USPS text scam: the 'package held' texts aren't from USPS
If you got a text saying a USPS package is held and you must pay a fee or confirm details through a link, it's smishing. USPS's real text service, 28777, only ever replies to a tracking number you send it first — it never sends unsolicited package texts with links.
USPS's only text number is 28777 (it spells 2USPS), and it works one way: you text it a tracking number and it replies with the status. USPS never sends an unsolicited "your package is held, pay a fee" text, and its messages never contain links. The scam texts come from random 10-digit numbers, iMessage/RCS, and foreign senders — not from 28777.
What the real USPS text code does
USPS Text Tracking uses the short code 28777. You start it — text a tracking number to 28777 (or sign up for updates on a specific package) and it replies with delivery status. It doesn't ask for payment, card details, or a login, and it doesn't send links. So any "USPS" text you didn't initiate is already off-script.
Red flags of a smishing text
- A delivery "problem" or "held package" you weren't expecting, demanding a small fee to release it.
- A link to a lookalike site (usps-tracking dot-something) asking for card or login details.
- The sender is a 10-digit mobile number, an email-to-text, or a foreign number — not 28777.
- Generic "Dear Customer" wording and urgency ("last attempt", "within 12 hours").
This pattern is consistent with the widely-reported USPS smishing wave that the Postal Inspection Service has warned about. It doesn't mean any specific number is a criminal — spoofed and burner numbers are used and discarded — so the safe move is to ignore the message, not engage with it.
Report a scam text: forward it to 7726 (which spells SPAM) so your mobile carrier can investigate the sender, then report it at reportfraud.ftc.gov. Don't reply or tap any links. More on 7726.
Track packages only at usps.com or by texting a tracking number to 28777. Look up another sender in the short code directory, or check a number that called you.
Frequently asked questions
Does USPS text you about a package?
Only if you asked it to. 28777 (which spells 2USPS) is USPS's text-tracking short code, and it only replies to a tracking number you send it first. USPS does not send unsolicited 'your package is held, pay a fee' texts, and its messages never contain links.
Is the 'USPS package' text with a link a scam?
A 'USPS' text you didn't request, asking you to pay a fee or click a link, is consistent with the widely-reported USPS smishing wave. Those messages come from random 10-digit numbers, iMessage/RCS, or foreign senders — not from 28777. Don't tap the link; forward the message to 7726 and report it at reportfraud.ftc.gov.
What is USPS's real text number?
28777. It's USPS's only text-tracking short code, and it works one way: you text a tracking number to 28777 and it replies with the status. Any other number claiming to be USPS, or any USPS text with a payment link, should be treated as smishing.
I clicked a fake USPS link — what now?
If you entered card or login details, contact your bank or the affected account right away, change the password, and watch for unauthorized charges. Then report the message to 7726 and at reportfraud.ftc.gov. Going forward, track packages only through usps.com or by texting a tracking number to 28777.
Based on the named sender's own guidance and public advisories from the FTC, FCC, USPIS, and IRS. Educational information, not legal advice; areacode.fyi is independent and not affiliated with any company or agency named here.