Fake Package Delivery Texts: The Holiday Scam After Your Bank Login

"Your package could not be delivered due to an incomplete address. Update your details here." The text arrives the same week you have three gifts on the way, so it does not seem strange. That is exactly the point. Fake delivery texts are timed for the season when nearly everyone is expecting a package.

The link usually leads to a page that looks like a shipping company's site. It asks for a small redelivery fee, then your card number, and sometimes your bank login or a one-time code. What starts as a two-dollar fee can end with a drained checking account. Here is how the scam works and how to protect your money.

How the scam works

Scammers send mass texts claiming to be from the U.S. Postal Service, UPS, FedEx, or another delivery company. The message says there is a problem with a package, such as a missing address or unpaid fee, and includes a link. The goal is to get you to click before you think.

The fake page may ask for your name, address, and phone number, then a small payment by card. Once you enter your card number, scammers can use it or sell it. Some pages then ask for your online banking login or the one-time code your bank texts you, claiming it is needed to verify the payment.

With your login and code, scammers may be able to access your bank account, change your contact information, and move money. Some also install malware on your phone if you download something from the page. This is why a small fee request should set off alarms.

Red flags in the message

USPS says it will not send customers texts or emails without the customer first requesting the service with a tracking number, and those messages will not contain a link. Other carriers have their own policies, but none should ask you to pay a surprise fee through a random text link.

Look closely at the sender and the link. Messages from personal phone numbers or email addresses, links with strange spellings or extra words, and web addresses that do not match the carrier's official site are all warning signs. Urgent language, such as warnings that your package will be returned in 24 hours, is another.

If you did not sign up for text alerts from that carrier, treat any message as suspicious. If you did, compare it with earlier legitimate messages. Even then, it is safer to check tracking yourself than to click.

What to do instead of clicking

Go directly to the retailer or carrier. Open the store's app or website and check your order status. If you have a tracking number from your order confirmation, enter it on the carrier's official website, typed in yourself. If there is a real issue, it will show up there.

You can also contact the carrier using a phone number from its official website. Do not call any number in the text message.

To report the text, forward it to 7726, which spells SPAM, to alert your mobile carrier. You can also report it to the Federal Trade Commission at ReportFraud.ftc.gov. USPS-related scams can be reported to the U.S. Postal Inspection Service. Then delete the message.

If you already clicked or entered information

Act quickly. If you entered a card number, call the number on the back of the card and report it. Your bank will cancel the card and send a new one. Check for any charges you do not recognize and dispute them right away.

If you entered your online banking username, password, or a one-time code, contact your bank immediately through its official number. Change your password from a trusted device, and ask the bank to check for changes to your account, such as new payees, new contact information, or transfers.

If you downloaded anything, run a security scan on your phone or ask your carrier for help. Watch your accounts closely for several weeks. Consider placing a fraud alert or a credit freeze with the credit bureaus if you shared your Social Security number or other personal details.

Protect your bank login

Never share a one-time code with anyone who contacts you. Banks use these codes to confirm that you are the one logging in or making a change. A delivery company has no reason to ask for your bank code.

Turn on alerts in your banking app for logins, password changes, new payees, and large transfers. If someone gets into your account, you will know right away. Use a strong, unique password for banking and consider using an authenticator app or passkey if your bank offers it.

Do not log in to your bank from links in texts or emails. Use the app or type the bank's web address yourself. That one habit blocks many scams.

Talk to family members

Older relatives and teens are often targets. Many people are not aware that carriers do not send surprise fee texts. A quick conversation can protect them. Share a simple rule: never click on delivery links in texts, and always check tracking in the store's app or website.

Encourage family members to call you or a trusted person before entering any information in response to a text. Scammers rely on urgency. A short pause often breaks the spell.

If someone in your family falls for the scam, help them act quickly and without shame. Scams are designed by professionals, and anyone can be caught off guard during a busy season.

Other versions of the delivery scam

Delivery scams do not only come by text. Some arrive by email with fake tracking links or attachments. Others are phone calls claiming that a package is being held and asking for payment or personal information. Some scammers leave fake missed delivery notices on doors with a phone number to call.

Some scams target sellers instead of buyers. If you sell items online, a buyer may send a fake shipping notice or ask you to pay a fee to a shipping company. Legitimate buyers and carriers do not work this way.

Another version claims to be from customs, saying an international package needs a fee before it can be released. Unless you know you ordered from overseas and the carrier's official site confirms a fee, treat these messages as scams.

The rule is the same for every version: do not use the contact information in the message. Go directly to the official source.

If you are not sure whether a message is real, wait. A real delivery problem will still exist an hour later, and you can check it safely through the official app or website. Scammers count on people acting before they think.

The bottom line

Fake package delivery texts spike during the holidays because so many people are waiting for deliveries. The real target is often your card number or bank login, not a small fee. If a text claims there is a problem with a package, do not click. Check your order directly with the retailer or carrier.

Report scam texts to 7726 and the FTC, and act fast if you shared information. Protect your bank login by never sharing one-time codes and by turning on account alerts. These simple habits keep your holiday shopping, and your bank account, safe.