Delivery scam texts work because they exploit something true, not something far-fetched: most people, on any given day, are actually waiting for at least one package. That baseline plausibility is the entire mechanism. A text claiming to be from USPS, FedEx, or UPS saying your package "couldn't be delivered" and needs a small fee to be rescheduled doesn't need to be well-written or convincing in any deep sense — it just needs to arrive at a moment when you're genuinely expecting a delivery, which for most people is most of the time.
This has made delivery scam texts one of the most consistently reported categories of SMS fraud, and the volume keeps climbing because the format is cheap to send at scale and effective against a huge, rotating pool of people who happen to be mid-shipment at the moment the text lands.
How the scam actually works
The structure is consistent enough across variants that it's worth laying out explicitly:
- A text arrives claiming to be from a shipping carrier (USPS, FedEx, UPS, DHL, and sometimes a retailer like Amazon directly), stating a delivery failed or is being held.
- It includes a link, often using a shortened or lookalike domain designed to resemble the real carrier's site at a glance.
- The link leads to a page requesting a small "redelivery fee" or "customs fee," usually a few dollars — small enough that it doesn't trigger much suspicion, which is deliberate.
- The payment page captures full card details, and in many cases this is the actual goal: not the few dollars from that one transaction, but a validated, working card number that gets resold or used for larger fraud afterward.
- Some variants skip payment entirely and instead harvest login credentials by mimicking a carrier or retailer account login page.
The small-dollar-amount framing is a deliberate design choice, not an oversight. A request for $2.99 reads as plausible and low-stakes in a way a request for $200 wouldn't, which lowers the psychological bar for handing over card details.
Red flags specific to delivery scam texts
- A link using a domain that isn't the carrier's actual domain. USPS, FedEx, and UPS all use their own established domains; a shortened link or a domain with extra words, hyphens, or a different top-level domain (.info, .xyz, and similar) is a strong signal.
- A request for payment to "redeliver" a package. Real carriers do not charge a redelivery fee via text message link for a standard delivery attempt. This is close to a universal tell.
- Vague or missing tracking numbers. Legitimate delivery notifications almost always reference a specific tracking number tied to an actual order you placed; scam texts are frequently vague or reference a generic "package" with no real tracking detail, because the sender has no idea whether you've actually ordered anything.
- Urgency with a tight deadline. "Respond within 24 hours or your package will be returned" is designed to short-circuit the moment of double-checking you'd otherwise take.
- Arriving when you're not expecting any package at all. These campaigns are sent in bulk to huge number pools with no targeting, so a meaningful share of recipients get the text despite having nothing in transit — a useful tell if you happen to check.
What to do if you get one
Don't tap the link, even out of curiosity — some of these pages are built to fingerprint your device or redirect through additional malicious steps beyond the initial credential or payment harvest. If you want to verify a delivery, go directly to the carrier's official app or website and enter a tracking number yourself, rather than following any link from the text. If you do want to report it, USPS has a dedicated reporting channel (forwarding to 7726, which spells "SPAM"), and most carriers have a fraud-reporting page on their official site. After that, the text itself should be permanently blocked so the same sender or pattern can't reach you again.
Why these texts keep coming from new numbers
Delivery scam campaigns are sent through the same category of bulk messaging infrastructure used for legitimate business texting, routed through providers with weak or no verification of who they're sending on behalf of. A single campaign typically rotates across a large pool of sending numbers specifically to stay ahead of number-based blocklists and carrier spam filters. Blocking the specific number that texted you stops that one number — it does nothing to the hundred other numbers the same campaign is actively using, and nothing to the identical campaign that resumes from a fresh number next week. This is exactly why pattern-based blocking, rather than number-based blocking, is the only approach that actually holds up against this category of spam.
How JunkNot blocks this pattern permanently
When a delivery scam text arrives, swiping it away and tapping "JunkNot it forever" creates a permanent block rule. Because SMS doesn't carry an app-defined notification channel the way app notifications do, JunkNot's matching for texts relies on sender identity and pattern-based metadata — formatting patterns common to this exact style of bulk-sent scam campaign, and whether the message originated from a short code or long code typical of these operations. That means the rule generalizes beyond the single message you swiped, rather than only blocking that one exact text. All of this classification happens on-device; message content isn't uploaded to a server to make the call.
JunkNot Pro's AI Autopilot extends this further by proactively flagging new delivery-scam-shaped texts before you've personally seen and swiped a version of them — useful specifically for a scam category like this one, which changes wording and carrier name constantly ("USPS" this week, "FedEx" next) while keeping the same underlying structural pattern (fake tracking claim, link, small-fee request). A model trained to recognize that structure doesn't need to see every individual wording variant to catch the next one.
Setting up protection against this specific scam
- Install JunkNot and grant notification access so it can see and act on incoming texts.
- The next time a delivery scam text arrives, swipe it and tap "JunkNot it forever" rather than just deleting it — deleting removes the one message; blocking removes the pattern going forward.
- Get in the habit of checking tracking status only through a carrier's official app or site, never through a link in an unsolicited text, regardless of how plausible the text looks.
- If the volume of these texts is high or frequently changing wording, consider JunkNot Pro's AI Autopilot to catch new variants proactively instead of swiping each new wording individually.
- Report persistent scam texts to your carrier via 7726 (SPAM) in addition to blocking them in-app — this helps the carrier-level filtering layer improve for everyone, not just you.
Delivery scams versus other common SMS scam types
| Scam type | Core hook | What makes it effective |
|---|---|---|
| Delivery scam ("package undeliverable") | Plausibility — most people are expecting a package at any given time | Low-dollar fee request feels low-stakes and believable |
| OTP/verification code scam | Urgency and authority — mimics a real login security flow | Tricks people into forwarding a real code to an attacker |
| Bank account alert scam | Fear — implies fraud is already happening on your account | Panic short-circuits normal verification habits |
| Prize/gift card scam | Reward — framed as something good happening to you | Lower guard than fear-based scams, but still requires a click or payment info |
Delivery scams specifically stand out for relying on plausibility rather than fear or reward, which is part of why they're so consistently effective against a broad population — the premise doesn't need to be alarming to work, it just needs to be believable, and for most people, "I might have a package coming" is almost always true.
Why this scam category isn't going away
Package delivery volume has grown consistently with the broader shift toward online shopping, which means the baseline plausibility this scam relies on isn't shrinking — it's growing. As long as a meaningful share of the population is mid-delivery on something at any given moment, this specific scam template will keep working well enough to justify the infrastructure cost of sending it at scale. That's a structural reason to set up permanent, pattern-based blocking now rather than treating each individual text as a one-off annoyance to delete and move past.
How carrier impersonation varies by brand
The three major carriers get impersonated slightly differently, and recognizing the specific pattern each uses can help you catch a fake faster:
USPS-themed scams
These often reference a "held package" or an "address verification" requirement, since USPS's actual delivery process does sometimes involve address confirmation for certain mail classes, which gives the scam a thin layer of plausibility. The real USPS does not send text links asking for a redelivery payment — their actual processes for delivery issues run through their official site and physical delivery notices, not unsolicited payment links.
FedEx and UPS-themed scams
These more frequently reference a "customs fee" or "clearance fee," leaning on the fact that international shipments genuinely sometimes incur customs charges, making the premise feel more familiar to anyone who's ever ordered something from overseas. Both FedEx and UPS have been explicit in their own fraud-awareness pages that they do not request payment via unsolicited text link for standard delivery completion.
Retailer-themed variants (Amazon and similar)
Rather than impersonating the shipping carrier, some variants impersonate the retailer directly, claiming an order issue or a refund that requires "confirming" payment details. These work on a slightly different psychological hook — concern about a specific order you may actually remember placing — rather than the more generic "a package" framing of carrier-impersonation variants.
Why the small-fee framing is so effective
It's worth sitting with why a request for $1.99 or $2.99 works as well as it does, because the psychology is more deliberate than it looks. A request for a large sum triggers scrutiny almost automatically — most people pause and think before authorizing a few hundred dollars to an unfamiliar site. A request for a couple of dollars reads as trivial, barely worth the mental overhead of questioning, which is exactly the point: the amount is calibrated to sit below most people's internal threshold for "this requires me to stop and verify." The actual goal usually isn't the few dollars themselves — it's a validated, live card number, confirmed to work by that small successful transaction, which then gets used for larger fraud or resold to someone who will.
What a real delivery notification looks like, for comparison
It helps to know what the legitimate version actually looks like, since the contrast makes scam texts easier to spot on sight. A real carrier delivery text typically: references a specific tracking number you can independently verify by typing it into the carrier's official site directly (not through the text's link), comes from a consistent, carrier-associated short code you'll see repeatedly across legitimate shipments over time, and never requests payment information to complete a standard delivery — redelivery after a missed attempt is handled through the carrier's normal process, not a text-based payment page. If a text is missing a specific, independently-verifiable tracking number, that absence alone is one of the more reliable tells available.
Why this scam spikes around shopping seasons
Delivery scam volume isn't constant throughout the year — it rises sharply alongside real shipping volume, particularly around major shopping periods when a larger-than-usual share of the population has multiple packages genuinely in transit at once. This isn't a coincidence; it's the same plausibility mechanism scaled up seasonally. A scam campaign sent in a low-shipping month hits a smaller base rate of people who are actually expecting something; the identical campaign sent during a high-shipping period hits a much larger base rate, which is exactly why reported delivery scam volume tracks shopping season spikes so closely. Setting up permanent pattern-based blocking before a high-volume shipping period, rather than reactively after getting hit, is a meaningfully better-timed defense.
How to safely verify a suspicious delivery text
If a delivery text leaves you genuinely unsure whether it's real, there's a safe way to check that doesn't involve the text's link at all:
- Open the carrier's official app (USPS, FedEx, UPS, or DHL) directly, or type the carrier's known web address into your browser manually rather than tapping anything from the text.
- If the text referenced a tracking number, enter that number directly into the carrier's official tracking tool. If it's a real tracking number tied to a real shipment, it'll show up with accurate status. If it's fake or unrelated, the lookup will fail or show something that doesn't match the text's claim.
- If you're unsure whether you have anything in transit at all, check your email for order confirmations and shipping notifications from retailers you've actually ordered from recently, since real shipping updates are also typically mirrored by email.
- If the text claims to be from a retailer rather than a carrier, log into that retailer's app or site directly (not through the text) and check your order history for anything matching.
This entire process takes under a minute and completely avoids the scam's core mechanism, which depends entirely on you interacting with its link rather than verifying independently.
Why this scam is worth explaining to less tech-savvy family members
Delivery scam texts are specifically effective against people who shop online less frequently or are less familiar with how legitimate shipping notifications typically look, which disproportionately includes older relatives who may not have a strong existing mental model of "carriers don't text payment links." If you're setting up protection for your own phone, it's worth a short, concrete explanation to anyone in your life who might be more vulnerable to this specific pattern: real delivery issues don't get resolved by paying a small fee through a text link, full stop, regardless of which carrier is named. That one sentence, repeated once, prevents more actual financial loss than a longer technical explanation of spoofing and bulk messaging infrastructure that's unlikely to be remembered in the moment a convincing-looking text arrives.
Frequently Asked Questions
How do I know if a delivery text is real or a scam?
Check whether it includes a specific tracking number tied to an order you actually placed, whether the link goes to the carrier's real domain, and whether it's asking for payment — real carriers don't charge a redelivery fee via a text link. When in doubt, check tracking directly through the carrier's official app or site instead of the link.
What happens if I already clicked the link and entered payment info?
Contact your card issuer immediately to report potential fraud and consider requesting a new card number — don't wait to see whether unauthorized charges actually appear first.
Can blocking one delivery scam number stop future ones?
Not reliably, since these campaigns rotate across many sending numbers. Pattern-based blocking, which looks at message structure and sender metadata rather than just the one number, is what actually holds up against number rotation.
Does JunkNot read the content of my delivery texts to detect scams?
Classification runs on-device using sender and pattern-based metadata rather than uploading message content to a server for analysis.
Should I report delivery scam texts even after blocking them?
Yes — forwarding to 7726 (SPAM) and reporting to the carrier being impersonated helps improve detection at the carrier and platform level, beyond just protecting your own number.