The package, the toll, and the recall

These arrive by the million, and they work on a simple bet: enough people are expecting a package, drove somewhere recently, or bought something that could be recalled.

They're low-stakes-looking on purpose. There's no threat, no big money, nothing that triggers alarm. Just a small task.

The undelivered package

"USPS: Your package is on hold due to an incomplete address. Please update: [link]"

Also sent as UPS, FedEx, DHL, and Amazon.

What they want: your address and card details on a fake page, for a small "redelivery fee" of a dollar or two. The fee isn't the point — your card number is. Sometimes the link installs something on your phone.

The truth: USPS does not text you about a delivery unless you signed up for tracking on a specific package. They will not charge a redelivery fee by text. Carriers leave a paper slip.

What to do: don't tap. If you're expecting something, open the carrier's own app or type their address yourself and enter your tracking number.

The unpaid toll

"You have an unpaid toll of $6.99. To avoid a late fee of $50, pay here: [link]"

Sent as E-ZPass, SunPass, FasTrak, TxTag, and others — often for a system that doesn't operate in your state, which is the easiest tell.

What they want: card details, plus confirmation that a real person reads the number.

The truth: toll authorities bill by mail, to the address on your vehicle registration. They don't text strangers about small balances with 24-hour deadlines.

What to do: don't tap. If you're unsure, go to your toll authority's real website — type it, don't search it, since scammers buy ads on those searches too.

The recall

"URGENT: The [product] you purchased has been recalled for a safety issue. Sign in to your account to process your full refund: [link]"

The newest of the three and the cleverest, because it uses your safety instinct and offers you money instead of demanding it.

What they want: your account login for a real retailer, or your card details for the "refund."

The truth: real recalls are announced by the manufacturer and by the Consumer Product Safety Commission. Retailers email you about them, and never ask you to sign in through a link to get a refund.

What to do: don't tap. Check cpsc.gov/recalls yourself, or go to the retailer's site directly.

The pattern under all three

Every one of them is:

Unexpected — it came to you
Small — too small to be worth checking, which is the design
Time-limited — a fee, a deadline, a hold
One tap away — the link does all the work

These are the three signs in miniature. Small stakes lower your guard, and lowering your guard is the entire product.

The one habit that handles all of them

Never tap a link in a message you didn't ask for.

Not to check. Not to see. Not because it looks real. If a message concerns something real in your life, you can always reach it another way: the company's app, an address you type yourself, a number off your card.

There is no message so urgent that it can only be reached through its own link.

Housekeeping

Don't reply STOP. It confirms a live reader. Just delete.
Forward the text to 7726 (SPAM). Free on all US carriers; it helps them block the sender.
Report at reportfraud.ftc.gov if you'd like it on the record.
If you tapped and entered a card number: call your bank, cancel the card, and watch for small test charges. If you entered a password, change it there and anywhere you reused it.

One habit covers all of them

Never tap a link in a message you didn't ask for. That's it — that's the whole defense for this entire category, and it works on the versions they haven't invented yet.

You'll get these texts for the rest of your life. From now on they're just clutter, and clutter is easy.