How to Spot Fake Text Messages and Delivery Scams (Smishing)

By

Last updated: October 8, 2026

Mock fake delivery text message on a phone with numbered callouts marking the scam signs

"We tried to deliver your package. Confirm your address to reschedule." Millions of people receive messages like this, and some of them are real. Many are not. Fake text messages, known as smishing (SMS phishing), are one of the most common ways scammers reach ordinary people, because texts feel personal and get opened quickly.

This guide shows how these scams work, the warning signs that give them away, what to do if you tapped a link or replied, and how to report the message.

What Is Smishing?

Smishing is phishing carried out through text messages, and also through messaging apps such as WhatsApp, Telegram, iMessage or RCS chats. The sender pretends to be a delivery company, bank, wireless carrier, government agency, toll operator or online store. The goal is usually one of these:

  • Get you to tap a link to a fake website that captures your login, card or identity details.
  • Get you to install a harmful app or approve a permission.
  • Get you to call a number that connects you to a scammer.
  • Get you to pay a small "fee" that is really a route to stealing card details.

The Classic Delivery Scam

The delivery version is popular because so many of us shop online. A typical message says a package could not be delivered, an address is incomplete, or a small customs or redelivery fee is due. The link leads to a page that looks like a carrier's website and asks for your name, address, phone number and card details for the "fee". The fee may be small, but the real prize is your card information and your personal data.

Scammers send these in bulk to random numbers, so it does not matter whether you are actually expecting a package.

Fake USPS Texts

In the United States, the most-copied name is the U.S. Postal Service. An FTC consumer alert from April 2025 describes fake texts claiming a package is out for delivery or that there is a problem such as unpaid postage, a missed delivery or a need to "update your shipping preferences". The FTC notes that texts claiming to be from FedEx or DHL work the same way. The link leads to a look-alike site, and anything you enter or pay goes to the scammer.

The U.S. Postal Inspection Service gives two clear rules:

  • USPS will not send you texts or emails unless you first requested tracking updates with a tracking number.
  • Even then, a genuine USPS tracking text will not contain a link. USPS also does not charge for its tracking alerts.

So an unexpected "USPS" text with a link is a scam. To check a real delivery, the FTC says to look up tracking on the retailer's site or in the account you ordered from, or type usps.com yourself. If you already interacted with the link, even without pressing submit, USPIS advises telling your bank or card issuer.

What Other Carriers Say

  • FedEx: its report fraud page says FedEx does not request personal information about your account credentials or identity through unsolicited mail, email or text, and asks you to forward suspicious messages to abuse@fedex.com. FedEx notes one exception to watch for: for international imports it may send an email or text with a secure link to pay duties and taxes, which you can check in the FedEx Import Tool on fedex.com rather than through the link.
  • Other carriers: UPS, DHL and others publish their own fraud pages. Find them by typing the carrier's address yourself, not through a link in the message.

Other Common Smishing Themes

  • "Wrong number" and "hi, how are you?" texts: A friendly message from a stranger, such as "Hi, is this Anna?" or "When are you free for coffee?". The FTC warns that scammers use these as conversation starters. If you reply, they apologize, keep chatting to befriend you, and later pitch cryptocurrency "investment" advice. Even a one-word reply confirms your number is active. The FTC's advice is not to reply, and to delete and report the message.
  • Bank alerts: "Unusual transaction on your account. Tap to verify." The link goes to a fake bank login.
  • Unpaid toll or fine notices: A demand to pay a small charge immediately or face a penalty.
  • Account security warnings: "Your account has been locked. Sign in here." The site collects your password.
  • Verification code requests: A message saying it was sent to you by mistake and asking you to send back a code you just received. That code is often a login or reset code for your own account.

Warning Signs of a Fake Text

1. It creates urgency or fear

Deadlines, threats of penalties and "final notice" wording are designed to stop you from thinking. Real organizations generally give you time and use more than one channel.

2. It comes from an unknown or odd number

Messages from ordinary personal numbers, long random numbers, or email addresses pretending to be a company are suspicious. Note that scammers can also make a message appear in the same conversation thread as a genuine sender name, so a familiar sender name is not proof.

3. The link looks wrong

Check for misspellings, extra words or unfamiliar endings, and shortened links that hide the real destination. Real delivery companies and banks use their own domains. If you are not sure, do not tap.

4. You did not initiate anything

If you have not ordered anything, not started a transaction and not contacted the organization, an out-of-the-blue message asking for action deserves caution.

5. It asks for information it should already have

Banks and delivery companies already have your details. Requests to confirm full card numbers, PINs, passwords or one-time codes are red flags. Never share a one-time code with anyone who contacts you.

6. It asks for payment in an unusual way

Requests for gift cards, cryptocurrency, wire transfers or payment through a link in a text should make you stop.

7. It pushes you to another app or a phone call

Moving you to a chat app or a call center is a way to avoid the protections built into messages and email.

What to Do When You Get a Suspicious Text

  1. Do not tap links, open attachments or call numbers in the message.
  2. Do not reply, not even "STOP". Replying can signal to the sender that your number is active.
  3. Check independently. If you are expecting a package, open the retailer's site or the carrier's official app, or type its website address (such as usps.com) yourself, and check the tracking number from your order confirmation. If it is about your bank, use its official app or call the number on your card.
  4. Report and delete. Use your phone's "Report junk" or "Report spam" option, or forward the message to your carrier's reporting service (see below). Then block the sender and delete the message.

What to Do If You Tapped the Link or Replied

Many smishing messages work like email scams, so see the signs of a phishing email.

  1. If you only opened the page, close it and do not enter anything. Keep your phone updated and run a scan with reputable security software if you are worried.
  2. If you entered a password, change it at the real website straight away and anywhere you reused it. Our guide on telling whether your email has been hacked shows what else to check. Turn on two-factor authentication, and sign out of other sessions where possible.
  3. If you entered card details, contact your bank or card issuer using an official number. Ask about blocking the card, disputing charges and monitoring the account. If you also entered your Social Security number or date of birth, read our guide on what to do after a data breach, which covers credit freezes and fraud alerts.
  4. If you shared a one-time code, assume someone is trying to access that account. Sign in through the official site or app, change the password and check recent activity.
  5. If you installed an app or profile from the link, remove it, disconnect from the internet if it behaves strangely, run a scan, and change important passwords from a different, clean device. If you are unsure, consider seeking help from a trusted professional or resetting the phone.
  6. Keep evidence. Take screenshots of the message and any pages. They may help if you report it or dispute a payment.
  7. Watch for follow-up scams. After you have engaged, you may receive more messages, including fake "recovery" offers.

How to Report Smishing

Reporting options vary by phone and carrier, so confirm details on the official pages.

  • Your phone's messaging app: both iPhone and Android messaging apps offer options to report junk or spam, usually by opening the message and choosing a report option. See Apple's guide to reporting spam in Messages on iPhone and Google's page on reporting spam in Google Messages. Menu names differ between versions.
  • The impersonated company: Many banks and delivery companies publish a page or address for reporting fraudulent messages that use their name.
  • USPS-related texts: USPIS asks you to email spam@uspis.gov. Copy the text of the message into the email without clicking the link, include your name, attach a screenshot showing the sender's number and the date, and say whether you clicked, paid or shared information. Also forward the text to 7726.
  • FedEx-related messages: forward them to abuse@fedex.com.
  • The FTC: The Federal Trade Commission accepts reports at reportfraud.ftc.gov, and also advises forwarding the message to 7726 (SPAM).
  • The FCC: You can also file a complaint about unwanted texts at the FCC Consumer Complaint Center. The FCC says it does not resolve individual complaints but uses them to inform enforcement. Your wireless carrier may also have its own spam reporting number.

If you lost money, contact your bank first, then report it to your local police and at IC3.gov.

How to Reduce Smishing Risk

A strong, unique password limits the damage: see how to create a strong password you can remember.

  • Use your phone's built-in spam filtering and the "filter unknown senders" option if it has one.
  • Save official apps for banks and delivery companies and use them for tracking and alerts.
  • Use a password manager. It fills logins only on matching websites, so a fake page will usually not get your saved credentials, which can prompt you to look more closely.
  • Turn on two-factor authentication using an authenticator app or security key when available, rather than relying only on text codes.
  • Keep your operating system and apps up to date.

Frequently Asked Questions

Can I be hacked just by receiving a text?

Receiving one is rarely enough by itself. The risk comes from tapping links, installing things or sharing information. Rare technical exploits do exist, which is another reason to keep your phone updated.

Why do scammers have my number?

Numbers may come from data leaks, lists sold between criminals, or from generating numbers at random. Having your number does not mean they know anything else about you.

Should I reply "STOP" to unwanted texts?

Not for suspected scams. Block and report instead.

How do I know whether a delivery message is real?

Do not use its link. Use the retailer's site or the carrier's official app or website, and check the tracking number from your order.

Does USPS send texts with links?

No. The U.S. Postal Inspection Service says USPS only texts you if you requested tracking with a tracking number, and those texts will not contain a link.

Is it safe to reply to a "wrong number" text to be polite?

It is better not to. The FTC says these messages are often conversation starters for scams, and any reply confirms your number is active.

Related Guides

Conclusion

Smishing works by making you act before you think. The defense is a simple routine: do not tap, do not reply, verify through the official app or website, and then report and delete. If you do slip, change passwords, call your bank promptly and watch your accounts. A few seconds of hesitation is often all it takes to stop these scams.

Comments

Post a Comment

Popular posts from this blog

How to Tell If Your Email Has Been Hacked and What to Do

By
Image
Last updated: October 8, 2026 Your email account is the master key to almost everything else you own online. Bank alerts, shopping receipts, social media logins and "forgot password" links all land in your inbox. If someone else gets into it, they can often reset the passwords of your other accounts too. That is why spotting a hacked email account quickly matters so much. This guide shows the common warning signs, how to check whether someone has really been in your account, and what to do, in order, if they have. It covers Gmail, Outlook, Yahoo and iCloud Mail, with links to each provider's official help page. Common Signs Your Email May Have Been Hacked No single sign proves a break-in, but several together are a strong hint. Watch for these: Friends say they received strange messages from you. Links, "urgent" requests for money or odd attachments sent to your contacts are a classic pattern. Sent folder items you did not write. Sometimes attackers d...
Read more

How to Create a Strong Password You Can Actually Remember

By
Image
Last updated: October 8, 2026 Most of us know we should use strong passwords, yet we still end up with "Summer2024!" or the same password on ten websites. The reason is simple: strong passwords seem impossible to remember. The good news is that a strong password does not need to look like random noise. Length matters more than complexity, and there are easy ways to make long passwords memorable. This guide explains what actually makes a password strong, what the current US government guidance says, how to build a password you can recall, how to check whether your existing passwords are weak or leaked, and when to hand the job over to a password manager. What Makes a Password Strong? Attackers rarely sit and guess by hand. They use software that tries huge numbers of guesses, starting with the most common passwords, known leaked passwords and predictable patterns. The Cybersecurity and Infrastructure Security Agency (CISA) sums up a strong password with three tips, and ...
Read more

How to Recover a Hacked Instagram Account

By
Image
Last updated: October 8, 2026 Finding that your Instagram password no longer works, that the email address on the account has changed, or that strange posts and messages are going out under your name is stressful. The important thing is to act in a sensible order, because the path you can use depends on whether you can still sign in. This guide walks through both situations: you can still get in, and you are locked out. It also covers how to secure the account afterward and how to avoid the "recovery services" that make things worse. Menu names in the Instagram app change from time to time, so where wording may differ, this guide describes the option generically and points you to Instagram's own Help Center . Instagram also has a dedicated page for hacked accounts at instagram.com/hacked , which you can open in a desktop or mobile browser. One more naming note: Instagram's Help Center says Meta is gradually moving people to Meta Accounts , so you may see either ...
Read more