The holiday season is the time of giving, but unfortunately, some believe it is the time of stealing.
The U.S. Postal Inspection Service is reminding customers the importance of avoiding trending scams while sending and receiving gifts this year. Perhaps one of the most popular scams is “smishing,” which, in the case of holiday mail, appears as fraudulent text messages indicating package tracking. Undisclosed texts with questionable tracking information and clickable links should be avoided in order to prevent scammers from gaining personal information.
Never heard of smishing? Here’s what to know about the fraudulent act, how to prevent it and what real tracking messages look like from the U.S. Postal Service.
Deadlines to ship your packages:USPS, FedEx and UPS holiday gift shipping schedules
Smishing is a form of phishing, the fraudulent practice of sending messages disguised as a reputable source to induce individuals to reveal personal and/or financial information, such as social security numbers, credit and debit card numbers, and account passwords.
Holiday deals: Shop this season’s top products and sales curated by our editors.
Smishing, specifically, is done through text messaging.
A victim of smishing typically receives a deceptive text message from a scammer trying to act as a government agency, bank or other institution, like the USPS.
Yes, the USPS offers text message tracking of packages, but customers must register to initiate it. USPS does not send tracking texts or emails without a customer first requesting the service, the U.S. Postal Inspection Service states.
Depending on the the information requested, tracking texts from the USPS may vary, but generally, all texts include the following:
Per the USPS, an example text message for an expected delivery may look like: USPS 01123456789123456789, Expected Delivery by: Monday, September 11, 2017 Reply STOP to cancel.
USPS tracking texts never include clickable links.
People can request text message tracking by sending their package’s tracking number to 28777 (2USPS). The text reply will be the package’s latest tracking update.
Individuals looking for more specific tracking information should send the package’s tracking number to 28777 in addition to one of the USPS’ keywords. Keywords tell the USPS what information an individual is looking for, such as expected delivery, when and where a package is available for pickup, and all past activity related to the package.
A list of keywords is available on the USPS website at usps.com/text-tracking/welcome.htm.
If you believe you have received a deceptive message from a sender disguised as the USPS, report the message via email to [email protected]. Take the following steps to file a report:
The U.S. Postal Inspection Service will contact you, if further information is needed.
If you receive a smishing message that is not related to the USPS, forward the message to 7726 and file a report with the Federal Trade Commission or the FBI’s Internet Crime Complaint Center.
Brushing is another type of fraud scammers may use during the holiday season.
Brushing is when a person receives a package containing items not ordered or requested by the recipient. While the package may be addressed to the recipient, the package often doesn’t include a return address. The intention of brushing is to give the idea that the recipient is a verified buyer who has written positive reviews online. Hence, the scammer is writing fake reviews in your name. Fake reviews help boost product sales.
While brushing may appear like a victimless crime, the reality is that the recipient’s personal information may have been stolen. And a fake review may encourage others to purchase items that aren’t worthy of a glowing rating.
If you think you may be a victim of brushing, there are several steps you can take. If you have not opened the package, write “RETURN TO SENDER” on the box and the USPS will take care of it at no charge. You can also throw away the package or if you like what’s inside, you can keep it. It’s legal to keep unsolicited merchandise.
But perhaps most importantly, change your account passwords, closely monitor accounts for unexpected activity and notify authorities.
Greta Cross is a national trending reporter at USA TODAY. Follow her on X and Instagram @gretalcross. Story idea? Email her at [email protected].

source