Holiday Package Text Scams: The Fake 'Failed Delivery' Text That Spikes Every Holiday Season | High Sierra Cyber

If you are shopping online this holiday season, you are also a target. Every November and December, as millions of packages move across the country, scammers flood phones with fake delivery texts. The message looks routine, it arrives when you actually are expecting a package, and it is designed to make you tap a link before you think twice.

This scam has a name: smishing, a blend of SMS and phishing. According to the U.S. Postal Inspection Service, fake package texts are one of the most reported scams in the country, and the volume climbs sharply during the holidays because that is when a delivery notification feels normal.

What the scam text looks like

The most common version is the “failed delivery” text. It claims a package could not be delivered and pressures you to fix something right away. Real examples read like this (links shown here are defanged so you cannot tap them):

USPS: Your package could not be delivered due to an incomplete address. Please update your details at usps-redelivery[.]com to reschedule.

U.S. Postal Service: We attempted delivery but were unable to complete it. A small fee is required to release your parcel: track-usps[.]info/pay

The brand changes, but the script does not. You will also see the same trick wearing a FedEx, UPS, DHL, or Amazon label. The details vary. The goal never does.

What happens if you tap the link

The link leads to a counterfeit website built to look like the real carrier. There, it tries to:

Steal your personal information, such as your name, address, and date of birth.
Capture payment card details, often by asking for a tiny “redelivery fee” of a dollar or two, which is really just a way to harvest your card number.
Collect logins or verification codes you type in.
Install malware on your phone in some cases.

The “fee” is bait. No legitimate carrier charges you a couple of dollars by text to release a package.

How to tell a real delivery text from a fake one

The single most useful fact comes straight from USPS: the Postal Service will not send you a text with a tracking link unless you first requested tracking for a specific package using its tracking number. An unexpected text with a link is the tell.

Watch for these red flags:

You did not sign up for tracking alerts from that carrier, yet here is a text with a link.
The link is not the carrier’s real website. Scam links use look-alike addresses like usps-redelivery[.]com or usps.tracking-info[.]net instead of usps.com.
It demands a fee to redeliver or release the package.
It pushes urgency, warning the package will be returned or held if you do not act now.
The sender is an ordinary phone number or email address, not a short code from the carrier.

When in doubt, do not use the link in the text. Go straight to the carrier’s real website and enter your tracking number yourself, or check the order confirmation from the store where you bought the item.

What to do if you get one

Do not tap the link. That is the whole game. If you do not tap, the scam fails.
Do not reply, not even “STOP.” A reply tells the scammer the number is live.
Delete the message after you report it.
If you already tapped and entered card or login details, call your bank or card issuer right away, and change any password you typed. Watch your statements closely.

How to report it

Reporting takes less than a minute and helps carriers and investigators shut these operations down:

Forward the text to 7726 (SPAM). This is a free service that flags scam texts for the carriers.
For fake USPS texts specifically, email a screenshot to spam@uspis.gov, along with the sender’s number and the date. Do not click anything in the message first.
Report to the FTC at reportfraud.ftc.gov and, if you lost money, to the FBI’s Internet Crime Complaint Center at ic3.gov.

A note for Reno-Tahoe business owners

This one is not just a home problem. During the holidays your staff are ordering supplies, gifts, and inventory, and a fake delivery text that lands on a work phone can expose a work login or a company card just as easily. A thirty-second reminder to your team, “unexpected delivery text with a link, do not tap it, check the real tracking page instead,” is cheap insurance during the busiest shipping weeks of the year. This is exactly the kind of timely, real-world lure we build into security awareness training and phishing simulations for Northern Nevada teams.

The people most likely to get caught are the ones expecting the most deliveries and feeling the most holiday rush. Forward this to family and coworkers now, before the shipping season peaks. A quick heads-up today prevents a stolen card number in December.

You can also see this scam, along with other active local warnings, on our Reported Scams board.

Sources: U.S. Postal Inspection Service: Smishing and package tracking text scams and Federal Trade Commission: How to recognize and report spam text messages.

High Sierra Cyber is a Reno-Tahoe cybersecurity company sharing this as a community safety alert. We are not affiliated with the U.S. Postal Service or any carrier named here. General information only, not legal or financial advice.