How to Spot Two Types of Package Delivery Scams

In 2024, Massachusetts' Grant Smith got a text message many of us have seen, telling him that his U.S. Postal Service (USPS) package couldn't be delivered until he clicked on a link to resolve the issue.1 Smith didn't fall for the common smishing scam, but he later found out his wife had received the same text and had entered her credit card into the fraudulent link. 

The scammers had defrauded the wrong wife. Smith is a security researcher who spent weeks tracking down and hacking into the Chinese-language system that supported the illegal venture. He then gathered up the stolen personal data, including 390,000 credit card numbers, and handed it all over to authorities. Smith found that the scammers were sending out 100,000 texts a day. 

Hopefully, his wife was impressed. But not all of us have cyber-vigilante spouses to protect us. And that's not the only package-related fraud out there. American households receive an average of 165 packages per year, and scammers have found ways to take advantage.2

As an aside, another recent trend has been linked to toll road fees not being paid. Fraudsters send text messages telling the recipient they're at risk of late fees or fines, or even suspension, if they don't pay. This smishing scam registered 59,271 complaints and $129,624 in losses in 2024, according to the Federal Bureau of Investigation's (FBI) annual Internet Crime Report 2024.3

In any event, here are two ways fraudsters use consumers' shipping habits to steal money, data and identities. 

Package Delivery Text Message Scam

Many Americans have experienced the smishing scam that ensnared Smith's wife. Smishing is the term for text-message-based phishing. And phishing is any scam where a fraudster sends out emails, texts, or other messages under a false name with the aim of leading the receiver into a scam. Phishing is the FBI Internet Crime Complaint Center's most commonly reported fraud, with more than 300,000 reports in 2024, costing victims $70 million, almost four times the losses reported in 2023.3

How Package Delivery Smishing Works

Package delivery smishing can end a few different ways, but it typically begins similarly to what happened to the Smiths: A would-be victim receives a text message claiming to be from USPS, UPS, FedEx, or another package carrier. The text usually states that the carrier has a package to deliver to the recipient, but there is a delivery issue, directing the recipient to a link to resolve it. 

Sometimes the link will lead victims to a page requesting credit card information to pay outstanding postage. Other times, the link will simply ask for personal information for the scammer to collect. The link could also automatically download malware — malicious software programmed to disrupt or damage a device's operation, gather sensitive information, or give someone access to your computer.

How to Protect Yourself from Package Delivery Phishing

Fortunately, the preventative measures for package delivery smishing scams are pretty straightforward: Never click on a link in any text claiming to be from a package carrier. If you are expecting a package from the carrier, find your original, legitimate tracking information, locate the shipper's contact information and reach out to them yourself.

Package Brushing Scam

Some of the trickiest scams are those in which the potential gains for the perpetrator aren't clear. Like when a package arrived on Anna Hutchinson's Minnesota stoop full of baby shower decorations she didn't order.4 It wasn't a misdelivery, but a scam known as brushing. Hutchinson didn't detect any harm in the incident, but her personal information and finances could have been at risk.