Fake delivery and toll texts: how to spot them

Updated · 5 minute read · By the IsSiteLegit team · How we write our guides

A text saying your parcel can't be delivered, or that you owe a small unpaid toll, is very often a scam — especially if it contains a link and asks you to pay a fee or "update your details". The link leads to a fake website that copies the real postal service or toll company and steals your card details. Don't tap the link. If you're unsure, open the official app or type the company's address yourself.

The quick version

  • Don't tap links in unexpected delivery or toll texts. Go to the official website or app yourself.
  • Small amounts ($1–$15, £1–£3) plus a deadline or a "late fee" are the classic pattern.
  • In the US and UK, forward the text to 7726 (it spells "SPAM"), then delete it.
  • If you entered card details, call your bank now, using the number on your card.

How do these scams work?

The text pretends to come from a postal or parcel service (USPS, Royal Mail, UPS, DHL, Evri and others) or from a toll road operator. It says a parcel is waiting, an address is incomplete, or a toll is unpaid, and that you must pay a small fee or confirm your details through a link. The amount is small so you won't think twice. The real goal is your card number, which is then used for much bigger payments, or sold.

The FBI's Internet Crime Complaint Center warned in 2024 about a wave of texts claiming to collect unpaid road tolls, with messages like "an outstanding toll amount of $12.51… to avoid a late fee of $50.00". The same pattern is used for parcels all year, and most of all around the holidays and big shopping sales.

Does the postal service really send texts like this?

Usually not out of the blue. The US Postal Inspection Service says USPS does not send text messages or emails to customers unless they first asked for updates with a tracking number. Real delivery companies don't ask you to pay through a link in an unexpected text. If a parcel really needs a fee (for example customs charges), you can always find it by going to the company's official website or app yourself.

What are the warning signs?

  • You weren't expecting anything, or the text doesn't mention a sender, shop or tracking number you recognise.
  • A link to a strange address, such as usps-redelivery-help.com, royalmail.parcel-fee.info or a short link. The real addresses are short and plain, for example usps.com or royalmail.com.
  • Urgency: "today only", "your parcel will be returned", "a late fee will be added".
  • A request for card details to pay a tiny amount, or for your date of birth or bank login.
  • The text comes from an ordinary phone number or an email address, sometimes from another country.

Our guide on checking a link before you click shows how to read an address and find out where a short link really goes, without opening it.

How can I check the link without opening it?

Press and hold the link to copy it (don't tap it), then paste it into IsSiteLegit. We check how old the website is, whether it is on a security blacklist, and whether its name imitates a well-known brand, and we look that exact link up on blacklists too. Fake delivery sites are usually only days old and imitate a famous name, which shows up clearly in the evidence. A clean result is not a guarantee, though: brand-new scam sites may not be on any list yet, so the safest move is still to go to the official site yourself.

How do I report the text?

  • US and UK: forward the text to 7726. Your mobile provider uses these reports to block the sender.
  • United States: report the scam to the FTC at ReportFraud.ftc.gov, and to the FBI's Internet Crime Complaint Center if you lost money.
  • United Kingdom: the National Cyber Security Centre explains how to report a scam text message.
  • Elsewhere: your mobile provider, and your national police or consumer protection agency.

Then delete the text. Don't reply, not even "STOP": a reply confirms your number is in use.

I tapped the link or paid. What now?

  1. If you entered card details: call your bank or card provider now, using the number on your card, and ask them to block the card and watch for payments.
  2. If you entered a password: change it, and change it anywhere else you use the same one. Turn on two-step verification.
  3. If you only opened the page: close it. Don't enter anything. Keep your phone's software up to date.
  4. Watch out for follow-up calls: scammers sometimes phone afterwards pretending to be your bank's fraud team. Your bank will never ask you to move money to a "safe account".

Our guide I paid a scam website — what do I do now? explains how to ask your bank for your money back.

Sources

Check a website now

Free. We show every piece of evidence we find, so you can judge for yourself.

See real results

More guides