USPS scams are still on the rise. According to the US Federal Trade Commission (FTC), the number of text scams is rising, with the most common being shipping and package scams. The spoofing of USPS is common due to the expectation and legitimacy of the communication.
Now, the risk has evolved. Newer scams in 2025 or in 2026 vary from previous scams in that they leverage new techniques like generative artificial intelligence (AI) text scams, QR code scams, and tariffs or customs duties scams when shipping from overseas. The typical USPS scam text these days is related to the USPS scam email, the USPS tracking scam, and other USPS scam methods that ultimately seek to obtain your personal or financial data.
In this article, you will find information on how these scams operate, how to identify a USPS scam text (or USPS phishing email), and how to be ready and respond to them.
How USPS scams work
Most USPS scams follow a common pattern. You receive a text message or email claiming that there’s an issue with your package (for example, attempted delivery, undelivered mail, or wrong address). This message is an urgent one and includes a link or a call to action.
When you click on the link, you are directed to a website that appears identical to the USPS website. In reality, it’s a fraudulent copy. These fake sites collect information such as your name, address, date of birth, or credit card number.
The data can be used to steal your identity for fraud or to be sold on the dark web. These sites can also run code that is malicious. To remove malware, you will need a security tool or AV/antivirus software.
Detect USPS scams
Keep in mind that USPS will only send you text messages if you have agreed to receive them ahead of time. Also, they use 5-digit shortcodes, and there won’t be any suspicious links.
Types of USPS scams (with real examples)
Scammers use fake USPS notifications to steal personal and financial information. Here are the most common schemes and how to spot them.
USPS text message scam (smishing)
The USPS text message scam, or USPS smishing, remains the most successful type of scam. When you get a USPS smishing text, it usually says you have a package that is delayed, has been returned, or is undeliverable. In most cases, this text asks you to click on a link. Smishing now accounts for 35% of all phishing scams and grew 40% over 2025, as users are almost 3 times as likely to fall for links in text messages in their inbox than ones in their email.
These scams are also referred to as USPS tracking scam text messages, as they look like legitimate tracking notifications. However, USPS never sends unsolicited text messages with tracking links to click.
Fortunately, the right tool can identify a scam based on telltale signs. Moonlock’s Scam Detector looks for the common signs of phishing and manipulation, such as a sense of urgency, suspicious requests, or mismatched details, and can flag a message based on how likely it is to be malicious. Start your free 7-day trial to see how Moonlock keeps you protected from potential scams.
USPS scam email
These scams are not limited to SMS; sometimes, criminals send out USPS phishing emails with similar messages designed to make recipients panic and click on links. Some of these links will take you to malicious websites laced with malware.
Fake delivery or incomplete address
The standard USPS scam text message will claim an inability to deliver a package due to a wrong or incomplete address. The message often asks you to update the information within a specific time frame, or your package will be returned. You’re then given a link to a fake website that will steal your personal information.
Unless you have a USPS tracking account, this is likely a USPS scam.
Unpaid redelivery or postage fee
Many USPS scam text messages will state that you’re required to pay a small fee (typically between $1.99 and $3.00) to redeliver a package. The charge is kept small to make it seem reasonable and genuine. However, the text may contain a link that leads to a fraudulent website that requests your payment details. Once they have this information, they could use it to charge you fraudulently or sell the data.
Invalid ZIP code (2025 variant)
The US Postal Inspection Service recently issued an alert about a new scam that claims you will receive a USPS tracking message stating that your package cannot be delivered because of an invalid ZIP code. You’re then asked to click on a link to correct your address, which will lead to a scam website that will either try to steal your personal details or plant malicious software on your system. This is a major security risk, not only for your data but for your computer.
Customs or tariff fee scam (2025–2026 variant)
A recent USPS package scam involves international packages and claims that your item is being held because of unpaid customs duty, import tax, or tariffs due. The scam message will include a link asking you to make a payment to release the package, but the webpage is actually meant to steal your financial and personal information.
This scam is successful because customs fees can appear genuine, particularly with recent changes to shipping and import costs. The Federal Trade Commission notes that delivery scam texts may encourage you to click on links or make payments. USPS never asks for customs or tariff fees in unsolicited communications. This request should be regarded as a USPS scam text or a USPS email scam, and you should check the whereabouts of your shipment in the proper channels.
USPS phishing emails
USPS scams aren’t always sent via text messages. USPS email scams (also called USPS scam emails or USPS phishing emails) use the same tactics: fraudulent delivery notifications, failed package delivery notices, or suspended account warnings. Some have infected attachments, while others lead victims to credential-stealing pages. These email scams can reach a broad audience, unlike text message scams.
AI-enhanced USPS scams (2026)
The other major change we’re seeing in USPS scamming is the content of the emails. In fact, research conducted by IBM security researchers found that AI can create a full phishing campaign in only 5 minutes from just a few prompts, a task that once took human hackers 16 hours. This means that the USPS scam’s telltale signs, such as bad grammar and obvious typos, are no longer a guarantee.
AI-powered phishing messages are now written with proper grammar, authentic tone, and sometimes, personal details from previous data breaches, making USPS phishing email campaigns more difficult to spot.
Fake USPS phone calls (vishing)
USPS scams delivered over the phone are known as vishing scams. A scammer will call you, claim to be a USPS employee, say there’s a problem with a package, and request personal or payment information. They may already have some of your personal details, making them seem legitimate.
The rule: USPS doesn’t randomly call and ask for personal information. If you receive a call like this, hang up and report USPS phishing by sending an email to [email protected].
QR code scams on fake delivery slips (quishing)
This type of USPS scam starts at your front door. Fraudsters drop official-looking fake delivery slips with QR codes, asking you to scan and pay a small fee or reschedule a delivery. The code takes you to a fake website that will steal your personal data. And since the URL is hidden, you won’t know where it leads until it’s too late.
If you get a slip for a package you don’t expect, don’t use the QR code, just verify your tracking number at usps.com.
What happens if you click the USPS scam text?
The United States Postal Service does send out tracking links via SMS. Instead, legitimate messages utilize a 5-digit shortcode, and they only send them out to customers who have opted in to receive these types of alerts. However, even these messages never contain clickable links.
The link indicates that it is a USPS text message scam. If you click the link, you will be directed to a website where your device is infected with malware, or you will be asked for personal information, which will be used for identity theft or fraud.
How to spot a USPS scam
Using a security tool like Moonlock on your Mac will help stop scams before they occur. With Scam Detector, you can copy and paste suspicious messages to analyze them. Based on the likelihood that the message is a scam, Moonlock will recommend what action you should take to ensure your cybersecurity.
How to detect USPS scam text:
- Sign up for a free Moonlock trial and install the app
- Copy and paste the suspicious message into Moonlock’s Scam Detector
- Click “Check”
- Moonlock will analyze it and tell you if it’s likely a scam
- If the risk is high, you’ll get guidance on how to respond
Red flags of USPS scam texts
The telltale sign of a USPS scam text is a clickable link. USPS never sends tracking texts with clickable links. If you receive one in an email that claims to be from the USPS, stop right there.
Here are some additional signs of a USPS scam text to look out for:
- Sender format: USPS text messages are sent from 5-digit shortcodes (such as 28777), not 10-digit phone numbers or untrustworthy international codes.
- You didn’t sign up: Unless you’re expecting an update about a package you’re tracking, there should be no legitimate USPS message in your inbox, and unsolicited emails are by definition suspicious.
- Fake URLS: USPS links point to usps.com. Scammers use similar domains: usps-track[.]com, uspsdelivery[.]net, sometimes with random strings added at the end. Links are trickier to see on mobile; instead of tapping the link, hold down on it to display the URL.
- Spoofed email addresses: For phishing emails in particular, look at the domain sending the email (not just the display name). Support@usps-notifications[.]com is not the USPS.
- Pressure tactics: “Reply within 24 hours or we will send your package back” is a scare tactic. And although AI has mostly put a stop to the “bad grammar = scam” rule, awkwardly worded messages or generic salutations (“Dear Customer”) are still telltale signs to watch out for.
Real-life examples of USPS text scams
There are dozens of real-life examples of the USPS text scam. For example, 13 Action News in Toledo, Ohio, reported a scam where criminals claimed a delivery had arrived at the warehouse but needed more accurate delivery address information. The text message requested that the user click the link and enter information.
The AARP has also warned seniors about various USPS text scams, offering the advice of never clicking the link or entering information into a website you don’t know.
IT services and cybersecurity companies use social media to inform and warn clients about these types of scams.
How to report USPS scam texts
If you receive a USPS scam text, you should immediately report it to the United States Postal Service. To do this:
- Do not click the link; copy and paste the entire text into a new email.
- Take a screenshot of the email and add your name and a message to the USPS to inform them of the scam. Be sure to include the phone number the text message came from and the date/time.
- If you clicked the link, provided any sensitive information, lost money, or lost control of an account, include that information also.
- Send the email to [email protected].
The USPS will contact you if they need more information. You can also forward the text message to 7726 to help your wireless provider identify the sender as a potential scammer. You also may want to report any fraud or identity theft to the Federal Trade Commission.
What to do if you already clicked a USPS scam link
If you did click the link, it’s not the end of the world, but you need to act fast. The most important thing: don’t fill anything out on the page you ended up on, even if it looks 100% legit. Close it. Then follow these steps:
- Scan for infection: Moonlock’s Malware Scanner can help find threats that may have breached your device when you clicked on the link. And with real-time threat detection, any malware that is detected will be moved to Quarantine, where you can review it and delete it.
- If you entered payment information: Contact your credit card issuer or bank immediately to put a stop on your card and dispute the charges. Don’t wait to see if you get charged—take the initiative.
- If you entered a password: Change your password immediately, and if you use that password on any other platforms, change it there as well. Then turn on 2-factor authentication (if you can).
- Report it: Forward the text to 7726 (notifies your carrier about the scam) and email the entire message (including the scammer’s number and when you received it) to [email protected].
- Report a scam: If you paid money or think your identity has been stolen, report the incident to the FTC at ReportFraud.ftc.gov and to IdentityTheft.gov.
Important: If you’ve clicked on a possible phishing link, monitor your bank and credit accounts for the next 30 days, as scammers may hold stolen data for a while.
Ways to avoid USPS scams
As troubling as these scams are, the best way to avoid them is to follow cybersecurity best practices. The following are some tips to avoid falling prey to USPS scams.
Block unknown numbers
Block any suspicious numbers that send you scam messages or unwanted advertisements.
Never click links in texts
If you receive a text from an unknown number claiming to be the USPS, report it, but do not click any links. Save it in case the USPS needs more info.
Do not give out personal information
Never give out personal information like your phone number, date of birth, driver’s license ID, social security number, or physical address to someone you don’t know who asks for it.
Create stronger passwords
Create long, strong passwords for all your accounts. Use a password vault to store them in and keep them all safe.
Use 2FA and MFA
Turn on 2FA and MFA for any account that offers it for an additional layer of security.
Secure your social media accounts
Social media accounts don’t always have the highest level of security settings enabled by default. Secure your social media accounts by enabling these settings for as much privacy as possible.
Cybercriminals continue to evolve their methods using every tool at their disposal. You must be diligent in learning how to spot fake messages and deal with them properly to keep yourself and others safe from theft and fraud.
