Fake "missed delivery" and "unpaid toll" texts are among the most common scam messages people receive, and they work because almost everyone is expecting a parcel or has driven on a toll road. A parcel or toll text scam is a smishing (SMS phishing) message that pretends to come from a postal service, courier or toll agency and pushes you to a fake website to pay a small fee or "confirm" your details. The real target is your card details and personal information. This guide shows what the messages look like, how the scam works behind the link, what the genuine services say they will and will not send, and exactly what to do if you clicked. It is for anyone who receives these texts, and for security and fraud teams who answer staff questions about them. The broader enterprise view of SMS and voice phishing is in the Vishing and Smishing Guide.
Key takeaways
- Genuine tracking texts only follow a request. USPS says it only sends tracking texts after you request tracking with a tracking number, and its tracking messages contain no links; Royal Mail says it only texts if the sender asked for tracking updates.
- Small fees are the bait. The FBI's 2024 toll warning described texts claiming about $12.51 owed with a $50 late fee; the aim is your card number, not the fee.
- Never use the link or number in the text. Check by typing the official website yourself or calling a number you already know.
- Report, then delete. Forward the text to 7726 in the US and UK, and report to the FTC or IC3 in the US, or the postal service's own scam address.
- If you entered details, act within the hour. Call your card issuer, watch for follow-up "bank" calls, and change any password you typed.
What it is
These scams impersonate trusted, everyday services so that the message feels routine. The FTC's January 2025 consumer alert notes that scammers pose as tolling agencies across the country, and that people receive the texts even if they have never driven through a toll. Delivery versions impersonate national postal services and couriers. Both rely on urgency and a small amount of money that feels safe to pay.
| Lure | Typical wording (paraphrased) | What the genuine service says |
|---|---|---|
| US unpaid toll | You have an unpaid toll balance; pay now to avoid a late fee or further action | FBI IC3 and FTC: check only through the toll service's legitimate website or official customer service number |
| USPS missed delivery or address problem | Your package could not be delivered due to an incomplete address; update details at a link | USPS: tracking texts only after you request them with a tracking number, contain no links, and tracking is free |
| Royal Mail redelivery or fee to pay | Your parcel is held; pay a small redelivery or shipping fee | Royal Mail: does not ask for underpaid-item fees by email or text, leaves a grey "Fee to Pay" card; never asks for bank details or passwords |
| Customs or import charge | A customs fee is due before delivery | Royal Mail: may text about customs charges if the sender supplied your contact details, alongside the grey card, so check via the official site, never the link |
| Courier "reschedule" or "confirm" | Reply or click to choose a delivery slot | Check the courier's own app or website using the tracking number from the retailer |
How it works
- Mass sending: messages go out in bulk from changing numbers and accounts. The FBI's IC3 noted in April 2024 that sender numbers changed between states and the toll scam was spreading from state to state, with over 2,000 complaints since early March 2024.
- The fake site: the link opens a page that copies the look of the real toll service or postal service. IC3 described websites impersonating the state's toll service.
- Harvesting: the page asks for name, address, phone, date of birth and card details to pay the "fee". The FTC warns that scammers can also collect information such as driving licence numbers and use it for identity theft.
- Follow-up fraud: stolen card details are used quickly. Victims may also receive calls from someone posing as their bank's fraud team, using the details just harvested to sound convincing and ask for one-time codes. See the OTP Fraud Prevention Guide.
Red flags to check in ten seconds
- You did not ask for tracking: both USPS and Royal Mail say they text only when tracking was requested.
- A link in a USPS text: USPS tracking messages contain no links.
- A fee requested by text: Royal Mail uses a grey "Fee to Pay" card for underpaid items.
- Odd sender: a personal mobile number, a foreign number or an email address in place of a short code.
- Pressure: late fees, legal action, licence suspension or "final notice" language.
- Strange domain: a web address that adds words, hyphens or an unusual ending to the brand name.
Why it matters
The fee is trivial, but the card number, address and date of birth are enough for card fraud and the first steps of identity theft. Staff who are scammed on their personal phone can also expose work accounts if they reuse passwords or are later targeted by convincing follow-up calls. For fraud and security teams, these lures are worth covering in awareness training precisely because they look harmless.
Why the lures keep working: they borrow the credibility of services people use weekly, they ask for a sum too small to trigger suspicion, and they arrive on a channel with no sender verification that most people can see. Online shopping means a parcel is almost always on its way somewhere, and electronic tolling without booths means many drivers genuinely do not know whether they owe anything. The scam does not need to fool everyone: a small response rate across millions of messages is enough. That is why the strongest defence is a simple habit rather than spotting each new wording: never act on a delivery or toll text through its own link, and always go to the service yourself. Messages change monthly; the rule does not.
Anatomy of a typical message: a brand name at the start, a reason (failed delivery, incomplete address, unpaid balance), a deadline (within 24 or 48 hours), a consequence (return to sender, late fee, further action) and a shortened or look-alike link. If you can label each of those parts, you are looking at a lure.
What to do if you clicked
| What happened | What to do now |
|---|---|
| Opened the link but entered nothing | Close the page, delete the text, report it to 7726. USPS advises contacting your financial institution if you interacted with the link even without submitting anything; doing so is a sensible precaution. |
| Entered card details | Call your card issuer using the number on the back of the card, ask for the card to be cancelled and reissued, and dispute any charges you do not recognise (as IC3 advises). |
| Entered personal details (address, date of birth, licence number) | Watch for identity theft. In the US consider a credit freeze; see the Credit Freezes and Fraud Alerts Guide. |
| Typed a password or one-time code | Change that password at once on the real site and any site where you reused it, and turn on multi-factor authentication. |
| Lost money | US: report at ic3.gov and reportfraud.ftc.gov. England, Wales and Northern Ireland: the NCSC points to reportfraud.police.uk or 0300 123 2040; Scotland: Police Scotland on 101. |
| Received a "bank" call afterwards | Hang up and call the bank back on the number on your card. Never read out a one-time code. |
For a full recovery plan see the What to Do If You Have Been Scammed Guide.
Where to report
- Any scam text (US and UK): forward it to 7726 (SPAM). The NCSC explains that the mobile provider can then investigate and block or ban malicious senders, and that reporting is free.
- USPS impersonation: email [email protected] with the message text (without clicking the link), a screenshot showing the sender and date, and any loss.
- Royal Mail impersonation: send a screenshot to [email protected], as well as forwarding to 7726.
- US toll and other scams: file at ic3.gov with the sending number and website, and at reportfraud.ftc.gov.
Reporting channels by country are listed in the Scam and Cybercrime Reporting Map.
For security and fraud teams
- Awareness: include toll and parcel lures in training with the official rules above (tracking texts only on request, no fee by text), because simple rules are easier to recall than red flag lists.
- Mobile protection: on managed devices, enable mobile threat defence or protective DNS that blocks newly registered and known phishing domains.
- Reporting path: give staff one place to forward suspicious texts received on work phones, and feed reported domains into block lists.
- Measure: track staff reports of SMS lures per month, time from first report to domain block, share of reported domains already blocked, and helpdesk password resets linked to smishing.
Common misconceptions
- "It is only a couple of pounds or dollars." The payment form is the point: it captures full card details for much larger fraud.
- "It has my name, so it must be real." Names and numbers are widely available from earlier data breaches.
- "I have never used that toll road, so I can ignore it safely." Ignoring is right, but the FTC notes people receive these texts regardless, so do not reply "STOP" or engage; report and delete.
- "The website had a padlock." A padlock only means the connection is encrypted, not that the site belongs to the brand.
- "Clicking without typing anything is harmless." Usually you have lost nothing, but the scammer may learn your number is active. Report it and stay alert for follow-up messages.
Related concepts
- Smishing and vishing: the wider family of text and voice lures. See the Vishing and Smishing Guide.
- Impersonation scams: government, bank and brand impersonation share the same tactics. See the Impersonation Scam Awareness Guide.
- Telecoms controls: how operators filter and block scam texts. See the Telecoms Scam Prevention Guide.
- Password managers: a password manager will not autofill on a look-alike domain, which is a useful warning sign. See the Password Manager Setup Guide.
Practitioner checklist
- Teach the two official rules: genuine tracking texts only follow a request, and fees are not demanded by text.
- Check any delivery or toll claim by typing the official website or calling a known number.
- Forward scam texts to 7726, then delete and block the sender.
- Report USPS lures to [email protected] and Royal Mail lures to [email protected].
- If card details were entered, call the issuer on the number on the card straight away.
- Change any password typed into the fake site and enable multi-factor authentication.
- Give staff a single route to report suspicious texts and feed domains into block lists.
- Track SMS lure reports and time to block as awareness metrics.
Standards and references
- FBI IC3: Smishing Scam Regarding Road Toll Debt (I-041224-PSA)
- FTC: Got a text about unpaid tolls? It's probably a scam
- US Postal Inspection Service: Smishing
- Royal Mail: Help with online security
- NCSC: Report a scam text message
- Report Fraud (which replaced Action Fraud on 4 December 2025)
Related NHI Mgmt Group resources: Vishing and Smishing Guide · What to Do If You Have Been Scammed Guide · Impersonation Scam Awareness Guide · Scam and Cybercrime Reporting Map