crackthe.net
Package texts and smishing: how to spot them
"Your package is on hold" – the most common scam text there is. Here is how to spot it in five seconds, and what to do if you already tapped.
- Do not tap the link and do not reply.
- Check the shipment yourself – in the carrier’s app or through your order confirmation.
- Delete the message and block the sender’s number.
- Install no app the message tells you to install.
Smishing – phishing by text message – is the highest-volume scam there is. The reason is simple: almost everyone is waiting for some package, and a text feels more personal than an email. The trick still falls apart in seconds once you know where to look.
What the message looks like
- Short link on an unrelated domain: Not a real USPS address, just an invented domain. Real carriers do not shorten their links to names like this.
- Time pressure: "24 hours or it goes back" is there to make you tap before you think.
- A payment request: A tiny fee through a link looks harmless. What it really does is capture your card details. You never pay a real delivery fee through a text link.
The variants you will meet
| The pretext | Typical wording | What actually happens |
|---|---|---|
| Customs or delivery fee | “Settle the outstanding $2.99 fee” | Your card details are captured |
| Failed delivery | “We missed you, pick a new time” | Login or card details |
| Confirm your address | “Address incomplete, please update” | Data collection for the next scam |
| Install the app | “Install our tracking app” | Malware on your phone |
| Voicemail waiting | “You have a new voice message” | Subscription trap or data capture |
The warning signs in detail
Checked in five seconds
- Money through a link: real delivery and customs fees are paid to the carrier or at the door, never through a link in a text.
- A domain that is not theirs:
usps-parcel-redelivery.infodoes not belong to USPS. How to read that reliably: Check a link before you click . - Time pressure: “within 24 hours”, “or it will be returned”.
- No tracking number, or one that matches none of your orders.
- An unfamiliar sender number, often with an out-of-area or international code.
- Small language slips: an odd greeting, strange word order, missing punctuation.
The rule that always works
Check every shipment in the carrier’s app or through your order confirmation – never through the link in the message. If the shipment is real, it is there. If it is not, the text was fake. That single habit makes the entire scam useless.If you already tapped
The tap itself is rarely the damage. What matters is what came after:
- Only tapped, entered nothing: close the page, delete the text. Expect more spam to that number.
- Entered card details: call your card issuer and lock the card, then Credit card misused .
- Entered login details: change the password, end all sessions – see Account hacked .
- Installed an app: disconnect the phone and work through Phone hacked .
The full sequence is in Clicked a phishing link .
The scam at a glance
A text message claiming to be from a delivery company reports an unpaid customs fee or a failed delivery. The link goes to a copy of the real payment page.
How to recognize it
- A small fee you are asked to pay through a link
- A domain that is not the carrier's real address
- Time pressure: "within 24 hours or it goes back"
What to do right away
- Check the shipment in the carrier's app or through your order confirmation
- Delete the message and block the sender's number
What never to do
- Enter card details through a link in a text message
- Install an app the message tells you to install
Getting fewer of these
You cannot stop them entirely, but you can slow the flow:
- Block and report the number. Forward the message to 7726 (SPAM) – it is free and it feeds your carrier’s filters.
- Never reply, not even “STOP”. A reply confirms the number is live.
- Give out your cell number sparingly – not on every checkout form, and never publicly.
- Turn on message filtering: both Android and iOS can sort unknown senders into a separate list.
- Report it to the FTC at ReportFraud.ftc.gov.
How scammers get your number in the first place is covered in Check for a data breach . The other scams are in the scams overview .
Frequently asked questions
How do I recognize a fake delivery text?
Three things: a fee you are asked to pay through a link, a domain that is not the carrier’s, and time pressure. Real carriers do not collect fees through a text link and never ask for card details in a message.
I tapped the link but entered nothing. Did anything happen?
Usually not. The tap alone mostly confirms to the sender that your number is live, so expect more spam. It only gets serious if you entered details or installed an app.
Why do I get these when I have not ordered anything?
They are blasted out to whole blocks of numbers with no connection to real shipments. That one occasionally lines up with a real order is coincidence – and it is exactly what makes them work.