How to Trace a Fake Delivery-Text Scammer

The message is short on purpose. It claims a parcel could not be delivered, that an address needs confirming, that a customs charge is owed, or that a tiny redelivery fee is due before your package is released. There is just enough friction to feel real and just enough urgency to make you move fast: act now or the package goes back. This is “smishing,” short for SMS phishing, and package-delivery texts are now the most-reported text scam in the country. The whole thing is designed to skip the part of your brain that would otherwise notice the wrong sender, the odd link, or the simple fact that real carriers do not text strangers for money.

Here is the detail that cuts through all of it: legitimate carriers like USPS, FedEx, and UPS do not charge a redelivery fee by text, and they do not send tracking texts for packages you never signed up to track. So any “pay to release your package” text is fake by definition, no matter how polished it looks. The fee they ask for is deliberately small, often just a couple of dollars, because a tiny charge lowers your guard. The few dollars are not the prize. Your card number and personal details are. The same lawful research our investigators use to help people find someone who scammed them applies squarely to the crews running these texts, because the message is the bait, not the business.

It is tempting to picture a lone person typing texts. The reality is an assembly line, and understanding it is what makes the scammers traceable rather than mysterious. It starts with sender spoofing. Faking the displayed sender or routing through an email-to-text gateway is technically illegal but trivially easy, which is why the message can look like it came from a carrier even though it did not. Spoofing hides the surface, not the infrastructure underneath.

Next comes the phishing domain. The link points to a lookalike website built to mimic the carrier’s tracking page. These domains are registered in bulk, spun up fast, and burned just as fast, but registration, hosting, and the kits used to build them leave records and reuse patterns. When you submit the form, the site captures your card and personal details in real time. Researchers have documented operations that immediately load the stolen card into a mobile wallet, and that quietly tell victims the first card “did not go through” so they will enter a second one, harvesting more than one payment method per person.

From there the value has to be turned into goods or cash. The crews use the stolen cards to buy high-demand electronics and luxury items, then ship them to reshipping mules, sometimes unwitting people recruited through fake work-from-home jobs, who forward the goods for resale. Each of those steps, the registrant behind the domain, the email or phone tied to the account, the wallet or payment processor, and the mule address that received the parcel, is a real-world identifier. That is precisely the layer our team works when we investigate fraud: not the spoofed front, but the people and accounts the operation cannot run without.

Two situations, one calm response. If you only received the text and did nothing, you are reporting to protect the next person. If you entered card or login details, the priority is containment first, then reporting. Report fraud and identity-theft exposure to the FTC at reportfraud.ftc.gov, which also generates a recovery plan if your information was exposed, and file the incident with the FBI Internet Crime Complaint Center at ic3.gov, the central federal intake that aggregates these complaints into investigations.

“They spoofed the number, so they are untraceable” is the assumption the crews rely on, and it is wrong. The spoof only disguises what shows on your screen. The operation still has to register a domain, host a phishing page, accept payment data somewhere, and route goods to a real address. Each of those is a thread, and lawful public-records research pulls on the threads, not the spoof. A phishing domain has a registration, hosting, and reuse history that can connect it to a wider campaign. A phone number or email used to set up an account is exactly the kind of identifier our team resolves when we help people identify a scammer by phone number or work from an email address back to a real person.

The further into the cash-out chain you go, the more the operation depends on people who used real identities. The reshipping mule gave a real delivery address. The person who opened the bank account, payment account, or mobile wallet to cash out had to verify real details. A handle, a username, or a name the scammer used while talking to you is a starting point too. Even when the front of the scam was a throwaway sender, those downstream identifiers can be researched lawfully through public records to surface a real name, address, and associates. That is the same investigative path behind our work helping people who searched for the person who scammed them, and a named, located individual is what turns a complaint number into something a prosecutor or a civil attorney can use.

Fake delivery texts run on the same rails as a dozen other scams, so the people behind them surface through the same lawful research that powers full-spectrum skip tracing. Send us what you saved, even if it feels like almost nothing: the sender number, the phishing link, an email, a username, a charge, or the address goods were shipped to. We work only for lawful, permissible purposes, we never promise a recovery we cannot control, and we are honest about what the records will and will not show. For a legitimate matter, an initial locate typically comes back within 24 hours.