It starts with a text that looks like it’s from the United States Postal Service (USPS). It says there’s a problem with your delivery. All you need to do is click the link to provide missing information or pay a small delivery fee, and your package will be on its way. It seems harmless enough, maybe you’re even expecting a delivery so it feels routine. It’s not, it’s a scam – and a convincing one at that.
Kitboga and the Seraph Secure scam investigations team rolled up our sleeves and took a deeper dive into the latest wave of mail text scams with the goal of understanding how widespread they are and how much damage they can do, all so we can help arm you with the knowledge you need to keep yourself safe.
We know these mail text message scams seem to be impacting nearly everyone with a mobile device, but what we found was alarming. These scams are far more widespread and convincing than many probably realize.
These failed package delivery scams even span internationally – Canada Post, the UK’s Royal Mail, and Australia Post all see their fair share of them. Other couriers in the United States – FedEx, UPS, and DHL – aren’t immune either. Where you are in the world doesn’t matter, all have a common theme: a package failed to be delivered, and you need to provide some information and maybe pay a nominal fee to receive it.
How the USPS Scam Works
The USPS might seem outdated in a world where most communication is done via email, texts, and instant messages, but they still play a major role in our society when it comes to delivering important packages and documents. Companies like Amazon and others even partner with USPS to ensure timely delivery to their customers. Scammers know the trust people place in these services, making them a target for exploitation.
These scams typically start with a text message, something like:
“USPS: We were unable to deliver your package. Please update the delivery address here: [scammy-link].”
These kinds of texts are called smishing (think phishing in text message form, SMS + phishing). They come from a random number or email address and contain a link that may look convincing if you don’t look too closely.
Tip from the Scam Experts: Always look carefully at the link URL. Scam links will often have mistakes or additional characters that are not part of the USPS website.
The link often leads to a clone of the real USPS website – same logo, legal disclaimers, and even real social media links. Once you land on the fake site, you are prompted to enter your personal details on a form to “verify” your delivery.
According to the United States Postal Inspection Service website, the USPS will never send you messages about missed deliveries unless you opt in online and provide a tracking number for a specific package. What scammers are betting on is that you don’t know this.
Official messages with tracking information will not contain links. If there is a problem delivering a package, you will get a physical letter or notice.
Investigating the USPS Scam
The investigations team started out by doing something we don’t recommend you do. We clicked on the links in these scam text messages so you don’t have to.
The fake websites are shockingly well done. Everything – from the logos with blue checkmarks to the legal pages – looks official. Some even have pages that link to the real USPS website, including the page about USPS scams, for an extra dash of authenticity.
Everything is an exact or near exact match, except for the “Click Update” button. Of course, we clicked it, and this is where the scam gets nasty.
You’re redirected to a form that asks for personal details. We found that the scammers typically ask you to enter your name, address, phone number, and email address, but we also came across some that wanted your date of birth and social security number.
The tracking number at the top? Totally fake. In fact, we found that scammers were often using the same tracking number across dozens of scam websites and texts, but there’s no guarantee it is always this number.
If you’re ever in doubt, take a moment to independently verify the tracking number provided. You can do this by visiting the official USPS website and entering the number in the designated tracking tool. Authentic tracking numbers should correspond to actual packages in transit and show accurate information about their status and expected delivery date.
The next step was to make a payment – a small charge of only a few cents, but a very high cost to pay if you actually enter your payment information. These scammers are hoping you don’t know the USPS never charges for any sort of “redelivery fee” and that you will think nothing of paying a small fee to get your package delivered.
Here’s what happens:
You enter your personal information
You enter your card details to pay the small fee
Nothing – except the scammers now have your personal and payment information
When we entered credit card card information and hit the check out button, we were sent back to the previous screen. Perhaps the scammers wanted us to think we did something wrong so we enter the information again. Or maybe they hoped we would try a different card this time, thinking the first was declined.
Meanwhile, your information is sent off to who knows where, leaving you in a very vulnerable position.
We were pretty surprised just how real this form looks. It’s frustrating, almost impressive in the worst way, to see just how sophisticated some of these scams have become. Scammers are taking advantage of a trusted service and have found a clever way to steal your personal details. Handing over your information on one of these forms opens the door to identity theft and financial loss, something that can take years to recover from.
The Scope of this Scam
Our scam investigations team has found over 300,000 fake USPS scam websites and we’re still counting. We expect the number of these websites to be in the millions.
The truly terrifying part is that this type of scam operation is relatively low effort, costs next to nothing to run, and has a high enough success rate to make it worthwhile to scammers. They can spin up these convincing fake websites so quickly and pay pennies to send scam emails or text messages with the link to thousands of people. All it takes is one unsuspecting person to make it worth the effort.
Getting these websites taken down is a job in itself. It’s like whack-a-mole, and as soon as one is taken down, another pops up in its place. The good news is that there are some simple things you can do to protect yourself and your loved ones from these scams.
Protecting Yourself from USPS Scams
Always verify first. Take an extra moment to verify the legitimacy of any message you receive, especially if it’s unsolicited. Check the sender’s phone number or email, the link (don’t click it – check for added characters, misspellings, and beware of short links), and in the case of USPS scams, the tracking number if provided in the message.
Remember, you have to opt in to receive update messages for a package. USPS does not automatically do this and will never send you unsolicited text messages.
Authentic USPS tracking phone numbers are five-digit short codes. If the text comes from a personal, 10-digit phone number or an email address, it’s probably a scam.`
If the text message you receive has a tracking number, you can check on the USPS tracking website. If the tracking number from the text doesn't appear on the USPS website, then it’s a scam.
Never open links or attachments in unsolicited messages. Links in scam messages can lead to phishing websites or even contain malware that can compromise your device. If you don’t know the sender, don’t click the link.
Talk about it. Talk to someone you know about these scams and how they work. The more people who know, the fewer victims there will be. Tell your friends, tell your family, tell your cousin’s next door neighbor’s best friend’s cat! Teach them not to click on links in unsolicited messages.
It’s impossible to know the ins and outs of every scam that exists, but by familiarizing yourself with the tactics scammers use, you can learn to quickly spot a scam situation.
Reporting a USPS Scam
If you do get one of these text message scams, you can report it directly to the United States Postal Inspection Service (USPIS). Screenshot the message, then block the sender. Report it to the USPIS by emailing spam@uspis.gov and include the screenshot with the scammer’s number as well as the date sent. You can also forward the text to 7726.
How Seraph Secure Helps
Scams like this are exactly why we built Seraph Secure. Our advanced AI and forensic tools, paired with a dedicated team of scam investigators, are designed to detect scams, block suspicious websites, and protect you from becoming a victim. The Seraph Secure team isn’t just fighting back – we’re committed to helping people stay a step ahead of the scammers and putting an end to these scams to make the online world a safer place for everyone.
After all, the USPS’s unofficial motto, “Neither snow nor rain nor heat nor gloom of night stays these couriers from the swift completion of their appointed rounds,” may be mostly true – unless you don’t actually have a package and the message you got was a scam.
Stay sharp, stay safe, and as always, don’t click that sketchy link.
– The Seraph Secure Team
