UPS text message scams, also known as "smishing" attacks, have become one of the most prevalent forms of phishing fraud in 2024 and 2025. Scammers send millions of text messages daily that appear to come from UPS, using sophisticated social engineering to trick recipients into clicking malicious links or providing personal information.
The effectiveness of UPS smishing attacks lies in their timeliness and relevance. People who are expecting package deliveries are primed to engage with what appears to be a legitimate UPS notification. By the time they realize the message is fraudulent, they've often already clicked a link, entered personal information, or downloaded malware onto their device.
In this guide, we'll examine how UPS text scams work, what data scammers are targeting, how to identify fake UPS messages, and what steps you should take if you receive a suspicious message or have already been compromised.
How UPS Smishing Campaigns Work
UPS text scams operate on massive scale. Scammers use automated systems to send millions of text messages to random phone numbers, relying on the law of large numbers. They know that a significant percentage of phone numbers belong to people who are actively expecting package deliveries, especially during peak shopping seasons.
The volume and targeting of these campaigns is strategic. Scammers often increase their efforts around the winter holiday season, back-to-school season, and major shopping events like Black Friday and Cyber Monday. During these periods, people are more likely to be expecting multiple packages, making them less suspicious of UPS notifications.
Additionally, scammers use sophisticated targeting techniques. They purchase or scrape lists of phone numbers from data breaches, marketing databases, or social media profiles. Some use phone number generation algorithms to create lists of potentially valid numbers in specific geographic regions. The goal is to maximize the hit rate — the percentage of recipients who fall for the scam.
The timing of these attacks is also calculated. Scammers send messages at times when people are most likely to be checking their phones and less likely to carefully scrutinize messages — typically during work breaks, lunch hours, or late evening. They also note that people are more likely to click links when they're using mobile devices, which have smaller screens and make it harder to see full URLs.
Common UPS Smishing Message Templates
While there's significant variation in UPS text scams, several common templates have emerged:
Template 1: Delivery Failed
"Your UPS package delivery failed on [date]. Please update your delivery address to reschedule: [malicious link]"
Template 2: Package On Hold
"UPS: Your package is on hold. Delivery requires additional information. Verify now: [malicious link]"
Template 3: Customs Fee Required
"UPS: Your international package requires a customs fee of $X.XX to complete delivery. Pay now: [malicious link]"
Template 4: Signature Required
"Your UPS package requires a signature for delivery. Schedule your signature confirmation: [malicious link]"
Template 5: Account Verification
"UPS Account Security Alert: Suspicious activity detected. Verify your account immediately: [malicious link]"
All of these templates follow a similar psychological pattern: they create a sense of urgency, suggest that the recipient's package or account is at risk, and provide an immediate action (click the link) that supposedly resolves the problem. By making recipients feel that inaction will result in lost packages or fees, scammers manipulate them into clicking before thinking critically.
Fake "Package on Hold" Scams
The "package on hold" message is one of the most common UPS text scams. The message claims that your package is being held in a UPS facility and that you need to provide additional information to complete the delivery. This message feels urgent because it suggests your package is stuck and won't arrive unless you take action.
When you click the link in the message, you're directed to a fake UPS website that looks nearly identical to the real UPS tracking page. The website asks you to enter your tracking number, phone number, email address, and sometimes billing address or payment information. Some versions even ask for a UPS account username and password.
Once you've entered this information, scammers have everything they need to intercept your actual UPS packages, place fraudulent orders, or use your personal information for identity theft. In some cases, the fake website simply collects your data and disappears; in others, it redirects to a legitimate UPS page to make it appear as though the process worked normally.
Fake "Delivery Failed" Scams
The "delivery failed" scam follows a similar pattern but adds an extra layer of psychological manipulation. The message suggests that a UPS driver attempted to deliver your package but was unable to because of an incorrect address, a missing recipient, or another delivery issue. You're told that unless you click the link to update your address or reschedule delivery, the package will be returned to the sender.
This message creates a false sense of immediacy: if you don't act now, your package will never arrive. In reality, if a UPS delivery actually failed, UPS would handle rescheduling automatically or would allow you to reschedule through your official UPS account or the real UPS website.
The fake "delivery failed" pages ask for similar information as other phishing pages: tracking numbers, phone numbers, and address information. Some versions of this scam even attempt to capture credit card information by claiming there's an outstanding delivery fee that needs to be paid before the package can be redelivered.
Fake "Customs Fee Required" Scams
For people who order items from international vendors, the "customs fee" scam is particularly effective. The message claims that your international package is being held at customs and that you need to pay a customs clearance fee to receive it. A link is provided to pay the fee.
This message exploits people's legitimate understanding that international packages sometimes incur customs duties. However, UPS would never ask for payment via an SMS link. Real international delivery fees would be collected through official channels, either at delivery or through your official UPS account.
When you click the link and attempt to pay the "customs fee," you're either directed to a page that captures your payment information for fraudulent charges, or to a fake payment system that appears to work but simply records your credit card details without actually processing a payment.
What Data Phishing Pages Collect
UPS phishing pages are designed to capture specific categories of personal information that scammers find valuable:
- Contact Information: Phone numbers, email addresses, and mailing addresses are used to target you with further scams or to sell to other fraudsters.
- Tracking Information: UPS tracking numbers reveal what you're ordering, when you receive packages, and your delivery patterns. This information is valuable to package thieves and identity thieves.
- Payment Information: Credit card numbers, debit card numbers, and billing addresses are used for fraudulent purchases and identity theft.
- Account Credentials: Some phishing pages ask for UPS account usernames and passwords, which can be used to access your legitimate UPS account and intercept real packages.
- Personal Identification: Date of birth, Social Security numbers (in some elaborate versions), and driver's license information are valuable for identity theft.
Once scammers have this information, they can use it in multiple ways: charging fraudulent purchases to your credit card, opening lines of credit in your name, intercepting future packages from your home, or selling your information to other criminals on the dark web.
Lookalike UPS Domains and URLs
One of the trickiest aspects of UPS smishing attacks is that the phishing pages are hosted on URLs that closely mimic legitimate UPS domains. Scammers use several techniques to create these lookalike domains:
- Subdomain Spoofing: Using subdomains like "ups-delivery-notification.com" or "my-ups-package.net" that sound official but are not actually controlled by UPS.
- Character Substitution: Replacing a character in the real UPS domain with a similar-looking character (for example, replacing the letter "l" with the number "1", so "ups.com" becomes "ups1.com").
- Added Words: Adding seemingly official words like "delivery," "tracking," "notification," or "verify" to the beginning or end of a domain.
- Geographic Variants: Creating domains that suggest legitimacy through geographic indicators, like "ups-delivery-us.com" or "ups-tracking-usa.net".
Common fake UPS domains include: ups-notification.com, ups-delivery-notification.com, my-ups-package.net, ups-track-delivery.com, and ups-verify-tracking.com. When you're on your phone and receiving a text message with a short URL (often using URL shorteners), it's nearly impossible to verify the actual domain before clicking.
How Real UPS Notifications Differ from Fake Ones
Understanding the key differences between real UPS notifications and fake ones is essential for protecting yourself:
Real UPS Notifications
- Opt-In Required: UPS only sends text notifications to customers who have explicitly opted in to receive them through their UPS My Choice account or during account setup.
- Never Ask for Payment: Real UPS messages never ask you to click a link to pay a fee. Delivery fees are either pre-paid or collected by the delivery driver.
- Don't Ask for Personal Info: UPS won't ask you to verify your address, phone number, or credit card information via text message. If you need to update this information, you can do so through your official UPS account.
- Link to Official UPS Domain: If a real UPS text includes a link, it goes to the official ups.com domain or UPS My Choice portal.
- Tracking Info Included: Real UPS tracking notifications include specific tracking numbers and status updates, not generic messages about packages on hold.
Fake UPS Notifications
- Unsolicited Messages: You receive messages even though you don't have UPS My Choice set up or don't remember opting in.
- Requests for Action: The message asks you to click a link and "verify" or "confirm" information.
- Vague Tracking Info: The message is generic and doesn't reference a specific tracking number you recognize.
- URLs Don't Match UPS: Hovering over the link (or checking the actual URL if you can see it before clicking) reveals a domain that doesn't belong to UPS.
- Urgency and Threats: The message suggests that if you don't act immediately, your package will be lost or a fee will increase.
How to Verify a Real UPS Shipment
If you receive a UPS notification and want to verify it's legitimate, follow these steps:
- Don't Click the Link: Don't click any links in the message, even if you think it might be legitimate. Instead, use a separate method to verify.
- Go to UPS.com Directly: Open your web browser and navigate to www.ups.com manually by typing the address into the URL bar.
- Use UPS My Choice: If you have a UPS My Choice account, log in directly and check your tracking information there. This is the most reliable verification method.
- Enter Tracking Number: In the official UPS website or app, enter any tracking number referenced in the message and verify that it matches a legitimate package you're expecting.
- Call UPS Customer Service: If you're unsure, you can call UPS customer service at 1-800-742-5877 (visible on the official UPS website) and ask them to verify the package and any claimed delivery issues.
Reporting UPS Smishing and Phishing
If you receive a suspicious UPS text message, reporting it helps prevent other people from falling victim to the same scam.
- Report to UPS: UPS has a dedicated reporting system for phishing and scams. You can forward suspicious messages to UPS at 7726 (SPAM) from your mobile phone, or visit UPS.com/phishing to report online.
- Report to Your Phone Carrier: If you have an iPhone, you can report spam messages directly. On Android, you can block and report the sender through your Messages app. Your carrier can investigate and potentially block the sending number.
- Report to the FTC: File a complaint with the Federal Trade Commission at ReportFraud.ftc.gov. Include the full text of the message, the phone number it came from, and any details about whether you clicked the link or entered information.
- Report to Cybersecurity Authorities: If you believe you've been compromised or have lost money, report the incident to your state's attorney general and to the FBI's Internet Crime Complaint Center (IC3) at ic3.gov.
Comparison to Other Shipping Scams
While UPS text scams are extremely prevalent, similar scams target customers of other shipping companies. Fake USPS text messages claiming to be delivery notifications are equally common. DHL scams follow the same pattern but target the DHL customer base, particularly people ordering international items.
The reason all shipping companies are targeted by scammers is simple: package delivery is a near-universal experience. Almost everyone receives deliveries, and almost everyone is occasionally confused about delivery status or timing. This universality makes shipping company impersonation one of the most effective social engineering vectors.
What to Do If You've Clicked a Suspicious UPS Link
If you've already clicked a link in a suspicious UPS text and you're concerned you may have been compromised, take these steps immediately:
- Stop Entering Information: If you haven't entered any personal information yet, close the page immediately and don't enter anything.
- Check Your Devices for Malware: If the link redirected to an app download or you received a prompt to install software, your device may have been compromised. Run a full antivirus scan using reputable security software.
- Monitor Your Credit Card: Check your credit card statements closely for unauthorized charges. If you entered credit card information, consider canceling the card and requesting a new one from your bank.
- Check Your Bank Account: Monitor your bank account for unauthorized transactions or suspicious activity.
- Place a Fraud Alert: Contact one of the major credit bureaus (Equifax, Experian, or TransUnion) and place a fraud alert on your credit file. This makes it harder for scammers to open credit accounts in your name.
- Monitor Your UPS Account: If you have a UPS My Choice account, log in and verify that no unauthorized changes have been made and that no fraudulent packages are being shipped to your address.
- Report to Law Enforcement: File a report with your local police department and the FBI's IC3 (ic3.gov).
Prevention Best Practices
- Never click links in unsolicited SMS messages, especially from companies you don't have active accounts with
- If you're expecting a package, check the status through the company's official website or app instead of clicking links in messages
- Be skeptical of messages claiming you need to pay a fee, verify information, or reschedule delivery urgently
- Enable two-factor authentication on any accounts you have with shipping companies or retailers
- Keep your phone's operating system and security software up to date
- Never share tracking numbers, personal information, or payment details via text or email
- Register for official UPS My Choice alerts if you want legitimate delivery notifications
- Consider enabling SMS filtering on your phone to block messages from unknown senders
Other Scams to Watch For
People researching this scam also check these related pages.
UPS Scam Checker
Detect fake UPS delivery texts and phishing emails.
Check NowFedEx Scam Checker
Identify fraudulent FedEx delivery notifications and scams.
Check NowDHL Scam Checker
Spot fake DHL delivery alerts and smishing messages.
Check NowPurolator Scam Checker
Check suspicious Purolator delivery messages for fraud.
Check NowUSPS Text Scam
Spot fake USPS delivery text messages and postal scams.
Check NowCanada Post Text Scam
Identify fraudulent Canada Post delivery text messages.
Check NowFedEx Text Scam
Identify fraudulent FedEx text alerts and delivery scams.
Check NowDHL Text Scam
Detect fake DHL SMS messages and package delivery scams.
Check NowWhy do UPS text scams target so many random people?
Scammers use automated systems to send millions of text messages to random phone numbers because statistically, a significant percentage of any random sample of phone numbers belong to people who are expecting packages. During peak shopping seasons, the success rate is even higher. The economics work in the scammer's favor: if they send a million messages and just 0.1% of recipients click and enter information, they've compromised 1,000 people, which can yield significant profit.
Can I get my money back if I paid a fake customs fee through a UPS phishing page?
Recovery depends on how the scammer processed your payment. If you used a credit card, contact your card issuer and file a dispute claim, explaining that you were the victim of fraud. If you used a debit card, contact your bank immediately. If you sent money via wire transfer, money transfer app, or cryptocurrency, recovery is extremely unlikely. The faster you report the fraud, the better your chances of recovery.
Is UPS responsible if I fall for a phishing scam using their name?
UPS is not legally responsible for losses from phishing scams, though they do work to prevent them. However, if you can demonstrate that UPS failed to take reasonable steps to combat phishing (for example, if they didn't register similar domains to prevent spoofing), you might have grounds for a complaint to regulatory bodies. More realistically, your best bet for recovery is through your bank or credit card company's fraud protection.
How do I know if my phone number was compromised in a data breach?
Visit haveibeenpwned.com and enter your phone number to check if it's been publicly exposed in a known breach. If it has been, your number is likely circulating in scammer databases, which is why you may receive UPS and other phishing messages. Even if your number hasn't been in a public breach, it may still be available for purchase on the dark web, which is why random people receive these messages regularly.
What's the difference between a phishing link and malware?
A phishing link typically takes you to a fake website designed to capture your personal information. Malware is software designed to damage or gain unauthorized access to your device. Some UPS scams include both: they send you to a phishing page (to capture your info) and also try to get you to download malware. If a link prompts you to download an app or software, it's likely attempting to install malware, and you should absolutely not proceed.