Is a text from Royal Mail or USPS asking for my card details to release a package real?
No. This is a delivery phishing text — one of the most commonly reported scam types in the UK and US.
Last reviewed: 1 June 2026
Explanation
Smishing (SMS phishing) texts impersonating Royal Mail, USPS, FedEx, UPS, and other carriers tell you that a package is waiting but cannot be delivered until a small customs fee, redelivery charge, or storage fee is paid. The amount is deliberately small — often under £2 or $3 — to make it seem not worth questioning. Clicking the link leads to a fake payment page that harvests your card details for larger fraudulent charges. Royal Mail does charge customs fees on international parcels above a threshold, but these are notified by a physical card left at the address, not by SMS with a payment link. If you have a legitimate outstanding customs charge, log in directly to the carrier's official website to check.
Common red flags
- Text from a carrier about a package with a payment link
- Small fee amount designed to seem trivial
- Link does not go to the official carrier website
- Text arrives about a package you are not expecting
- Sender ID appears as the carrier name but the link domain is unfamiliar
What to do now
- Do not click the link
- Check any genuine outstanding deliveries through the carrier's official app or website
- Report the smishing text to your national spam reporting number (7726 in the UK)
- If you entered card details, contact your bank immediately to block the card
Frequently asked questions
How do real customs charges from Royal Mail work?
Royal Mail leaves a physical card at the address with a reference number. You pay the fee online at royalmail.com using that reference — never through a link in a text message.