Don’t Fall for Fake USPS “Invalid Recipient Address” Scam Stealing Money

The USPS “Invalid Recipient Address” scam is a new phishing technique aiming to steal sensitive personal information from unsuspecting victims. Scammers are sending fraudulent text messages and emails pretending to be from the United States Postal Service. The messages claim that a package cannot be delivered due to an invalid recipient address. They urge recipients to click on a link to correct their address and pay a small redelivery fee. However, the link directs users to a fake USPS website designed to steal personal and financial information.

This article will take an in-depth look at how the “Invalid Recipient Address” phishing scam operates, how to protect yourself if targeted, and ways to avoid falling for similar frauds in the future.

Overview of the USPS “Invalid Recipient Address” Scam

This scam starts with potential victims receiving a text message or email supposedly from the USPS. The message claims a package cannot be delivered due to an invalid recipient address. Scammers pretend to be from the USPS and typically say something like:

“Your package is on hold for an invalid recipient address. Fill in the correct address info by the link below.”

The message urges victims to click on a link redirecting them to a fake USPS site. The fraudulent site mimics a real USPS page and asks victims to enter updated address information. It also requests a small redelivery fee, typically $0.20 to $0.30.

However, unsuspecting users who enter personal data and payment info are at risk of identity theft and financial fraud. The scammers steal sensitive information like names, addresses, credit card numbers, security codes, and more. Data is then used to commit other crimes like opening fraudulent accounts, taking over existing accounts, or selling info on the dark web.

This scam is essentially a phishing attack targeting innocent victims expecting package deliveries. Phishing uses urgent-sounding messages with links to fake sites impersonating trusted brands. The USPS name and logos are used to make the scam appear legitimate. But real USPS communications would not ask for personal info or payments over text or email.

How the USPS “Invalid Recipient Address” Scam Works

Scammers orchestrating this scam are quite strategic in how they target potential victims. Here is a step-by-step overview of how this scam typically works:

1. Scammers Obtain Victims’ Contact Info

The first step is scammers obtaining a database of names, phone numbers, and email addresses. Info like this is easily found online or purchased on the dark web. Scammers may also use botnets to harvest data from public sites and social networks. Accounts with e-commerce sites can be compromised to steal customer contact info too.

2. Scam Texts and Emails Are Sent En Masse

Once scammers compile a list of target contacts, they send out scam USPS messages en masse. Text messages come from a local number pretending to be a postal office. Emails spoof the real USPS domain in the sender address. Both contain urgent wording about an undelivered package and a link to the fake site.

3. Fake USPS Site Requests Updated Address and Redelivery Fee

If recipients click the link, they are taken to a deceiving site mimicking a real USPS page. The site asks users to enter updated address info since the original was “invalid”. A redelivery fee around $0.20 to $0.30 is also requested, making the page appear like a legit USPS payment portal.

4. Users Input Sensitive Personal and Payment Information

Tricked into thinking the site is real, many victims start filling in details like:

• Full name
• Home address
• Phone number
• Credit card number
• Security code
• Expiration date

Some even input their Social Security Number, date of birth, or other info requested. Entering any kind of personal data poses serious risks.

5. Scammers Steal Information for Financial Fraud and Identity Theft

Once submitted, all user data gets stolen by scammers to commit identity theft and financial fraud. Info like names, addresses, and Social Security Numbers can be used to open fake accounts or take over existing accounts.

Stolen credit card details are used to make fraudulent purchases online, resell on the dark web, or create cloned cards. Phone numbers may be targeted with additional smishing attacks or sold to shady telemarketers. The more info obtained, the more ways scammers can financially exploit victims.

How to Identify Fake USPS Emails Related to the “Invalid Recipient Address” Scam

It’s important to be able to recognize fraudulent USPS emails used in the “invalid recipient address” phishing scam. There are several indicators to help discern fake emails from real USPS communications. Learning these email phishing techniques can prevent you from getting scammed.

Analyze the Sender’s Email Address

Carefully inspect the email address in the “From” field of any USPS email. Legitimate messages will only come from an official usps.com email address:

• usps.com
• USPS.com
• notifications@usps.com
• no-reply@usps.com

Scam USPS emails often spoof or mimic real addresses. Look closely at the sender’s full email address and domain name:

❌ uspos.com
❌ alertsusps@email.com
❌ serviceemail@usps-com.net

Fake domains with misspellings or extra words should signal a phishing attempt.

Watch for Poor Spelling and Grammatical Errors

Real USPS emails are professionally written with no spelling, grammar, or punctuation errors. Phishing emails often contain issues like:

• Typpos and mispellings
• Missing or misused words
• Wrong postal terms like “postal code” instead of ZIP CodeTM
• Awkward phrasing and formatting

Messages with multiple issues should be considered highly suspicious. Fraudsters lack the mastery of language real USPS emails have.

Inspect Hyperlinked Text Carefully

Never click links in unsolicited emails. But hovering over hyperlinked text can reveal phishing tricks. Fake USPS links often use deceptive text that differs from the actual URL destination.

Hyperlinks saying “USPS Delivery Update” may actually link to “freepostalreport.com” – a big red flag. Only click links back to usps.com resources.

Check for Requests for Personal Information

The USPS would never ask customers for sensitive information like account numbers, Social Security numbers, or login credentials over email.

Phishing emails try to urgently scare victims into providing personal or financial details. Requests for account updates, package tracking numbers, or payment info signal a scam.

Verify Any Threats or Warnings

Scare tactics are meant to panic recipients into immediate action without thinking. Phishing emails make dubious claims your account is suspended, a package seized, or that you owe postage.

But USPS would not threaten delivery holds or legal action over email. Verify any warnings directly with USPS customer service before taking action.

Stay vigilant analyzing USPS emails for these common phishing indicators. Report scam messages to usps.gov and delete them immediately. Use caution providing personal data when contacted out of the blue online or over email. Protect yourself from fraud with awareness of phishing techniques.

How to Spot Fake USPS Text Messages Related to the “Invalid Recipient Address” Scam

Scammers also use fraudulent USPS text messages, known as smishing, to conduct the “invalid recipient address” phishing scam. Be wary of suspicious texts and know how to recognize real USPS communications.

Verify the Sender’s Phone Number

Carefully inspect the phone number or short code a text is sent from. Legitimate USPS messages will come from an official short code like:

• 28777 (USPS Tracking)
• 69797 (USPS Notifications)

Scam USPS texts often spoof local area codes or use arbitrary short codes:

❌ 888-555-1234
❌ 75309
❌ 39284

Unknown numbers should signal a smishing attempt. Search online to confirm if a short code is truly affiliated with USPS.

Watch for Odd Links and Website Addresses

Real USPS texts would never contain links to outside websites. Phishing texts provide links to shady sites engineered to steal your data when entered.

Hover over any links to inspect the web address. Fake domains with “usps” misspellings like “uspss” should reveal a scam.

Verify Any Threats and Warnings

Smishing texts make dubious claims of unpaid postage, seized packages, or delivery cancellations. But USPS would not threaten holds on shipments or legal action over text.

Inspect texts carefully and confirm any warnings through official USPS customer service before taking action.

Check for Requests for Personal Information

Much like phishing emails, smishing texts try to trick users into inputting sensitive information like account numbers, Social Security numbers, or login credentials.

The USPS would never ask customers for personal or financial details over text. Requests for address updates, package tracking numbers, or payment info signal a scam.

Watch for Poor Spelling and Grammar

Typos, spelling and grammar errors are common in smishing texts from foreign numbers. Real USPS messages are professionally written with no language issues.

Stay vigilant against USPS smishing scams by analyzing texts closely for these red flags. Report scam messages to SPAM (7726) and avoid clicking links or providing personal information requested. Use caution with communications from unknown numbers.

What to Do If You Are Targeted by This Scam

If you receive a suspicious text or email claiming to be from USPS about an undelivered package, here are important steps to take:

Do Not Click Links or Provide Any Information

First and foremost, do not click on any links in the message or enter any personal or financial information on linked sites. The links are a trap to a fake portal used to steal data. Remember – USPS would never request info or payments via text or email.

Report the Scam Message

Report the scam text or email to USPS by forwarding it to spam@uspis.gov. You can also file a complaint with the Federal Trade Commission at ReportFraud.ftc.gov. Reporting scams helps authorities track down and stop fraudsters.

Contact Your Bank

If you did provide credit card information, immediately contact your bank and report the fraudulent charges. Your bank may be able to freeze the card, dispute the charges, and prevent further fraudulent use.

Reset Online Account Passwords

Also change passwords for any online accounts that use the same username and password combination entered on the fake site. Scammers may leverage credentials to gain access to other accounts. Use strong, unique passwords for every account.

Monitor Accounts and Credit Reports

Carefully monitor bank and financial accounts for any suspicious activity, as well as your credit reports for any unauthorized activity. Placing a fraud alert or credit freeze can help protect against identity theft.

Beware of Recovery Scams

Be cautious of any call, email, or text claiming they can recover lost money or compromised information. This is likely another scam attempt. Only work directly with your bank or legitimate law enforcement.

How to Avoid Falling Victim to Similar Scams

While scams are getting more sophisticated, there are ways to avoid falling victim to phishing attacks like the USPS invalid recipient address scam:

• Never click links or call numbers in unsolicited messages – Be skeptical of texts, social media messages, emails, or calls claiming there is a problem with an account or requesting personal information. Calling a number or clicking a link verifies to scammers that they reached a real, active person. Legitimate companies won’t ask for info this way.
• Set up multi-factor authentication – Turn on multi-factor authentication for banking, email, social media, and other online accounts. This adds an extra layer of security beyond just usernames and passwords.
• Create strong, unique passwords – Avoid password reuse by generating complex, unique passwords for each online account using a password manager. Weak, duplicated credentials allow scammers to infiltrate multiple accounts.
• Keep software updated – Maintain the latest security updates for all devices and software. Updates patch vulnerabilities that scammers exploit to steal data and spread malware.
• Be wary of unsolicited calls and texts – Don’t answer or return calls from unknown numbers. Let unknown numbers go to voicemail. Scammers use robocalls and smishing to find live targets.
• Consult legitimate websites or apps – If you get an urgent request regarding an account, consult the official website or app first. Don’t rely on texts or emails alone. Search for the company’s official contact info to verify legitimacy.
• Monitor your accounts and credit reports – Routinely check all financial accounts statements and credit reports for any unusual activity. It’s easier to spot fraudulent activity early by monitoring closely.

Is Your Device Infected? Run a Free Malware Scan

Slow performance, constant pop-ups, or strange behavior? These are classic signs of a malware infection. The fastest way to find out is to scan your device with Malwarebytes Free — one of the most trusted malware removal tools available.

The free version detects and removes the most common threats, including:

• Adware — the cause of those annoying pop-ups
• Browser hijackers — unwanted redirects and changed homepages
• Trojans and spyware — hidden programs stealing your data
• Potentially unwanted programs (PUPs) — software you never asked for

👉 Select your device below — Windows, Mac, or Android — then follow the simple steps to download Malwarebytes, scan your system, and remove any threats it finds. The scan usually takes 5 to 20 minutes.

Stay Protected: Block Ads and Malicious Sites

Now that your device is clean, keep it that way. Most infections start with a malicious ad or a fake download button — so blocking them at the source is your best defense.

We recommend AdGuard, which blocks malicious ads, phishing pages, and dangerous redirects before they can reach you.

👉 Download AdGuard and browse safely

Frequently Asked Questions About the USPS “Invalid Recipient Address” Scam

This FAQ section provides key information about the USPS “Invalid Recipient Address” phishing scam targeting unsuspecting victims. Learn how to spot this scam and protect yourself from fraud.

What is the USPS “Invalid Recipient Address” scam?

The USPS “Invalid Recipient Address” scam involves fraudulent text messages or emails pretending to be from USPS. The messages state a package can’t be delivered due to an invalid recipient address. They provide a link to correct your address and pay a small redelivery fee. However, the link goes to a fake USPS site designed to steal personal and financial information for identity theft and credit card fraud.

How does the USPS invalid address scam work?

Scammers send text messages or emails with USPS branding claiming a package can’t be delivered to you due to an invalid address. The message urges you to click a link to correct your address and schedule redelivery by paying a small fee, usually $0.20 to $0.30. But the link goes to a fake website impersonating an official USPS portal to steal your data.

What are examples of the fake USPS messages for this scam?

Examples of fake messages used in this scam include:

• “USPS: Your package is on hold for an invalid recipient address. To reschedule delivery please click here.”
• “Attention: We were unable to deliver your package due to an incorrect address. Please verify your information here.”
• “USPS Delivery Failed – The address entered for your package delivery is invalid. Please update your address here.”

What happens if you click the link in the fake USPS messages?

The link in the fake USPS messages directs victims to a phishing website pretending to be a real USPS portal. The site requests users enter personal info like your name, address, phone number, credit card details and more under the guise of collecting updated address data and a redelivery fee payment. In reality, all data entered is stolen.

How can you tell if a USPS text or email is fake?

To identify fake USPS communications:

• Inspect the sender’s address – Real USPS emails come from usps.com addresses only.
• Check for typos & grammatical errors – USPS messages are professional with no mistakes.
• Do not click links – USPS never sends texts/emails with links to account pages.
• Hover over links to inspect the URL – Fake links often have misspelled or forged domains.
• Call USPS directly if concerned about a message.

What should you do if you get a fake USPS message?

If you receive a suspicious USPS text or email:

• Do not click any links or provide personal or payment information.
• Report the scam message by forwarding it to spam@uspis.gov.
• If you entered payment info, call your bank immediately to freeze your card and dispute the charges.
• Change passwords on any accounts that may have been compromised.
• Watch for signs of identity theft or account breaches.

How can you protect yourself from the invalid recipient address scam?

To avoid falling for this scam:

• Never click links or call numbers in suspicious texts or emails.
• Use multi-factor authentication for online accounts.
• Create strong, unique passwords for all accounts.
• Keep software updated to patch vulnerabilities.
• Consult official sites if contacted about your account.
• Carefully monitor financial accounts and credit reports.

What is phishing and smishing?

Phishing is when scammers use fraudulent emails, sites, or forms to steal personal information. Smishing is phishing conducted over SMS text messaging. The invalid recipient scam uses both tactics to bait victims.

What should you do if you already fell for this scam?

If you provided your information:

• Contact banks to freeze/cancel cards.
• Place fraud alert on credit reports and review for any suspicious activity.
• Reset passwords on compromised accounts and enable two-factor authentication.
• Watch out for recovery scams contacting you to prevent more loss.

How can I report this scam or cybercrime?

To report this scam, cybercrime, or identity theft:

• File a complaint with the FTC at ReportFraud.ftc.gov.
• Report ID theft to the FTC at IdentityTheft.gov.
• Contact your state attorney general office to file a complaint.
• Notify the major credit bureaus and your banks of any fraud.
• File a report with your local law enforcement agency.

Stay vigilant for new variations on the USPS invalid recipient address scam trying to phish for personal data. Perform online safety best practices to avoid exposure.

The Bottom Line

Scammers are constantly evolving their tactics and the USPS invalid recipient address is one of their latest ploys. This scam leverages fake postal service messages to trick unsuspecting targets into providing personal and financial data. This information is then used for identity theft and financial fraud.

The best way to avoid this scam is being aware of the tactics, verifying message legitimacy, and refraining from providing info or clicking links in unsolicited communications. Protect all accounts with strong passwords and multi-factor authentication. Report any scam messages and suspicious activity to stop these fraudsters in their tracks. Stay vigilant against new schemes aiming to steal personal data and assets. Don’t let scammers packages promises lure you into divulging sensitive information.