Everyone loves a surprise package, but scammers are taking the excitement out of that experience by using bogus packages as a cover for a scam that tricks victims into sharing personal information.

Here’s all you need to know about the pending package scam:

How the scam plays out

In the scam, the victim will receive a text message from an unknown number who is an alleged mail carrier or represents a package-delivery service. The contact tells them that they were unable to deliver a package to them. The scammer will then ask the victim questions to confirm their identity, which may include sharing your personal information or credit card details. Don’t do this! Sharing information like this places the victim at high risk for identity theft.

Red flags

There are two red flags that can warn you about this ongoing scam.

First, the original text or email will generally not have any company associated with it. The scammer will only claim to be an employee of a mail or package-delivery service, but will not verify if they work for UPS, FedEx, or another legitimate organization.

Second, the scammers don’t always check if the victim actually has a package in transit. They’ll either assume the victim has recently ordered something online or they’ll claim a friend or family member has sent a surprise gift. If you know you didn’t order anything, you can guess that this is a scam.

How to Avoid Getting Scammed!

Take these precautions to avoid being the next victim of a pending package scam:

• Be wary of unsolicited communications. Your mail carrier and package delivery services will never contact you via text message.
• Track your packages. After placing an order for an item, record the tracking number for the package so you can easily verify its whereabouts. This way, you can quickly confirm the authenticity of any suspicious texts, emails, or phone calls about your package.
• Never share personal information with an unverified contact, especially via text. End the conversation immediately if you suspect this is a scam.
• Never click on links in unsolicited text messages. Links in text messages can download malware onto your computer or device.

If you’ve been targeted

If you believe you’ve been targeted by a pending package scam, please end all contact with the scammer. Delete any suspicious text messages, block the number of the contact and report the scam at FTC.gov.