Texts and calls

The Postmates Account Takeover Text, October 2026 (52ch)

Updated 20 October 2026

You are sitting on the bus and a text lands that says your Postmates account is locked, or that a new card has been added, and the only way to keep your food money safe is to tap the link in the next ten minutes. The costly assumption is that a delivery app texts you about money at all, because it almost never does, and the link is the entire point of the message. Account takeover is not new but the Postmates flavour of it is having a moment in October 2026 because the app sits in millions of phones, holds a saved card, and is trusted to charge small amounts without a second thought.

What the Postmates takeover text actually says

The two scripts doing the rounds in October 2026 both lean on urgency, and both arrive as SMS rather than push notification. The first script claims your account has been locked because of suspicious activity and asks you to verify your identity to restore access. The second claims a new card has been added to your account and gives you a short window to confirm or remove it. Both end with a link that looks like a Postmates domain but is not.

The links in active campaigns resolve through several redirect hops, usually beginning with a shortener and ending on a page that mimics the Postmates login with very high fidelity, right down to the green and the old courier icon. The page asks for your email or phone, your password, and then a one time code that arrives by SMS in real time. That last field is the giveaway. Postmates does not need a code you receive by text to log you in. The code is for the attacker, who is typing it into the real Postmates site from a browser in another country while you read it off your messages app.

There is a quieter variant that does not ask for a password at all. It only asks for the one time code, on the theory that a great many people have already used the same password somewhere and the attacker is hoping the code is enough to finish a session they started with a credential they bought. Either way the goal is the same, which is to be logged in as you, with your saved card, your order history, and your delivery address.

What the attacker does once they are in, and the law they are breaking

A working Postmates account is a small but flexible financial instrument. The attacker usually starts by changing the email and password, which kicks your real session out within a minute. They then look at the order history to learn your home or work address, and at the saved card to see the last four digits and the brand. From there the play splits.

Some attackers order food to your address on your card and then contact you from a second number pretending to be support, offering to cancel the order in exchange for the code that just arrived. This is the refund and cancellation double tap, and it is the one that hits hardest because the threat feels real and the food is actually on the way. Other attackers add a new card, usually a stolen one, and use the account to launder small purchases through a delivery they collect themselves. A third group simply sells the verified account on for a few dollars, bundled with the address book, and moves on.

Every one of those steps is a crime. In the United States, the Computer Fraud and Abuse Act covers unauthorised access to an online account, the Access Device Fraud statute covers the misuse of a saved card number, and most states have their own identity theft and unauthorised charges statutes that apply on top. In the United Kingdom, the Computer Misuse Act 1990 and the Fraud Act 2006 cover the same ground, and Action Fraud is the reporting route. None of that helps you in the next ten minutes, but it matters when you file the police report that your bank will ask for.

For a sense of scale, the FBI Internet Crime Complaint Center logged 859,532 complaints in 2023 with reported losses above 12.5 billion dollars, and phishing and spoofing together remained the most reported crime type. Account takeover sits inside that bucket, and delivery app accounts have been a growing slice of it through 2025 and into 2026.

What to do in the next ten minutes if you tapped

If you only opened the link and did not type anything, you are probably fine but you should still treat the message as hostile and delete it. If you typed your email and password, that password is now in someone else's hands, and the clock is on. Open the Postmates app from the home screen, not from the link, and change your password to something you have not used anywhere else. A password manager helps here, because it will offer a long random string and remember it for you. While you are in the app, check the card on file. If a card has been added that is not yours, remove it, then go to your real bank and rotate that card number, which most banking apps will let you do without a phone call.

If you typed the one time code, the situation is worse because the attacker is likely already in. From a desktop browser, go to the real Postmates site and use the sign out of all sessions option if you can find it, then change the password and the email on the account, and add two factor authentication if it is not already on. If two factor was on and the attacker still got in, the SMS code was the weak link, so switch the second factor to an authenticator app rather than SMS where the platform allows it.

Pull a recent statement and look for orders you did not place. If you find any, screenshot them with the order number, the restaurant, the delivery address, and the timestamp, because the bank and the police will both want that. If a real order was placed and is on its way to your address, do not engage with the courier. Let the order complete if it is safe to do so, and dispute the charge with your card issuer rather than trying to recover the food.

If the attacker contacts you by text or call claiming to be Postmates support, end the conversation. Postmates support will not text you from a personal number, will not ask for a code by SMS, and will not call you to ask for your password. Real support is reached through the help section of the app, and that is the only path worth using.

How to tell the real Postmates from a fake one

Postmates does send emails, and it does send push notifications from inside the app. It does not normally send security SMS to a number you did not give it, and when it does, the message is a heads up, not a demand. The link in any real message points at postmates.com or a subdomain of it, and you can verify that by long pressing the link on a phone and reading the destination before you tap. A short link that hides the destination is a small red flag, and a link to a domain that is almost postmates but not quite, like postmates-verify or postmates-secure, is a much larger one.

The page itself also gives the game away if you look. A real Postmates page is loaded over https with a certificate that matches the domain. A phishing page often has a certificate that does not match, or it loads over http with a green padlock painted into the page as a static image. If you tap and the address bar shows anything other than postmates.com, close the tab and start again from the app.

Push notifications from the real app do not ask you to verify by SMS. They tell you that your order is on the way, that a refund has been processed, or that a card on file is about to expire. If a push notification asks you to tap a link and enter a code, treat it as hostile and uninstall the app, then reinstall it from the official store before doing anything else.

How to harden the account so the next one bounces

Two factor authentication is the single biggest lever, and SMS based two factor is better than nothing but is no longer the best option. An authenticator app, such as the one built into most password managers or a standalone option like Google Authenticator or Authy, generates codes locally and is not vulnerable to a SIM swap. If Postmates offers app based two factor, turn it on. If it only offers SMS, turn that on and accept the tradeoff, but call your carrier and add a port out PIN so a stranger cannot move your number to a new SIM.

Use a unique password for Postmates. Credential stuffing is the engine that drives most account takeover, and a password that you have used on another site is a guess waiting to happen. A password manager will generate and remember a long random string for you, and the only password you actually need to remember is the one that opens the manager.

Set a transaction alert on the card that is on file. Most banks will text or push a notification for any charge above a threshold you choose, and a one dollar charge from Postmates that you did not make is the earliest warning you can get. The earlier you catch a card swap, the less an attacker can do with it.

Finally, treat any text about money as guilty until proven innocent. Delivery apps, banks, payment apps, and tax authorities all prefer their own app or a paper letter to an SMS, and a text that demands a tap within a window is almost always a scam. Slow down, open the real app, and check from the inside.

This is general safety information, not legal advice. Scams change. If you need an official desk: FTC ReportFraud or IC3.