USPS incomplete address scam

by Tom Richards

Wednesday, Aug 2, 2023

Identity thieves are not sophisticated hackers, nor do they typically wear dark hoodies, but try telling that to the media.
Identity thieves are not sophisticated hackers, nor do they typically wear dark hoodies, but try telling that to the media.

How does the “incomplete address” scam work? What happens if you divulge your payment information? How can you avoid it?

The scam

You receive a text message which looks like a USPS delivery notification. The message indicates that your delivery will not reach its destination due to a problem with your address. Oh no! You must take action now, or the package with your new laptop will remain undelivered!

The message asks you to click a link to confirm your address information.

Screenshot of scam text message

The scammers even know the links don’t work.

Your SMS application knows this message comes from an unknown sender, and gets in your way by disabling links in the message. As a proficient technology user, feeble defenses like this do not pose a problem to you. You bypass this restriction by manually entering the link into your browser (note: do not actually do this!).

You land on a page that looks like this:

Screenshot of scam homepage

Supposedly the USPS website.

A nice and official-looking USPS website! You enter your address details, and click “Continue”:

Screenshot of address entry page

The address entry page.

It then asks you to enter your payment details. You efficiently enter your payment details, and click “Continue” again:

Screenshot of payment details page

The payment details page.

It shows you a fake progress bar. A warm and fuzzy feeling comes over you.

Screenshot of fake loading spinner

A fake “processing” indicator that actually does nothing.

You wait for a short amount of time before it tells you that you have an error in your payment details:

Screenshot of invalid payment error popup

This card cannot be used error message.

Once again, you enter another credit card number for this so-called “free service”, but the page will not accept it. Oh no! Won’t somebody think of your poor laptop!

You feel relieved because you don’t see any charges on either credit card. I suppose we did not care about that laptop after all.

What went wrong

You know something went wrong, but you can’t quite put your finger on it. Let’s take a look at the clues we missed.

  1. First of all, we didn’t take a moment to consider our actions. We just clicked the link and filled out our payment details.

    We could have inspected the tracking number included in the notification first, and looked up the delivery status directly on the USPS website. If the courier could not actually deliver the package, the tracking information page would have told us so.

  2. We manually visited a link in a text message from someone we didn’t recognize.

    Don’t do this. In fact, don’t even bother looking at the URL they send you.

  3. The URL of the page does not look right. It looks like this:

    The domain name has no association with USPS. Scammers will typically try to make the domain name have “USPS” in it somewhere, but they didn’t even bother this time.

  4. The title bar consists purely of non-english characters. At least, the first page does.

    When have you ever used a different language selection on the USPS website?

What happens if you enter your payment details

Some scams ultimately redirect you to the legitimate website, so you think nothing of it. But this one doesn’t. It just keeps asking you to enter your payment details, and then “rejects” them.

The scammers just collect your payment details, then package them up and sell them to other people on the dark web. They do not verify the payment details you enter, so you can enter anything you want. You can enter a fake credit card number, or even a real one. It doesn’t matter to them.

After your credit card information filters through the various darknet marketplaces and gets sold, you’ll start to see charges flow through. Sometimes, this can take a handful of hours, but in some cases the charges won’t show up for at least a couple weeks.

I did not see any activity on my card until more than two weeks after I filled out the form. Below, I list most of the charges that appeared on my card (I may have purged some charges from my records, sorry!):

What?Merchant DescriptorDateAmount
SquareSQ *RUD3 BWOY SMOKE SHJune 2023$85.00
SquareSQ *CARLOGIX AUTO TRANJune 2023$517.50
DoordashQUALITY PIZZA RESTAURANTJune 2023$114.54
Spin ScooterSpinJune 2023$5.00
Spin ScooterSpinJune 2023$5.00
Spin ScooterSpinJune 2023$5.00
DoordashWILLIES TACO JOINTJune 2023$52.76
PayByPhoneMPA PARKIN PAY BY PHONJune 2023$3.25
WaymoWAYMOJune 2023$18.89
PayByPhoneMPA PARKIN PAY BY PHONJuly 2023$3.25
PayByPhoneMPA PARKIN PAY BY PHONJuly 2023$3.25
DoordashDD *DOORDASH MRYOUCHINJuly 2023$58.95
DoordashDOORDASH*MR YOU CHINESJuly 2023$58.95
DoordashDOORDASH*MR YOU CHINESJuly 2023$58.95

All in all, the scammers attempted to charge my card for close to $1,000. None of these charges went through, because:

I did not actually enter my real credit card.

I used a virtual card from I highly recommend using Privacy to protect your purchases online.

Sign up (free!) today and get $5 in Privacy Credit to spend anywhere online!

How to avoid this scam

Just ignore the message. You can effectively avoid scams this way, and you can also use this method to avoid people in general.

“But how can I tell?” you ask. “The message looks so official!”

Using your brain, you can think about the message for five seconds and ask yourself the following critical questions:

Do you know the sender?

Ignore messages from phone numbers or email addresses you do not recognize.

Does it look unprofessional?

Ignore messages or websites that contain spelling or grammatical errors.

Does it urge you to act now?

Do not divulge your personal or financial information for urgent requests.

Does it instruct me to go somewhere else?

Attempt to resolve the problem directly on the courier's website.


Before you act, ask yourself the above questions. Always take a moment to critically think about any unsolicited requests for your personal or financial information.

Remember, if it looks suspicious, ignore it!