affiliated with USPS or the U.S. Postal Inspection Service (USPIS), and USPS is the brand being impersonated in these scams, not the sender. The steps below come from official sources, and the place to report is the USPIS smishing page.
A USPS scam text is a smishing attack that uses the Postal Service's name to get you to open a fake website. USPIS describes smishing as a deceptive text meant to lure you into giving up personal or financial information, such as passwords, your Social Security number, your date of birth, or card numbers and PINs.
Package texts work because almost everyone is waiting on something. The FTC's data spotlight on 2024 reports, published in April 2025, ranked fake package delivery problems as the most reported text scam that year, and said these messages usually appear to come from USPS. For wider numbers, see our smishing statistics.
Here is what one can look like.
Illustrative example, written by DeepStrike. This is not a copy of a real message, and the link is removed. USPS: Your package could not be delivered because of an incomplete address. Confirm your details and pay the redelivery fee here: [link removed]. If the link does not open, reply Y and reopen this message.
Four things give it away:
Yes, but only when you ask. USPIS says USPS won't send you texts or emails unless you first requested the service with a tracking number, and that the message won't contain a link. It also says USPS doesn't charge for its tracking tools. A separate USPIS notice says USPS officials would never directly contact customers by email or text asking for payment or personal information.
A real USPS text starts with you. You either text your tracking number to 28777 (2USPS) or sign up on the USPS Tracking page. So the fastest test is one question: did you do that for this package? If not, treat the text as a scam. If you did, check the details, then confirm it yourself.
| Check | Real USPS text | USPS scam text |
|---|---|---|
| How it starts | You texted a tracking number to 28777 or signed up on USPS Tracking | It arrives out of the blue |
| Sender | The 28777 (2USPS) short code | Often an ordinary or foreign phone number, or an unfamiliar sender |
| Content | Status, tracking number, date, time and location | A vague "your package" with no number you can check |
| Link | USPIS says it will not contain one | Almost always a link to a lookalike site |
| Money | Tracking is free; standard message rates may apply | A small fee, unpaid postage or a customs charge |
| What it asks for | Nothing, beyond an optional STOP reply | Your address, card, Social Security number or a code |
The real-text format comes from the sample on the USPS Text Tracking page. The foreign-number and missing-tracking-number clues come from a Brown University alert dated October 2023. Treat the sender as one clue rather than proof, and rely on whether you made the request.
Two situations can look confusing:
The wording changes often, but the story usually falls into one of these groups.
| What the text says | What it is after | Who has warned about it |
|---|---|---|
| Your address is incomplete or wrong | Your address, then your card | USPS, Brown University |
| A package is waiting or delivery was missed | A tap on the link | USPS, FTC |
| Pay a small redelivery fee or unpaid postage | Your card number, sometimes your Social Security number | FTC, USPIS |
| Your order is stuck in customs, pay the tariff | Your card number | FCC |
| Your order is confirmed or out for delivery | A tap on the link | FTC |
| Reply Y, then reopen the message | A reply that turns the link on | BleepingComputer |
| Call this number about your delivery | A call to a scam operator, or call charges | FCC |
USPS lists the urgent phrases in a 2023 Postal Bulletin. The FTC explains that the small redelivery fee is a trick to get card numbers. The FCC covers the tariff version and costly callback numbers, and warns about QR codes that come with unexpected packages. Our guide to QR phishing explains that variation. The same trick also arrives by email, with USPIS citing lures such as "Delivery Failure Notification".
The FTC says similar texts also pretend to come from FedEx or DHL, so the same checks apply to any carrier.
The small fee is rarely the real goal. It gets you to type in a full card number, and in the versions researchers have documented, the page then asks for one more thing. Here is the chain, with the action that breaks that stage.
Many different criminals, using shared kits. On November 12, 2025, Google sued unnamed defendants tied to Lighthouse, a phishing-as-a-service kit linked to the group researchers call the Smishing Triad. Google alleges Lighthouse harmed more than 1 million victims in over 120 countries, and estimates between 12.7 million and 115 million US cards were stolen. Those are Google's claims in a lawsuit, and the wide range is its own.
A day later, Google said Lighthouse had been shut down. However, Silent Push told CyberScoop it was still tracking sites using the kit's code and other kits used by the same actors. Treat that as a disruption, not an end. USPIS was still warning about these messages in its 2025 holiday guidance.
Don't panic, and don't go back to the page. Find what you did below and work through every row that applies.
Don't click or reply. Take a screenshot, report it (see the next section), then delete it and block the sender. If you're expecting a package, check tracking through USPS.com or the retailer.
Stop there and don't reply again. You may get more messages, because a reply shows that your number is active. On iPhone, Apple says you can't report a message after replying, but you can still email USPIS, forward the text to 7726 and block the sender.
USPIS is direct on this: if you interacted with the URL, even if you did not click submit, notify your financial institution. Do that even if the page looked harmless.
If you downloaded or installed anything, follow the FTC's malware steps. They are written for computers, but the FTC says they can apply to other devices:
Act now, even if the fee was only a few cents or dollars. These steps come from the FTC's guide to what to do if you were scammed:
Federal law limits what you owe for unauthorized use. The FTC says that when your number is used but the card isn't lost or stolen, you aren't responsible for unauthorized credit card charges. For debit and ATM cards, the same protection depends on reporting within 60 calendar days after your statement is sent, so don't wait. Your bank or credit union can confirm which rules apply to your account. This is general information, not legal advice.
Tell your bank about the code on the same call. Ask whether your card was added to a mobile wallet or a device that isn't yours, and what can be done about it.
This specific question isn't on the FTC's checklist. It comes from the mechanism researchers describe. But it gives your bank the detail it needs, and the official step is still the same: report it to your card issuer right away.
The FTC splits this into two cases:
You can also place a free credit freeze or fraud alert. A freeze stops new credit from being opened in your name until you lift it, and you need to contact all three bureaus: Equifax, Experian and TransUnion. A fraud alert makes lenders verify your identity, and you only need to contact one bureau, which must notify the other two. Our identity theft statistics show how this kind of data gets misused.
The FTC says to create a new, strong password for that account, change it anywhere else you used it, and turn on two-factor authentication. If you're locked out, use the FTC's account recovery guidance linked from the same page.
Whatever you shared, USPIS also suggests reviewing your cell phone bill regularly for unauthorized charges and reporting them to your carrier.
Order matters here. USPIS asks for a screenshot, but on iPhone, "Delete and Report Spam" removes the message. So capture it first.
You can't stop every text, but these official suggestions help:
These texts reach employees too, often on the same phone they use for work. MITRE ATT&CK tracks mobile phishing as T1660, including smishing, and notes that small screens make fake websites harder to spot. A delivery lure is low effort for an attacker, and the same trick can target work logins as easily as card numbers. Our guides to spear phishing and social engineering cover the targeted versions.
Four practical steps:
Yes, but only if you requested it with a tracking number, by texting 28777 or signing up on USPS Tracking. USPIS says those texts won't contain a link. An unexpected USPS text with a link is a scam.
Treat any such text as a scam. USPIS says USPS officials would never directly contact customers by email or text asking for payment or personal information, and the FTC calls the small redelivery fee a trick to get your card number.
You may be fine, but don't assume it. USPIS says to notify your financial institution if you interacted with the link, even without clicking submit. If anything was downloaded, follow the FTC's malware steps.
Possibly. Report it to your card issuer right away and ask for a refund. Federal law limits your liability for unauthorized card use, and your bank can confirm how the rules apply.
No. Don't reply at all. A reply can show that your number is active and can enable links in iMessage. STOP is only useful for real USPS Text Tracking messages from 28777.
For any one person, it's usually impossible to say. Google's complaint alleges that a "data broker" group supplies target lists to the operation. You don't need to work out how they got it to report the text and protect your accounts.
If you got one of these texts, the short version is this: don't tap, check tracking yourself, report it, and call your bank if you shared anything.
If you run security for an organization, the same lure is a useful test of your reporting and response. DeepStrike's penetration testing services include simulated social engineering such as phishing, calling and baiting. If you'd like text-based lures in scope, contact our team to talk it through.
Mohammed Khalil is a Cybersecurity Architect at DeepStrike, specializing in advanced penetration testing and offensive security operations. With certifications including CISSP, OSCP, and OSWE, he has led numerous red team engagements, focusing on cloud security, application vulnerabilities, and adversary emulation. His work involves dissecting complex attack chains and developing resilient defense strategies for clients in the finance, healthcare, and technology sectors.
Stay secure with DeepStrike penetration testing services. Reach out for a quote or customized technical proposal today
Contact Us
