A text that says a package is waiting, delivery failed or an address needs updating, and that carries a link, is the standard shape of a fake U.S. Postal Service message. The U.S. Postal Inspection Service, the law-enforcement arm of USPS, has a simple test for spotting one: genuine tracking texts do not contain a link.
The rule is narrow and it is checkable in a second. It rests on how the Postal Service says its text alerts work, and it lets a recipient discard a large class of scam messages without reading the rest of the text or judging how official it looks.
The rule as the Postal Inspection Service states it
The wording comes from the Postal Inspection Service’s smishing guidance on package-tracking texts, last updated May 19, 2025. It says USPS “will not send customers text messages or e-mails without a customer first requesting the service with a tracking number,” and that a real tracking message “will NOT contain a link.” Two conditions are packed into that sentence. The customer must have asked for the alerts, and even then the message carries no clickable address.
Smishing, the term in the page’s title, is phishing done through a text message or phone number. The inspectors describe it as an attempt to trick recipients into revealing personal or financial information while impersonating a legitimate organization. The information at risk includes account credentials, Social Security numbers, birthdates and card numbers, all of which can be turned into fraud. The guidance also describes how real alerts are sent, using five-digit short codes to send and receive text messages. A message arriving from a full ten-digit phone number therefore does not match that description, although the presence of a link is the simpler tell.
Why an unsolicited link is the giveaway
The scam depends on urgency and on a link. A typical message claims a parcel cannot be delivered and asks the recipient to tap through to update an address. ABC7 reported the same warning in October 2023, quoting the Postal Service’s statement that texts or emails are not sent unless the customer registered to receive them, and that its messages will not contain a link. The same report cited FTC data showing consumers lost $23.6 million to imposter scam texts in the first nine months of 2023.
Time’s coverage of the same guidance, Beware of Fake USPS Text Messages, repeated the advice to verify the sender before responding, never click links in unsolicited texts and block spam messages through a wireless carrier. Its summary of the inspectors’ advice also includes monitoring a phone bill for unauthorized charges and keeping devices updated with security patches.
Package scams are effective because most people are expecting a delivery at any given moment. That expectation, not any technical trick, is what the fake text exploits. When the Postal Inspection Service says a real alert will not contain a link, it removes the need to judge a message’s design, since even a flawless copy of USPS branding fails the test.
Where to send a fake text, and what to do after a click
The inspectors give two USPS-specific reporting routes. A suspicious text can be forwarded to 7726, which spells SPAM on a phone keypad and reports the scam number. It can also be emailed to [email protected] with the message body, a screenshot, the sender’s phone number and the date. For scams unrelated to the Postal Service, the page points to the FTC’s ReportFraud site and to the FBI.
The FTC’s phishing guidance agrees on the basics: a person with no account at the company named in the message is probably looking at a scam, and, in the agency’s words, legitimate companies “won’t email or text with a link” to update payment information. It advises contacting the company through a phone number or website already known to be real. The FBI’s Internet Crime Complaint Center serves as the federal intake point for cyber-enabled fraud.
Someone who has already tapped the link is told to notify their financial institution. The Postal Inspection Service also asks that a report include details if the recipient clicked, lost money or shared personal information. Axios quoted the inspectors in December 2024 saying that USPS would never contact a consumer by text unless the customer initiated the request, and pointed shoppers to the carrier’s own tracking tools or a retailer’s account instead.
The practical habit that follows is to leave the text alone and go to the source. A recipient expecting a parcel can open the carrier’s own tracking page, or the retailer’s order page, and type in the tracking number by hand. If the parcel is real, the status appears there. If it is not, nothing was lost by ignoring a message that failed the one-link test, and the number that sent it can be reported and blocked.
The page carries a May 2025 update date, and no source reviewed here reports a change to the rule since then. The unanswered figure is scale: none of the guidance says how many fake USPS texts reach phones each day.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
More from Morning Overview
- A handful of car engines are so tough mechanics say they almost never wear out
- The NSA is again telling phone owners to switch off one location setting
- Supplements now rank as the fifth-leading cause of death from liver disease.
- Herbal supplements are landing Americans in the hospital with liver damage, doctors warn
