You parent gets a text: "USPS: Your package is on hold pending verification. Click here to confirm: usps-pkg.co/track."
This is a scam. Specifically: it is the most successful scam targeting older adults in 2026, by volume of victims. Here is how to identify it, what to do about it, and how to protect your parent without lecturing them.
The five-second tells
Real delivery texts and scam delivery texts look almost identical. Here is what separates them:
- The link domain. Real USPS texts come from usps.com. Real Amazon from amazon.com. Real FedEx from fedex.com. Anything else (usps-pkg.co, amaz0n-track.net, ups-delivery.info) is a scam.
- The ask. Real delivery services do not ask for payment, credit card info, or personal verification to release a package. They just deliver it.
- The urgency. "Your package will be returned in 24 hours" is a scam pressure tactic. Real deliveries do not threaten you.
- The sender number. Real Amazon texts come from short codes (5-digit numbers like 262966). Real USPS from official channels. A scam often comes from a regular 10-digit number or a foreign code.
- Whether you are expecting anything. If your parent is not expecting a package, no real delivery service is texting them.
What to do if they already clicked
If they tapped the link, do this immediately:
- If they only opened the page and did nothing: close the browser. They are probably fine.
- If they entered any info (address, credit card, password):
- Change the password for any account using that password.
- If they entered a credit card, call the bank's fraud line on the back of the card. Cancel the card.
- If they entered a debit card, freeze the card immediately. Debit fraud is harder to reverse.
- If they sent money or a gift card: call the bank, money service, or gift card issuer immediately. Time matters. Some transactions can be reversed in the first hour.
- Always: report at reportfraud.ftc.gov. It helps law enforcement and protects others.
The "is this real?" workflow to teach
Do not teach your parent to identify scam texts in the abstract. The pattern-recognition fails under stress. Teach them one workflow:
If you get a text about a package:
1. Do not click the link.
2. If you ordered something recently, go to the app you ordered from (Amazon, USPS, whichever) and check status there.
3. If you did not order anything, delete the text.
4. If unsure, forward to Kinline or call a family member before clicking.
Print it. Tape it to the fridge. The simpler the workflow, the more it sticks.
How scammers got so good at this
A few reasons it has exploded:
- The texts cost almost nothing to send. Scammers send millions per day.
- The fake landing pages look real. AI tools generate convincing copies of Amazon's UI in minutes.
- Older adults receive more packages now (online shopping habits picked up post-pandemic), so the cover story is plausible.
- Many phones do not flag the messages as spam, especially if the scammer is using a recently-registered number.
The pattern is not going away. The defense has to be at the user, not the inbox.
The four-line family rule
Pick one of these as a family rule and stick to it:
- Strict: "Never click a link in a text from a company. Go to the app or website directly."
- Practical: "If unsure, forward to me before clicking."
- Hands-off: "Forward suspicious texts to Kinline (855-758-6884). They will tell you in seconds if it's real."
The strict rule is the safest. The hands-off rule is the most realistic.
The system-level fix
Two things to turn on for your parent's phone:
- Filter unknown senders. iPhone: Settings > Messages > Filter Unknown Senders. Messages from non-contacts go to a separate folder. Reduces visibility of scam texts.
- Report scams to carrier. Forward scam texts to 7726 (spells SPAM). Every major US carrier accepts this. They use it to block the sender's number.
For other common scams, read our scam roundup and how to tell a real payment email from a fake.