What Is Smishing And How Does It Target Holiday Shoppers
Check holiday delivery texts without clicking links by using the store or carrier app instead.
Smishing is phishing by text message, where criminals pose as trusted senders to steal passwords, card numbers, or personal data. For holiday shoppers, it often arrives as a fake shipment or missed-delivery text that urges a quick click on a link. Shoppers face added pressure in November and December because they expect many packages and short sale windows.
A quick tap can expose personal details or install harmful software on a phone.
Verification note: Program terms and availability can change. This page was checked against linked sources on November 03, 2026.
How does the delivery text trick work?
The U.S. Postal Inspection Service explains that USPS sends tracking texts only after you requested updates for a specific package, as described in its Identity Fraud guidance. An unexpected text with a link about a delivery problem does not fit that pattern.
Leave the link untapped. The holiday version often asks you to reschedule delivery, according to Federal Trade Commission holiday shipping guidance in its shipping notification comment page. That click can lead to a form that harvests personal details.
It can also install malware on a phone or computer.
What other holiday messages should you pause on?
The Cybersecurity and Infrastructure Security Agency says holiday criminals also use too-good-to-be-true deals, fake charities, and messages built to look like retailers. Those messages may carry harmful links or request personal and payment details. The FBI Cleveland office lists related holiday frauds affecting shoppers: fake shopping sites, bogus delivery notices, gift-card payment demands, and social-media posts offering vouchers or gift cards that lead to surveys collecting personal data.
A short bargain post can be a data harvest rather than a saving.
How common are these text tricks?
Consumers reported losing $470 million to scams that started with text messages in 2024, more than five times the 2020 level, according to the Federal Trade Commission in its 2024 top text scams data. Fake package-delivery problems were the most-reported text scam type that year. Those dollar totals still understate harm because many frauds go unreported.
Treat each unexpected delivery text as suspect, even during weeks when friends report the same message.
How can you check an order without clicking?
Federal Trade Commission and Postal Inspection Service guidance urges shoppers to verify orders only inside the carrier or store app or site you open yourself. Type the address or open the app from your home screen, then check tracking there. Use these steps for an unexpected text:
- Stop before you tap the link or reply.
- Open the store or carrier app yourself to check the order.
- Forward the scam text to 7726 (SPAM).
- Send USPS smishing to [email protected] and report fraud at ReportFraud.ftc.gov.