A text about a package arrives from an unfamiliar number, with a link and a warning that delivery has failed. The U.S. Postal Inspection Service says a real USPS tracking message works the opposite way: the agency will not send customers text messages or e-mails without a customer first requesting the service with a tracking number, and the message “will NOT contain a link.”
Free daily tech newsletter: TLDR is the free daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.
We may earn a commission if you sign up.
That two-part test, an opt-in first and no link ever, gives recipients a reliable way to sort real notices from smishing without examining a sender’s number or the wording of the text. The Inspection Service defines smishing as a form of phishing that involves a text message or phone number, and scammers often pose as a government agency, a bank or a company.
The Opt-In Rule That Exposes Fake Delivery Texts
The Postal Service’s text tracking is a service that customers start themselves, either by registering online or by texting a tracking number. According to the Postal Inspection Service’s guidance on package-tracking text scams, last updated on May 19, 2025, USPS does not charge for these services and uses five-digit short codes for its text messages. A message that shows up for a package nobody asked USPS to track therefore fails the first test, whatever it claims about a missed delivery or an unpaid fee. The USPS text tracking FAQ is the reference the Inspection Service points customers to for the legitimate version of the service, including how to sign up for it and how it works.
A Link Is the Tell, Even for a Package Someone Expects
The second test is blunter. The Inspection Service lists two red flags: the recipient never requested tracking for a package, and the text includes a link, even if it seems to concern a delivery that is actually on the way. That second point is the trap. A link on a text about a parcel that really is in transit can look entirely plausible, which is why the rule makes no exception for deliveries that are actually expected.
The Federal Trade Commission describes where such a tap leads. In a consumer alert titled “Think that text message is from USPS? It could be a scam,” the agency says the link sends people to a fake copy of a real website, where scammers try to collect personal or financial details. Its advice matches the Postal Service’s: do not click, and check the shipment through the retailer’s site or an account there instead of the message. The agency also suggests using a phone’s settings to filter and block texts from unknown senders, and reporting the message through the messaging app’s junk or spam option or by forwarding it to 7726. Inspectors say the same thing about the Postal Service itself: anyone expecting a parcel can visit USPS.com on a phone or computer to follow it.
Reporting a Fake USPS Text to Inspectors, the FTC and the FBI
The Inspection Service’s reporting steps are specific. Without clicking the link, copy the body of the message into a new email and send it to [email protected] with a name, attach a screenshot showing the sender’s phone number and the date, and mention whether the link was clicked, money was lost or personal information was shared. The text itself should be forwarded to 7726, which helps report the scam number. The Inspection Service says it will make contact if it needs more information.
Texts that have nothing to do with USPS take a slightly different route. The page directs people to forward them to 7726, report fraud to the FTC at reportfraud.ftc.gov, and file a complaint with the FBI’s Internet Crime Complaint Center through its complaint form. People who want to report a mail-related crime more broadly can use the Inspection Service’s report page.
Cleanup Steps After Tapping the Link
The guidance anticipates that some people will have tapped already. Anyone who interacted with the link, even without submitting anything, is told to contact a financial institution. The other steps are modest and quick: do not reply, delete the message, and verify the sender before sharing any information. The page also suggests calling the carrier, usually by dialing 611, to block text messages that are sent to a phone as email, and it advises checking the phone bill regularly for unauthorized charges.
The simplest habit follows from the two tests. A legitimate tracking text can only follow a request that the customer made, and it will not carry a link, so a message that breaks either rule can be deleted without a second look. Anything that really needs attention can be checked on USPS.com, or by calling the Postal Inspection Service at 1-877-876-2455. The same agency also publishes a separate article on fake USPS emails, which applies the same logic to phishing messages that arrive in an inbox instead of on a phone, and keeps a page on the brushing scam for people who receive packages they never ordered.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
More from Morning Overview
- Doctors warn a silent liver disease now affects one in three American adults
- The FBI told the rest of ShinyHunters to surrender after a 24-year-old was arrested
- Two passengers died at an Ohio toll plaza, and the NTSB now wants the cash lanes shut
- Long use of a common prostate pill is tied to a higher chance of glaucoma
