Should You Click That Holiday Package Tracking Link?

No. If a text about a holiday package arrives and you did not personally sign up for tracking on that specific shipment, do not tap the link — open the retailer's or carrier's own site in a new browser window instead. The link is the tell, not a detail to inspect.

Fake package-delivery texts were the single most-reported text scam in the Federal Trade Commission's 2024 complaint data, according to the FTC's text scam data release. That matters most in November and December, when almost everyone genuinely has packages in transit and a delivery problem sounds plausible.

Verification note: Program terms and availability can change. This page was checked against linked sources on November 13, 2026.

Why the link itself is the warning sign

The U.S. Postal Inspection Service, the law-enforcement arm of USPS, states in its guidance on package tracking text scams that a genuine USPS tracking text contains a tracking number and no link at all. It also states that if you did not first request tracking for a specific package, a USPS-branded text carrying a link is smishing — phishing delivered by SMS.

That gives you a single rule you can apply in two seconds, without reading the message closely. A link in an unrequested delivery text is the problem. You do not need to judge the wording, the sender number, or the look of the page it opens.

The FTC adds that the real USPS never contacts customers out of the blue about a delivery and never demands payment to redeliver a package.

What happens after the tap

The FTC describes the mechanism in its spotlight on top text scams: the text carries a fake tracking code and a link to "update delivery preferences," which opens a page imitating the real USPS site. Many people who reached that page paid a small "redelivery fee." The fee existed only to capture card numbers, and in some cases a Social Security number. The small amount is the point.

A $1.99 or $3 charge reads as a nuisance rather than a loss, so the card details go in with less hesitation than a larger request would get. Consumers reported losing about $470 million to text scams in 2024 — five times the 2020 total — even as the number of reports fell, per the same FTC data. Fewer reports with far higher losses means each successful attempt is now extracting more money.

What the carriers themselves say they will and will not send

The pattern is not specific to one carrier. The Federal Communications Commission's package delivery scam guidance describes the same generic shape across carriers: the message claims a delivery is delayed and pushes a tracking link to update delivery or payment preferences. Each carrier publishes its own limits, and they are worth knowing because the exception matters: That FedEx exception is the only carrier-acknowledged case where a payment link can be real, and it applies to international shipments with duties owed.

Even then, the verification happens through the Import Tool, not the message.

• **USPS** — per the Postal Inspection Service, legitimate tracking texts carry a tracking number and no link, and only after you request them.
• **UPS** — states in its fraud guidance that it never requests payments, personal or financial information, account numbers, IDs, or passwords in an unsolicited manner, and tells customers unsure of a text to avoid its links, which may carry malware, and open a new browser window to ups.com instead.
• **FedEx** — states in its fraud prevention page that it does not request payment or personal information by unsolicited call, mail, text, or email for goods in transit, and currently flags scam texts pointing to `.shop` URLs. Its one legitimate exception is a secure link for international duties and taxes, which you can verify separately in the FedEx Import Tool.

Why "it looked legitimate" is not a defense anymore

The old advice was to watch for typos and clumsy grammar. The FBI, in its holiday scam advisory, warns that modern phishing messages are generated without spelling or grammar errors, so typo-spotting is no longer a reliable defense. The bureau's alternative is the same as the carriers': request tracking numbers directly from sellers rather than trusting inbound notices.

The direction of the contact is the signal — not its polish. Applied to a holiday order, that means going back to the confirmation email you already have, or logging in to the store account where you placed the order, and reading the tracking number there. If the delivery problem is real, it will show up in both places.

If you already tapped it

Tapping a link is not the same as losing money, and the response depends on how far it went. The Postal Inspection Service and the FTC set out the reporting path: The last step is the one people skip. Call the number on the back of your card — not a number from the message — and tell them what happened, so a later charge is already on record as disputed rather than something you have to explain from scratch.

If you entered a card number, ask for a replacement card rather than only watching the statement. If you entered a Social Security number, treat it as exposed and consider a credit freeze with each of the three bureaus directly.

• Forward the text to 7726 (SPAM) so your mobile carrier can block similar messages.
• Email USPS-branded ones to [email protected].
• File a report at ReportFraud.ftc.gov, or at IC3.gov for the FBI.
• Notify your bank or card issuer even if you submitted nothing.

Frequently Asked Questions

I have six packages coming. How do I check a real delivery problem without using the text?

Open a new browser window and go to the retailer's site or the carrier's site directly, then enter the tracking number from your order confirmation. UPS gives this exact instruction for texts customers are unsure about.

Is a text with a tracking number but no link safe?

The Postal Inspection Service describes that as the shape of a genuine USPS tracking text — but only if you requested tracking for that specific package first. An unrequested one still deserves a check through the carrier's own site.

Can a delivery company ever legitimately ask me to pay through a link?

FedEx names one exception: a secure link for international duties and taxes. It says that case can be verified separately in the FedEx Import Tool, so you never have to rely on the link to confirm it.

Why do these texts spike around the holidays?

Volume. A delivery-problem claim only works if the target is plausibly expecting a package, and in December nearly everyone is — which is why fake delivery texts were the most-reported text scam in the FTC's 2024 data.