“Package Pending”: Anatomy of the Smishing (SMS Phishing) Attack

Received a text about a failed delivery or a "pending" package? This is Smishing. Learn how to identify fake delivery alerts and protect your phone from malicious tracking links.

The Text Message That Never Ends

It is the most common scam of 2026: a text message appearing on your smartphone claiming that a package is “pending” or that a delivery has “failed due to an incomplete address.” Because so many people shop online daily, scammers play a numbers game, knowing that at any given time, millions of people are indeed waiting for a delivery.

This is called “Smishing”—a combination of SMS and Phishing. These messages are designed to create a sense of urgency, forcing you to click a link before you have time to think.

How to Identify a Smishing Text

While scammers try to mimic the branding of the USPS, UPS, FedEx, or DHL, there are several technical “tells” that reveal the fraud.

  • The Sender’s Number: Official delivery services use “short codes” (usually 5 or 6-digit numbers). If the text comes from a standard 10-digit phone number—especially one with an international area code—it is 100% a scam.
  • The Suspicious Link: Look closely at the URL. A real USPS link will always end in .com or .gov. Scammers use “link shorteners” or slightly misspelled domains like “https://www.google.com/search?q=usp-delivery-track.com” or “fedx-update.net.”
  • The “Redelivery Fee” Demand: Delivery services will never text you to ask for a small $1 or $2 redelivery fee. They will either leave a paper slip at your door or hold the item at a local facility. The “fee” is just a way to get you to enter your credit card number on their fake site.

What Happens if You Click?

Clicking the link usually leads to a highly convincing “tracking page.” Once you are there, the site may attempt to do one of two things.

First, it may try to install malware on your phone to steal your passwords. Second, it will ask for “verification info,” including your name, address, and credit card. Once you provide this, they don’t just take the $2 redelivery fee; they use your card for thousands of dollars in unauthorized purchases.

Steps to Take if You Receive a Text

  • Do Not Click: The safest thing to do is delete the message and block the sender.
  • Go to the Source: If you are genuinely worried about a package, open your browser and manually type in the official website of the carrier (e.g., ups.com) and enter your tracking number there.
  • Report the Scam: Forward the scam message to 7726 (which spells “SPAM”). This alerts mobile carriers to the fraudulent sender so they can block them for everyone.

Internal Link Suggestions for Article #4:

Share the Post: