Texts and calls

The ring doorbell package theft text scam, taken apart

Updated 6 October 2026

You assume the clip is real, because the doorbell camera caught it. That is the costly assumption. The whole message is built so the fear of a stolen parcel makes you tap the link before you read it, and the link is the actual theft.

What the ring doorbell package theft text looks like

The pitch arrives as an SMS or an email that looks like a delivery alert or a Ring or Nest notification. The body says a package was taken from your porch, and a short video is attached, or a link is offered so you can watch the clip. The video, if you tap it, shows a stranger walking up to a front door, lifting a box, and walking off. Your address is in the message. Sometimes your name is too. The tone is urgent, the sender looks like a courier or a camera brand, and the page you land on is built to feel official.

By October 2026 the Federal Trade Commission and several state attorneys general have logged thousands of these messages. The shape is consistent. A piece of personal information, a fear of loss, and a link that looks like the natural next step. The page behind the link asks you to log in, pay a small re delivery fee, claim a refund, or verify your address. Every one of those steps is the con.

Why a real video makes the trap work

A photo of a parcel on a porch is easy to dismiss. A short video of someone taking it feels like proof. Scammers know this, which is why the message is engineered around the clip rather than the package. The video is stolen or staged. It is not your door. The same clip gets reused across thousands of messages because most readers never look past the first second.

The second trick is the personal detail. Your name, your street, sometimes a past delivery. None of that is hard to find on people search sites, and the same data feeds the ring doorbell scam text and the broader category of delivery scams 2026 that have crowded out the old fake courier pages. A real courier does not have your doorbell footage. A real courier does not text you a video at all.

The three things the link is actually after

Most of these pages are chasing one of three things, and a clever one chases all three at once. First, your login. The page is styled as Ring, as Amazon, as UPS, as a bank, or as a video hosting site. The moment you type your email and password, the scammer tries those details on every other site that matters. This is the same trick behind the Netflix payment failed email and text, which uses a familiar brand to pull credentials rather than money.

Second, your card. The page asks for a small redelivery fee, a signature fee, or a refund you need to claim. The amount is small on purpose, under five dollars, so the loss feels boring when it lands. The card is the real prize, and the small charge is the test that tells the scammer the card is live.

Third, your address and phone number, confirmed. If you typed them into a form, the scammer now has a record that is sharper than anything on a people search site. That confirmed record sells for more, and it gets reused in the next round of messages.

How to tell the real Ring alert from the fake one

Ring and Nest do send motion alerts, but those alerts live inside the app on your phone, not in your SMS inbox. If a delivery or theft video arrives as a text from a number you do not recognise, treat it as a scam by default. If it arrives as an email, check the sender domain. Real Ring mail comes from ring.com. Real Nest mail comes from nest.com. Anything close but not exact, such as ring-alerts.co or nest-secure.app, is a fake.

The video itself is the give away when you stop and look. The house is not yours. The lighting does not match. The courier uniform, if there is one, is a stock photo. Most of the clips in circulation in October 2026 come from a small library of stock footage that gets swapped between scam pages. Search the filename of any video you receive on a desktop browser and you will usually find the original.

What to do in the first five minutes

Do not click the link. That is the rule that protects every other rule. If you already tapped, do not fill in any form. Close the page. If you typed a password, change that password on the real site, and on any other site that shares it. Turn on two factor authentication if you have not already. The SIM swap text and what your carrier will actually do covers how a stolen password can lead to a stolen phone number, and why a second factor matters.

If you typed a card, call the bank and ask for a new card number. Do not wait for the small test charge to clear. Ask the bank to flag the merchant descriptor so any future attempt is blocked. If you entered your address and phone into a fake form, treat that data as exposed and tighten the privacy settings on the accounts that use it for recovery.

Where to report a scam text or email like this

Forward the message to 7726, which spells SPAM on a phone keypad, and your carrier will log it. In the United States you can also report the message to the FTC at ReportFraud.ftc.gov and to the Internet Crime Complaint Center at ic3.gov. If the message pretends to be a specific carrier or retailer, forward it to that brand's abuse address as well. Ring takes abuse reports at abuse@ring.com, and most major couriers have a similar inbox.

If the fake video is hosted on a social platform, use the report button on the post itself. The platforms have a duty to take down cloned footage, and the faster you flag it the fewer people will see it. If you lost money, file a police report through your local non emergency line so there is a paper trail. The paper trail is what banks and insurers ask for when a refund is on the table.

The law on impersonating a courier or a camera brand

In the United States, the FTC Act lets the agency go after companies that impersonate other brands, and the agency has used it against delivery scams 2026 in a string of settlements. Several states have their own statutes. California Business and Professions Code 17580 makes it illegal to send unsolicited commercial email that spoofs a sender. New York General Business Law 399 aa covers similar ground for text messages.

If the message crosses a state line or touches a federal interest, the Department of Justice can charge wire fraud under 18 U.S.C. 1343, and the FBI's Internet Crime Complaint Center is the place that aggregates those cases. For a single consumer, the law matters less than the report. Every report is a data point, and the agencies use those points to build the cases that shut the rings down.

How to recover money if you already paid

If the loss was on a credit or debit card, call the bank and ask for a chargeback. Under the Fair Credit Billing Act, credit card chargebacks for fraud are a right, not a favour, and most banks will process them within ten business days. Debit card recovery is messier because the money has already left the account, but Regulation E gives you sixty days from the statement to dispute an unauthorised transfer. Move fast. The longer you wait, the harder the bank can make it.

If the loss was through a payment app such as Zelle or Venmo, the recovery odds are low. The bank-to-bank Zelle transfer scams that hit in 2024 set the template, and the apps have not changed their position. Report the transfer inside the app, then call the bank that funds your account and ask for a reversal. If the scammer cashed out within the hour, the money is gone. The Unpaid toll text scam and how to tell it from a real toll notice covers a sibling case where small dollar losses are used to launder bigger ones, and the same logic applies to a small redelivery fee.

How to harden your phone against the next wave

Turn on filtering for unknown senders in your SMS app. Both iOS and Android ship with one, and it moves messages from numbers you have never texted into a separate tab. This is not a fix on its own, because the ring doorbell scam text often comes from a number that has texted you before, but it cuts the volume and gives you breathing room.

Use a password manager and a unique password for every account. The day you type a password into a fake Ring page is the day the scammer tries that same email and password on every bank, email, and shopping site that matters. A password manager makes the second site throw a fit when the wrong password is entered, and that early warning is the closest thing to a refund you will get. The AI voice clone calling about your grandchild is the voice version of the same trick, and the same password hygiene will limit the blast radius if you ever pick up.

The pattern under the pattern

The ring doorbell scam text is one shape in a long line. The unpaid toll text, the jury duty call, the Netflix payment failed email, the Zelle refund pitch, the wrong number opener, the package you did not order, all of them trade on a small piece of personal data and a moment of fear. The fear is the lever. The data is the handle. The link is the cash register.

Once you see the shape, the messages get easier to read. The name of the brand on the message does not matter. The video in the message does not matter. The only thing that matters is whether you typed anything into the page behind the link. If you did, change the password, freeze the card, and report the message. If you did not, delete it and move on. The next message is already on its way.

This is general safety information, not legal advice. Scams change. If you need an official desk: FTC ReportFraud or IC3.