Is the "package delivery" text a scam?

What it looks like

A real example, anonymized.

      [USPS] Your package cannot be delivered due to incomplete address information. Please confirm your address within 24 hours to avoid return-to-sender: usps-redelivery[.]top/confirm
    

Variations swap in DHL, UPS, FedEx, Royal Mail, An Post, Canada Post, Australia Post, La Poste, DPD, Hermes, Evri. The structure is always the same: urgency, a small fee or "confirmation", a link you have never seen before.

Red flags

How to spot it in five seconds.

You were not expecting a package, or the message arrives the same day for "yesterday's delivery". Scammers spray these texts to millions of phones, hoping a few recipients happen to have an open order.
The link is not the courier's real domain. The real USPS is usps.com. Real DHL is dhl.com. Real Royal Mail is royalmail.com. Scam links look like usps-redelivery.top, dhl-pay.com, track-rm.help, or use a shortener.
The fee is suspiciously small. $1.99, £1.50, €2.99. The amount is too low to seem like a fraud target. The real goal is to capture your card details.
The grammar is slightly off. "Your package can not be delivery". "Please to confirm". "We are sorry but for inconvenience". Couriers send millions of texts a day and have professional copy editors.
Urgent deadline. "Within 24 hours", "or the package returns to sender". Real couriers re-attempt delivery, leave a card, and email or call. They never demand action within hours by text.
Sender is a long number, a random short code, or an email gateway. Real courier texts come from short codes the company has registered. If the sender is a regular phone number from a strange country code, it is a scam.

What to do

Do this instead.

If you are expecting a real package, open the courier's official app or website yourself by typing the URL. Use the tracking number from your original order confirmation. Never the link in the text.
Forward the text. In the US, forward to 7726 (SPAM). In the UK, forward to 7726 as well. Most carriers route these to a fraud team.
Delete the message after forwarding. Block the sender if your phone allows it.
If you already clicked the link but did not enter any details, you are likely fine. Close the tab. Run your phone's malware scan if you have one (rare for iPhones).
If you entered card details, call your bank's fraud line now (number on the back of the card) and have them block the card and issue a new one. Then change the password on any account you used the same credentials for.

What not to do

Never do this.

Do not click the link to "see what it says". Some scam pages collect data the moment they load (your IP, your browser, sometimes more). Most ask you for card details on the next screen.
Do not call any phone number in the message. Scammers run fake call centers as a backup if the link gets blocked.
Do not reply with "wrong number", "stop", or anything else. Replying confirms your number is active and you go on a "responder" list that gets sold to other scam operations.
Do not pay any fee, no matter how small. Real customs fees in the US, UK, and EU are collected by the courier at delivery, by the postal service at pickup, or shown in your order checkout, never by surprise text.

Quick questions

FAQ.

I really am expecting a package right now. How can I be sure?

Open your order confirmation email or the merchant's app (Amazon, eBay, the brand's own site). Take the tracking number from there. Then type the courier's official URL into your browser yourself (usps.com, dhl.com, etc) and paste the tracking number. If the real tracking page shows your package is moving normally, the text was a scam. If the real page shows a delivery problem, the courier will tell you in their own app, with no surprise fees.

I clicked the link but did not enter anything. Am I in trouble?

Almost always no. Modern phones sandbox the browser, so just visiting a scam page does not install anything. The scam needs your card or password to monetize you. Close the tab. If you are on Android, you can run Play Protect (Settings → Security → Google Play Protect → Scan). On iPhone, just close Safari and clear history.

How did they get my number?

They did not, specifically. Scammers buy phone-number lists from past data breaches (LinkedIn, Facebook, T-Mobile, hundreds of others) or generate numbers in bulk. The text is sent to millions at once. You are not personally targeted, which is also why the message is generic.

Got a different message?

Check your exact text. It takes 5 seconds.

Free, no signup, nothing stored. Works for SMS, email, WhatsApp, links, and screenshots in 10 languages.

Check my message →

More scam guides

Is the package delivery text a scam?