Fake Delivery and Toll Text Scams: How to Spot Them

What Do Package Delivery and Toll Text Scams Actually Look Like?

Both scams follow the same basic playbook: a short, urgent text message, a small and specific-sounding dollar amount or action needed, and a link to a website that looks convincing at a glance but isn't the real company or agency.

The fake package delivery text

A typical message might read: "USPS: Your package has an incorrect delivery address. Please update your information here: [link]" or "FedEx: We could not deliver your parcel due to an unpaid customs/redelivery fee of $1.99. Confirm payment: [link]." Some versions include a fake tracking number for added credibility. The link usually leads to a page that mimics the carrier's real branding, logo, colors, even a tracking-style layout, but sits on a web address that has nothing to do with usps.com, fedex.com, or ups.com.

The fake toll text

Toll scam texts follow an almost identical script, swapped for a state tolling agency: "E-ZPass: You have an unpaid toll of $6.49. To avoid a $50 late fee and possible suspension of your license, pay now: [link]" or similar messages impersonating SunPass (Florida), FasTrak (California), TxTag (Texas), I-Pass (Illinois), and other regional toll authorities. The language tends to be strikingly similar from state to state and carrier to carrier, a strong clue they're generated by the same automated campaigns rather than written individually to target you personally.

Why Do These Scams Work So Well, Even on Careful People?

These aren't especially clever scams in terms of technical sophistication, what makes them effective is psychology, timed and tuned with real precision.

• Plausibility: Almost everyone genuinely orders packages, and millions of people genuinely drive on toll roads. A delivery or toll text isn't a strange or suspicious premise the way, say, a text about a foreign lottery win would be. It fits into ordinary life.
• Small dollar amounts: Scammers typically ask for something tiny, a $1.99 "redelivery fee" or a $6.49 "toll balance." A small number feels low-risk and not worth questioning closely, even though the real goal is to capture your full card number, expiration date, and security code, which can then be used or resold for much larger fraud.
• Manufactured urgency: Messages often warn of a looming deadline, package returned to sender, late fees, or even license suspension, which pushes people to act fast, before they'd normally stop to verify.
• Mobile-first design: On a phone screen, it's harder to hover over a link to preview the real web address, harder to spot a subtly wrong domain name, and easier to tap without a second thought, especially while multitasking or checking your phone quickly between other things.
• Volume: Scammers send these messages by the millions using automated tools, so even a tiny response rate produces a steady stream of victims and stolen card numbers.

How Big Is This Problem, Really?

This isn't a fringe scam, it's one of the most-reported scam categories in the country right now. According to the Federal Trade Commission, consumers reported losing $470 million to scams that began with a text message in 2024 alone, roughly five times what was reported in 2020, even though total text scam reports had actually gone down, meaning each successful scam is, on average, taking more money than before. The FTC has also identified fake package delivery texts as the single most commonly reported type of text scam, ahead of fake bank fraud alerts, job scams, and "wrong number" scams.

Toll scam texts have surged right alongside delivery scams. The FBI's Internet Crime Complaint Center (IC3) received more than 60,000 complaints related to fake unpaid-toll text messages in 2024, with agencies across dozens of states, including E-ZPass authorities on the East Coast, SunPass in Florida, and FasTrak in California, issuing public warnings as the campaign spread state by state.

Who's Behind These Texts? The Rise of Industrial-Scale Smishing Kits

A phishing kit is a pre-built, off-the-shelf software package that lets someone with little to no technical skill run a convincing phishing campaign, fake websites, message templates, victim-tracking dashboards, and more, all bundled together and often sold or rented to other criminals. Cybersecurity researchers have traced a large share of the U.S. package delivery and toll smishing wave to a China-based cybercrime operation they call "Smishing Triad," which builds and sells these kits (sometimes marketed under names like "Lighthouse") to other scammers around the world.

Security researchers at firms including Resecurity and Silent Push have documented that this group's infrastructure has used tens of thousands of fake web addresses impersonating USPS alone, with toll-agency impersonation an even larger share of its overall domain activity, and reporting estimates the broader operation has generated over $1 billion for its operators over the past several years. This isn't meant to alarm, but to make one thing clear: if you've received one of these texts, you weren't personally targeted or careless, you were one of millions of numbers hit by an automated, industrial-scale operation.

Real Notification or Scam? How to Tell the Difference

The good news is that once you know what to check, telling a real delivery or toll notice from a fake one gets much easier.

Red flags that point to a scam

• You weren't expecting a package or don't use that toll road, tag, or account at all.
• The link uses a shortened URL (like bit.ly) or a domain that isn't the carrier's or agency's actual website, for example, anything other than usps.com, fedex.com, ups.com, or your state's real toll authority site.
• The message asks you to pay a small "fee" or "balance" directly through a text-linked page.
• There's pressure to act immediately, often with a scary consequence attached (package returned, fee doubles, license suspended).
• The grammar, punctuation, or formatting feels slightly off, extra spaces, odd capitalization, or a greeting that doesn't use your name.
• You get the text from a random-looking phone number or an email-style address rather than a short code.

Signs that point to a legitimate notice

• You already know you have a package coming or a toll account in good standing, and you specifically opted in to text alerts for it.
• USPS, in particular, generally does not text customers unless they've specifically signed up for Informed Delivery or package tracking alerts, and USPIS notes that legitimate USPS texts do not contain links asking you to take action.
• Real toll authorities and carriers direct you to log into your own account on their official app or website, they don't typically ask you to enter card details through a one-time link in an unsolicited text.

When in doubt, the safest move is always the same: don't click anything in the text. Instead, open a browser yourself and type in the carrier's or toll authority's real website address, or open the official app you already have installed, and check your account or tracking status directly there.

What Happens If You Click the Link or Enter Your Information?

Clicking the link alone usually just loads a fake web page, unpleasant, but not automatically catastrophic. The real danger comes from what happens next: these fake pages are built to look like a real carrier or toll-payment checkout screen, designed to capture whatever you type, your card number, expiration date, security code, billing zip code, and sometimes your name, address, and even a login username and password if the page asks you to "verify your account."

Once that information is submitted, scammers can use it to make unauthorized charges, sell it on to other criminals, or use reused login credentials to try breaking into other accounts you own. Some versions of these fake pages also attempt to install malware or push a follow-up "verification" step designed to capture a one-time passcode sent to your phone, which can defeat some forms of two-factor authentication.

How to Protect Yourself: Step-by-Step Prevention Habits

• Don't click links in unexpected delivery or toll texts, treat any link in an unsolicited message as suspicious by default, no matter how legitimate it looks.
• Go directly to the source instead: open the carrier's or toll authority's official app, or type the real website address into your browser yourself, and check your account or tracking number there.
• If a text includes a tracking or account number, search for it only through the official site's own tracking tool, not through the link in the text.
• Never enter payment card information through a link sent by unsolicited text message.
• Don't reply to the text at all, not even to say "STOP", since replying can confirm to scammers that your number is active and may lead to more messages.
• Enable your phone carrier's spam-text filtering (available through most carrier apps or settings) and consider a call-and-text-blocking app if you receive these frequently.
• Talk to older relatives and anyone you help with finances, these scams work on people of every age, but they've become an especially common way scammers target retirees.

How to Report a Delivery or Toll Scam Text

Reporting these texts helps carriers and investigators shut down the campaigns behind them, and it takes only a couple of minutes.

• Forward the text to 7726 (which spells "SPAM" on a phone keypad), this works with AT&T, T-Mobile, Verizon, and most other major U.S. carriers and helps them trace and block the source.
• Report it to the FTC at ReportFraud.ftc.gov, including the sender's number, the message text, and the link (typed out, never clicked).
• If it impersonated USPS specifically, forward it to 7726 and email a copy to spam@uspis.gov, per U.S. Postal Inspection Service guidance.
• If it impersonated a toll authority, you can also file a report with the FBI's Internet Crime Complaint Center at ic3.gov.
• Take a screenshot before you forward or delete anything, so you have a record of the sender's number, the message, and the date.

Already Clicked or Entered Information? Here's What to Do Right Now

If you clicked the link but didn't enter anything, you can usually just close the page and move on, but it's still smart to watch your accounts for a few weeks in case the page attempted to install anything in the background.

If you entered payment card information, act quickly:

• Call the number on the back of your card (not any number from the text) and tell your card issuer what happened. Ask them to freeze, cancel, or reissue the card.
• Review recent transactions and dispute anything unfamiliar, most card issuers offer strong fraud protection, but the sooner you report it, the smoother that process goes.
• Set up transaction alerts if you haven't already, so you'll be notified immediately of any new charges.

If you entered personal information like your name, address, date of birth, or a login password:

• Change the password on that account immediately, and on any other account where you reused the same password.
• Turn on two-factor authentication where it's available.
• Consider placing a free credit freeze with each of the three major credit bureaus (Equifax, Experian, and TransUnion) if you're worried about identity theft, this makes it much harder for anyone to open new credit in your name.
• Report the incident at IdentityTheft.gov, which will walk you through a personalized recovery plan.

None of this means you did something foolish. These campaigns are built by organized operations sending millions of messages specifically because they know a percentage of recipients will be caught off guard. Acting fast is what matters now.

Frequently Asked Questions