Scammers Go Smishing to Exploit Shipping Delays

If you get a text from the USPS or other carrier, think twice before clicking on links contained in the message. Fraudsters are exploiting holiday shipping delays with "smishing" campaigns sent via text messaging.

Like phishing emails, smishing texts are made to look like they are coming from a trusted source. Our social media channels are filling up with examples of smishing texts buyers and sellers have received made to look like they're sent by USPS about recent shipments.

A reader sent us an image of a text they saw a seller post on Facebook. It read as follows (with certain details redacted):

"USPS: (name), your parcel (number) was supposed to be delivered before Christmas. Clam here- (URL) and claim compensation."

The US Postal Service Inspector General's office had warned the USPS about smishing activity after seeing an article on TripWire.com in September. The Postal Service responded with a "smishing awareness campaign" to the public on the Postal Inspection Service website in October.

The USPS also said its Corporate Communications department would work with the Postal Inspection Service to promote awareness of smishing campaigns across Postal Service social media channels and alert customers of these events on usps.com, to the extent possible.

"Management will, at least monthly, link to the Postal Inspection Service's website and online information as it becomes available. The target implementation date is February 2021," the USPS wrote in its response to the Inspector General.

Smishing texts, just like phishing emails, attempt to trick users into clicking on links that are connected to fraudulent sites that could steal credentials or propagate malware.

Such attacks are not new. In fact, the FTC published a post in February, "Is that text message about your FedEx package really a scam?" It published a graphic of a text message reading, "Hello James, your FEDEX package with tracking code GB-6412-GH83 is waiting for you to set delivery preferences: (hyperlinked URL)."

Above: FTC warns consumers about smishing text messages. 

As usual, scammers exploit current events, and with the chaotic holiday shopping leading to severe delivery delays, buyers and sellers may be more easily tricked into clicking on links.

The FTC offered the following tip: "If you get an unexpected text message, don't click on any links. If you think it could be legit, contact the company using a website or phone number you know is real. Don't use the information in the text message."

If you see examples, please feel free to share them in the comments below. Seeing the various approaches scammers take can help us all stay on guard.