That "your package is held" text is a scam: how delivery smishing works
A text saying your parcel is stuck and needs a small "redelivery fee" leads to a look-alike courier page that steals your card and details. Here is how the scam works, the tells, and the free move that beats it.
A delivery-smishing text trades on a near-universal fact: most of us are waiting on some parcel. The message says yours is held, undeliverable, or needs a small fee — just tap the link to fix it. The link leads to a page dressed up as a real courier, and whatever you type there goes to the scammer.
How the scam works
The pattern is consistent, and it’s sent out in enormous volume:
- The hook. An unsolicited text claims to be from a courier like USPS or UPS: a package is on hold, a delivery failed, or there’s an address problem.
- The small fee. You’re pressured to act fast and pay a tiny “redelivery” or “customs” charge — often under a dollar — to release the parcel.
- The look-alike link. The link opens a phishing page that copies the courier, complete with logo and a plausible tracking number.
- The harvest. You “verify” your address and enter card details. The tiny charge is just bait — your card number, name, and address flow straight to the scammer, and bigger charges can follow.
The fact worth remembering: a genuine courier won’t text you an out-of-the-blue link demanding a fee. The US Postal Inspection Service is blunt that USPS won’t send a text with a tracking link unless you requested it first.
How to spot it
The tells are in the box below, but the short version is: an unexpected text + a link + a fee or “verify your address” = stop. Real deliveries don’t hinge on you tapping a text within the hour.
What to do instead
You don’t need to buy anything to beat this — the free move comes first (see the defense box). The habit that defeats nearly every fake notice is Go Direct: never act on a link a message sent you. Open the courier’s real app, or type the address yourself, and check there. The same habit beats QR-code “quishing” and fake refund texts. For more, see our defense moves and the 60-second quiz.
- An unexpected text with a link says a package is "held" and needs a small fee or "address verification" to release it.
- It pushes urgency — "respond now or your parcel is returned to sender".
- The link or sender doesn't match the courier's real website address (a random or look-alike URL, not one you typed yourself).
- Ignore the link. Track any real parcel in the courier's official app, or by typing its website address yourself from your order confirmation.
- Know the baseline: a genuine courier won't text you a random link demanding a small fee to release a package.
- Report it. In the US, forward spam texts to 7726 (it spells "SPAM"); USPS-themed ones can also go to spam@uspis.gov.
- If you already entered card details, call your bank to flag fraud and consider a new card, then watch for small "test" charges.
What makes these so effective isn’t cleverness — it’s timing and volume. We’re all expecting *something* in the post, so a 'your parcel is held' text catches almost everyone on a day when it happens to be plausible. My rule is boring on purpose: I never tap a tracking link in a text. If I might have a package, I open the courier’s app. It takes ten extra seconds and skips the trap entirely.
Sources
Frequently asked
How do I check if I really have a package waiting?
Don't use the texted link. Open the courier's official app, or type its website address yourself, and enter the tracking number from your own order confirmation. If the website and your order both say nothing is held, the text is a scam.
I clicked the link but didn't pay. Am I at risk?
Clicking alone is lower risk than entering details, but be careful: these links can lead to fake sites or attempt to load malware. Don't enter anything, close the page, keep your phone updated, and run a security scan if anything seems off.
It used a real-looking tracking number — isn't it genuine?
No. Scammers deliberately use look-alike pages with the courier's logo and a plausible tracking number to seem real. A convincing number proves nothing — verify only by going direct to the courier yourself.