A text from "USPS", "FedEx" or "DHL" saying a package couldn't be delivered and asking you to update your address or pay a small redelivery/customs fee via a link is a classic phishing scam. It works because most of us are genuinely expecting a package. The goal is your card details.
Common variants, always with a link: "USPS: your package could not be delivered due to an incomplete address. Update here: [link]" "A customs fee of $1.99 is required to release your parcel: [link]" "FedEx: delivery attempt failed. Reschedule and confirm details: [link]" The link opens a fake copy of the carrier's site asking for your address and then your card.
• The link isn't the official carrier domain (usps.com, fedex.com) but a look-alike or shortened URL • A tiny "customs"/"redelivery" fee of a dollar or two • Urgency: "within 24 hours or it will be returned" • Asks for full card details via a link • No real tracking number, or one that doesn't exist on the official site • Comes from a random mobile or international number
Carriers show delivery issues inside their official app or site, tied to a tracking number you can verify — and real customs fees are paid after identifying yourself, not on an anonymous page. Unsure? Open the carrier's official app yourself, or type the address manually, and check the tracking number from the store you ordered from.
1. Don't tap the link. 2. Paste the message into the free Phishy check on this page. 3. Check the tracking number from the seller (not from the text) on the official carrier site. 4. Entered your card? Freeze it (number on the back) and review transactions.
No. Real fees are paid on the official site or app after identifying yourself, with a verifiable tracking number — not via a text link with a tiny amount.
Check the tracking number the store gave you (not the one in the text) on the carrier's official site.
Paste it into the Phishy check on this page — an answer in seconds.