What To Do If You Clicked A Fake Delivery Link
Clicked a fake delivery text? See what to lock down first, who to call, and where to report it.
If you clicked a fake delivery link, close the page right away and do not type, download, or reply further. Then secure any password, payment, or personal details you already entered and report the message. Smishing is a text that pretends to be a package notice to steal logins or payments.
Unexpected delivery texts with links deserve a pause, because the U.S. Postal Inspection Service says USPS does not send unsolicited texts with links and sends tracking texts only after you ask for updates on a specific package, as explained in the U.S. Postal Inspection Service smishing guidance.
Delivery-text reports led to about $470 million in reported U.S. losses in 2024, according to AARP citing FTC April 2025 data.
Verification note: Program terms and availability can change. This page was checked against linked sources on November 02, 2026.
Did you tap, reply, or enter anything?
Start by stopping all contact with the message. Do not tap again, reply, call a number in the text, or forward the link to friends. Open your carrier app or type the carrier website address yourself to check tracking.
Use the pause to note what happened. Did the page load only, ask for a login, ask for payment, or start a download? Your next steps depend on that answer.
Keep the message until you finish reporting, then delete it.
Clicked but shared nothing?
Close the browser tab and delete the text. Do not install files, grant permissions, or enter contact details to "reschedule delivery." Those extra steps can install harmful software or confirm your number. Next, update your phone system, browser, and security software, then run a security scan.
The Cybersecurity and Infrastructure Security Agency gives that cleanup advice for shoppers who click a suspicious link, as described in the CISA holiday-season shopper reminder. Watch for odd battery drain, pop-ups, new apps, or texts you did not send.
Did you enter a password or personal details?
Act fast if you typed a password on the fake page. Change that password right away, change it anywhere else you reused it, and turn on two-factor authentication. Use a unique password for email, banking, and shopping accounts.
If you shared a Social Security number, address, birth date, or ID details, make a recovery plan at IdentityTheft.gov. The Federal Trade Commission resource covers password changes, two-factor authentication, and recovery steps, as explained in the IdentityTheft.gov Know Your Rights page. Also place free credit freezes with Equifax, Experian, and TransUnion.
- Change the exposed password and other accounts that reuse it
- Turn on two-factor authentication
- Save the IdentityTheft.gov plan and keep freeze PINs in a safe place
Did you enter card or bank information?
Call your bank or card issuer at once using the number on the back of the card. Ask for a new card number, review recent charges, and dispute charges you did not approve. Do not use a phone number or link from the delivery text.
Ask what payment protections apply to your account. AARP, reporting FTC consumer guidance, advises quick issuer contact, replacement numbers, and disputes for unauthorized charges. Keep statements, screenshots, and confirmation numbers for each call.
How do you report the text?
Forward the message to 7726, which spells SPAM, so mobile carriers can study and block similar texts. Then report USPS impersonation through the Postal Inspection Service reporting portal and send other reports to ReportFraud.ftc.gov, as described in the FTC spam-text reporting guidance. If you lost money or shared financial details, also file a complaint with the FBI Internet Crime Complaint Center at ic3.gov.
That center collects cyber-enabled crime reports for law-enforcement databases, though it cannot answer every complaint. Reports do not promise refunds, but they help investigators track patterns.