Smishing, SMS phishing, has exploded in recent years, and USPS-impersonation scams are among the most widespread variants globally.

As a cybersecurity professional, I can tell you these attacks are effective precisely because they exploit something real: people genuinely receive packages, and genuine delivery notifications are routine.

That normalcy is the attacker's greatest weapon.

Here's what's actually happening and what each red flag means in depth.

The Anatomy of a USPS Smishing Attack

These campaigns typically originate from organized cybercriminal groups, many based in Southeast Asia.

They purchase or scrape phone number databases, deploy automated SMS blasting tools, and route victims through convincing phishing landing pages that are often indistinguishable from the real USPS site — complete with logos, fonts, and even working navigation menus.

The fake pages are hosted on compromised or purpose-registered domains that rotate frequently to evade blocklists.

The goal is almost always one of two things: steal payment card data, or harvest personally identifiable information (PII) for use in identity fraud or sale on dark web marketplaces.

Breaking Down the 7 Red Flags

Here's what you need to look out for.

The Link Doesn't Go to usps.com

This is the single most reliable tell. Attackers craft domains using techniques like homograph attacks (replacing letters with visually similar Unicode characters), subdomain abuse (usps.com.malicious-site.net — the usps.com part here is just a subdomain label), or typosquatting (uspss.com, uspc.com).

Always expand any shortened URL with a service like unshorten.it before clicking, and check that the root domain — the last two parts before the first slash — is exactly usps.com.

Artificial Urgency

This is textbook social engineering. The attacker wants you to act on reflex, not reason. Deadlines of "12 hours" or "today only" are designed to suppress your critical thinking.

Take a breath. Legitimate postal services will hold packages for days and send multiple official notices.

A Fee Request of Any Amount

Even a $0.30 "customs fee" is a trap. The real objective isn't the 30 cents —it's your card number, expiry date, and CVV. Once submitted, that data is sold within hours. USPS does not collect redelivery fees via text message, period.

Unsolicited Tracking With no Matching Order

These texts are broadcast to millions of numbers at once. Scammers don't know who has a package, they're betting on statistical probability.

Always cross-reference any tracking number independently at usps.com, typed manually into your browser. Never use the link in the text.

Requests for personal information beyond what delivery requires. No postal carrier needs your Social Security number, mother's maiden name, or full date of birth to complete a delivery.

If a "USPS" page asks for these, you are on a credential harvesting site. Stop immediately, close the browser tab, and do not enter anything.

Grammar and Formatting Anomalies

USPS communications go through professional copywriting and brand review. Random capitalization, exclamation points, broken sentences, and awkward phrasing are hallmarks of machine-translated phishing templates.

Don't dismiss this signal just because the rest of the message looks polished — scammers are getting better, but errors still slip through.

The Sender is a Regular Mobile Number

USPS uses registered short codes (like 28777) or verified alphanumeric sender IDs. A text from a standard 10-digit number, an international number, or a number that changes each time is not coming from USPS infrastructure.

You cannot trust caller ID or sender numbers as a standalone proof of legitimacy — they can be spoofed — but a random number is a clear disqualifying signal.

What to Do if You Receive One

Don't click the link. Don't reply (replying confirms your number is active). Forward the message to spam@uspis.gov — that's the U.S. Postal Inspection Service, the law enforcement arm of USPS — before deleting it.

If you already clicked and entered information, contact your bank immediately to freeze the card, enable fraud alerts on your credit reports, and monitor for identity misuse.

The Bigger Picture

These scams succeed because the cognitive load of modern life makes shortcuts appealing. Attackers study human psychology as carefully as they study technical exploits.

The best defense is a simple habit: never act on a text message about a delivery. Instead, open a browser, type usps.com yourself, and look up the tracking number there. That extra ten seconds is the entire gap between becoming a victim and not.