Short answer: Do not tap the link in an unexpected "missed delivery" or "package on hold" text. Open the carrier's own app or website, or the retailer's order page, and check there. If you already tapped or entered card details, call your bank using the number on your card, then change any password you typed in.
Last reviewed: October 25, 2026.
Key takeaways
- A real carrier does not need you to click a text link to prove a delivery exists. Check the parcel from the carrier app or the store's order page.
- The Postal Inspection Service asks people to forward suspicious USPS texts to spam@uspis.gov and delete them. If you did not request a tracking text, treat any link in it as suspicious.
- Canada Post says it does not send unsolicited messages asking for card numbers, account details or passwords, and will not charge you to track or release a delivery.
- If you tapped the link, it is sensible to tell your bank, especially if you typed anything. If you entered card details, treat the card as compromised.
- Forward the text to 7726 where your network supports it, then delete it and block the sender. Official reporting channels per country are listed below.
Why this scam spikes before the holidays
From November to January almost everyone is expecting a parcel. That makes a vague "we could not deliver your package" message believable even to careful people. The scammer does not need to know what you ordered. They only need you to be waiting for something.
We have not verified a specific 2026 holiday statistic from a primary source, so we will not quote one. The pattern itself is documented by postal services and regulators, and the advice below comes from their own pages (fetched October 25, 2026, where noted).
This guide is a practical response plan. For the wider concept of SMS phishing, see our explainer What is smishing. Here we focus on delivery texts only: what they look like, what each carrier says it will never do, and exactly what to do next.
What the fake texts usually say
These are typical patterns, written as composites rather than copies of any one campaign. Wording changes weekly, but the structure stays the same.
| Pattern | Example wording | What the scammer wants |
|---|---|---|
| Address problem | "Your parcel could not be delivered because the postal code is invalid. Confirm your address here." | Your name, address, then card details for a small "redelivery fee" |
| Small fee | "A customs/redelivery fee of a few dollars is due before we can release your package." | Card number, expiry and security code |
| Package on hold | "Your package is on hold. Reschedule within 24 hours or it will be returned." | Urgency, so you tap without thinking |
| Tracking update | "Tracking update: action required for parcel 00000000." | A tap on the link, then a login or card form |
| Reply to activate | "Reply Y to enable the link." | Confirmation that your number is active, plus a way around phone link filters |
Canada Post's own guidance (fetched October 25, 2026) describes a similar set of tells, including generic greetings such as "Dear Customer", urgency, links that do not point to a legitimate Canada Post page, and tracking numbers that do not match its format.
Red flags you can spot in ten seconds
- You were not expecting anything, or the message names no retailer and no item.
- A link to "confirm", "reschedule" or "pay". A real carrier notice does not hinge on this.
- The sender is a random mobile number or an email-to-text address rather than a short code you recognise.
- A deadline such as "within 24 hours".
- A web address that is not the carrier's own domain. Look at the part just before the first single slash. A carrier name stuck inside a longer address is not the carrier.
- A request for any payment to release or track a delivery.
What each carrier says it will and will not do
These statements come from the carriers' own pages where we could read them. Where we could not, we say so rather than guess.
| Country / carrier | What the carrier says | Source status |
|---|---|---|
| US, USPS (Postal Inspection Service) | Tracking texts or emails are sent only after you request tracking with a tracking number, and they will not contain a link. USPS does not charge for these services. | Fetched from uspis.gov, October 25, 2026 |
| Canada, Canada Post | Does not send unsolicited messages asking for card numbers, account details or passwords, and does not charge to track or release a delivery. When delivery is attempted it leaves a notice card, not an email. Its SMS short codes are listed as 272727 and 55555. | Fetched from canadapost-postescanada.ca, October 25, 2026 |
| Australia, Australia Post | Reported as saying it will never call, text or email asking for personal or financial information such as passwords or card details, and advising you to check its app first. | Reported in news coverage found by search; we could not open the primary page. Confirm on auspost.com.au |
| UK, Royal Mail | We could not open Royal Mail's scam page (access blocked). Read its current scam guidance directly before relying on any specific rule. | Not verified |
Notice what is missing from every list: none of them says a carrier will ask you to enter card details through a link in an unexpected text.
Step by step: what to do when the text arrives
- Do not tap, do not reply. Even a reply of "STOP" confirms your number is live.
- Check the parcel the safe way. Open the carrier app or type the carrier's website into your browser yourself. If you bought something, open the store's own order page or email.
- Compare. If the carrier or store shows no pending delivery, the text is fake.
- Report it (see the country list below).
- Delete the message and block the sender.
If you already tapped the link
Tapping alone is usually less serious than typing into the page, but do not assume nothing happened. If you interacted with the link, it is sensible to notify your financial institution.
- Close the page. Do not enter anything further.
- Do not install anything the page offers, such as a "tracking app" or "security update". If a file was downloaded, do not open it.
- Call your bank using the number printed on your card or on your bank's official site, not a number from the text.
- Change passwords for anything you typed in, starting with email. If your email is compromised, attackers can reset everything else. See email account hacked recovery.
- Update your phone to the latest system version and run its built-in security scan.
Not sure what is wrong? Get a diagnosis first.
Our certified tech can connect remotely, check your software, drivers and backups, and tell you honestly whether the problem needs a hands-on repair.
If you entered card details, a one-time code or a login
Move fast. Work through this list in order.
- Call the card issuer immediately and say you entered your card number on a fake delivery page. Ask them to block and reissue the card and to review recent charges.
- Do not share one-time codes. A text that arrives right after you entered card details, asking you to read out or confirm a code, may be the scammer approving a purchase with your card. Tell your bank the code was requested.
- Turn on card transaction alerts in your banking app.
- Change the password of any account whose login you typed, and turn on two-factor authentication using an authenticator app where possible.
- Watch for follow-up contact. People who hand over details are sometimes called by a fake "bank fraud officer". Hang up and call the bank yourself. Our guide on tech support scam warning signs covers the same call-back trick.
- If identity details such as a date of birth or ID number were entered, follow our identity theft recovery guide.
Back up anything important before running cleanup on a device. Removing a suspicious profile or app is reversible only if you know what you removed.
How to report a fake delivery text, by country
| Country | Where to report | Verified? |
|---|---|---|
| US | Email spam@uspis.gov with the text body (no link), a screenshot showing the sender number and date, and whether you clicked or lost money. For non-USPS texts, report to the FTC at reportfraud.ftc.gov and to the FBI's IC3 at ic3.gov. | Yes, from uspis.gov, October 25, 2026 |
| Canada | Forward spam texts to 7726. If you believe you are a fraud victim, contact the Canadian Anti-Fraud Centre through its online report form at reportcyberandfraud.canada.ca. Canada Post says you do not have to report to it. | Yes, from canadapost-postescanada.ca, October 25, 2026 |
| UK | Report through Royal Mail's scam page and the national fraud reporting service for your nation (historically Action Fraud, which has been changing its name, so confirm the current service). Many UK networks accept forwarded spam texts on 7726; ask your network. | Not verified, confirm on official sites |
| Australia | Report to Scamwatch (scamwatch.gov.au) and tell your bank if you lost money. Australia Post advises checking its app before acting on a message. | Partly, via news coverage; confirm on scamwatch.gov.au |
Phone steps: report and block
Menu names change between versions, so look for the nearest equivalent if yours differs.
iPhone
- Open the message. Do not tap the link.
- If the message came from an unknown sender, look for a Report Junk option under the message. This sends it to Apple and your carrier where supported.
- To forward to 7726, touch and hold the message bubble, choose Copy, then paste it into a new message to 7726.
- Tap the sender at the top, then the contact info, then Block this Caller.
- Optionally, in Settings, open Messages and turn on Filter Unknown Senders.
Android (Google Messages)
- Open the conversation without tapping the link.
- Open the three-dot menu and choose Block & report spam, or Report spam, depending on version.
- Press and hold the message, choose copy, and paste it into a new message to 7726 if you want to notify your network.
- Check that spam protection is switched on in the Messages settings.
Other Android messaging apps differ. If the app has no report option, block the number and forward to 7726.
Common mistakes
- Calling the number in the text. It reaches the scammer.
- Replying "STOP". It confirms your number is active.
- Paying a "small" fee. The fee is the card theft.
- Assuming a message in a genuine thread is real. The ACMA reportedly warns that scam texts can appear among legitimate past messages from a postal service, according to news coverage we could not trace to a primary page.
- Not telling the bank because "nothing happened". If you tapped the link, it is sensible to tell your institution.
How to avoid it next time
- Save your carriers' official app or website as a bookmark and use only that.
- Track purchases from the store's order page.
- Use a virtual or low-limit card for online shopping if your bank offers one.
- Keep your phone and apps updated, and consider two-factor authentication on email first.
- Warn family members. Older relatives and teenagers are common targets.
If you tapped a link and want a technician to look at your device with you, our remote repair service can walk through it. For PC-side cleanup, see Windows support.
Frequently asked questions
Is tapping the link in a fake delivery text enough to get hacked?
Usually the main risk is the page you land on asking for card or login details, not the tap itself. Still, if you interacted with the link, it is sensible to contact your financial institution and update your phone.
Should I trust a link in a delivery text?
The Postal Inspection Service asks people to forward suspicious USPS texts to spam@uspis.gov and delete them. If you did not ask for a tracking text, treat any link in it as suspicious and type the carrier's web address yourself.
What if I really am expecting a package?
Check it in the carrier's app, on its website typed by hand, or on the store's order page. If those show nothing wrong, ignore the text.
Does Canada Post text about deliveries?
Canada Post says it will not request card details, logins or payments by text, and leaves a notice card when a delivery is attempted. Check tracking on its website or app.
What does 7726 do?
Canada Post tells people to forward spam texts to 7726 so the phone provider can flag or block the number. Availability varies by network.
I entered my card number. What is the first call?
Your card issuer, using the number on the back of the card. Ask them to block and reissue the card and review charges.
Should I factory reset my phone?
Usually not if you only tapped a link and installed nothing. If you installed an app or profile you do not recognise, back up your data first and get help before resetting.
Can I get my money back?
Often card issuers can reverse unauthorised charges, but outcomes vary by bank and country. Report quickly and keep screenshots.