The other morning, while lying in my bed and hitting the snooze button for the third time, I did what we all do and grabbed my phone.  To my surprise, I received a deceptive text claiming to be USPS stating that my package was damaged, the address information was lost and my package couldn’t be delivered.  Sarcastically, I mutter to myself “Oh no!  What am I to do?”.

This appeared to be a classic smishing scheme.  Smishing (SMS + Phishing) is a scam where someone tries to trick the victim into giving away personal and financial information by impersonating a person or company.  This could be used to steal login credentials, credit card numbers, social security numbers and other sensitive information.  In some cases, it may lead to activating a virus or malware on our device that could steal sensitive information.

This is why I never click on links that I don’t trust.  Always practice Stop, Think, and then Click.

Thankfully, I’m pretty skeptical of all texts and emails these days because phishing and scamming have become so prolific, it’s hard to trust even legitimate communications.  However some key observations stood out to me in reviewing this text message.

This was the biggest red flag for me.  Fortunately, I wasn’t expecting a package so I had no sense of urgency or concern regarding the matter.

However, if I were expecting a package, like an expensive electronic gadget, I would be concerned about receiving my package in a timely manner.  In this case, the language that the scammer used “Please be sure to update the delivery address information in the link within 12 hours” would have created a real sense of urgency for me to act.

Urgency is a common tactic that scammers use to get us to act without thinking.  They first invoke emotion with fear such as “oh no, my package isn’t going to arrive” and then amplify it with the thought “oh no, I only have 12 hours to act”, otherwise I won’t get my package.

#2: USPS will not initiate contact via email or text message

According to the United States Postal Inspection Service (USPIS):

“The Postal Service offers free tools to track specific packages, but customers are required to either register online, or initiate a text message, and provide a tracking number. USPS does not charge for these services! USPS will not send customers text messages or e-mails without a customer first requesting the service with a tracking number, and it will NOT contain a link. So, if you did not initiate the tracking request for a specific package directly from USPS and it contains a link: don’t click the link!”

#3: The text message link is not from the official usps.com website

As we established in Number #2, USPS will not send a link, but we’re going through our investigative steps here.

The link contained “usps” as a subdomain, which is not the official USPS domain, indicating a scam.  The scammers were hoping that I would gloss over the fact that they are attempting to send me to a different domain that they, the attacker controls.

For a URL to the USPS website, we’d expect the text right before .com to be “usps”.  USPS’s domain name is “usps.com”.

Subdomain spoofing uses familiar words (e.g. “usps”) as a subdomain to trick users into clicking on a link to a website that the attacker controls.

https://usps.attacker123.com is owned and controlled by attacker123.com, not USPS.

#4: The text message was from a phone number

“USPS utilizes the 5-digit short codes to send and receive SMS to and from mobile phones.”

The presence of a shortcode isn’t a foolproof way to decipher smishing texts vs legitimate texts, but it’s a helpful piece of information.  Because we know that USPS uses the 5-digit SMS short codes, we know that we can dismiss any text message claiming to be USPS that use a regular phone number.  It automatically becomes a red flag.

Again, worth noting that according to USPIS:

“USPS will not send customers text messages or e-mails without a customer first requesting the service with a tracking number, and it will NOT contain a link”.

How This USPS Phishing Text Scam Is Really Sneaky but Detectable

Well, I somewhat screwed up here.  My plan was to visit the link in a sandboxed environment to safely share what the scammers have in place.  However, I let this task sit in my backlog for too long and the site is no longer active.  Which overall is a good thing.

Hypothetically, let me share what I think we’d see.  I think we’d very likely see a website that gives us the impression that we landed at the official USPS website.  From here, it could go a few different ways.

By impersonating the official website, they might try to trick me into logging into a fake login form.  This would allow them to steal my login credentials and allow the scammer (now hacker) to be able to take over my account.

Scenario 2: Stolen Sensitive Personal Information from a Phishing Attack

Remember, in this scam they told me I had 12 hours to update my delivery address to retrieve the damaged package.  Because of this, I’d expect at a minimum that the scammers would have a form that collects personal information.  It would also likely include sensitive personal information that they could use to steal my identity in other attacks.

Scenario 3: Stolen Financial Information from a Phishing Attack

They might ask for credit card or bank account information to perform “processing” in the recovery of my package.  Remember, in this hypothetical scenario, the scammer’s page is impersonating the USPS website, which is an organization that I and most of us would generally trust with payment information.

I’d expect a payment request scam to be combined with Scenario 2 in the collection of personal information.

There could be something on the page that triggers the installation of viruses or malware, which could further steal information from the device that I’m using.

What I’d Do If I Fell For Any Of These Scam Scenarios

Note, there may be other scam scenarios that I haven’t covered or thought about at the moment.

How I’d Handle an Account Takeover Attack

If I were to give up my credentials through a malicious login form and realize it within a timely manner; I’d immediately change the login credentials and enable two-factor authentication.  Hopefully, in this case, I’d be able to beat the hackers before they take over my account.  If they do take over the account, then I’m at the mercy of the service (hypothetically USPS) to help me recover my account.

Because I don’t reuse passwords, my exposure should be limited to the account that has been taken over.  However, if I were reusing passwords, I’d need to immediately change the passwords for those accounts with reused passwords so they don’t also get hacked as a result of this phishing attack.

How I’d Handle Stolen Personal Information from a Phishing Attack

If I were to give up my sensitive personal information, then I need to be in a position where I need to play a little defense.  I personally use Credit Karma to monitor my credit accounts so, I’d pay close attention to any changes there.  Additionally, I’d consider freezing my accounts at the credit reporting agencies (Equifax, Experian and Transunion).  

Note that free annual credit reports are available from each of the three credit reporting agencies. However, if I knowingly gave my personal information to a scammer, I’d want to keep closer tabs on my credit to make sure financial accounts are not opened in my name.

Additionally, I’d keep a close eye on all of my accounts for any strange activity that may be as a result of this hack.

How I’d Handle Stolen Financial Information from a Phishing Attack

If I were to give up financial information, then I’d immediately call my bank or credit card company and freeze those accounts.  If it’s a credit card, it’s likely a little easier to cancel and get a replacement card.

Freezing a bank account or debit card might be a little more impactful to my daily life, but I’ve got to prevent the criminals from taking my money.  I imagine banks are very used to dealing with fraudulent and unauthorized transactions so they should be able to guide me through the appropriate steps in this process.

How I’d Handle a Virus or Malware Attack

If I realize that I have visited a malicious website, I am at a minimum running a virus or malware scan on that computer or device.  Before doing so, I’m going to make sure that the anti-virus software has the latest updates.

In specific situations where I believe the attack is more severe, I might take the additional step of completely wiping my harddrive, reformatting and reinstalling everything from scratch.  This is a little more extreme and before doing so, it might be a good idea to consult a computer repair specialist.

Hopefully, the awareness of these deceptive USPS smishing (SMS + phishing) schemes and my rambling hypotheticals & investigation tactics will empower you to identify and feel confident in tackling these attacks.  If it’s too late and you have been scammed, the FTC has a great resource called What To Do if You Were Scammed.

If interested in being more proactive in your approach to your online security, then check out our Free More Secure in 5 Challenge.  In just 5 days we’ll help you set up some foundational security practices to help protect you and your accounts.

I received a deceptive text claiming to be USPS stating that my package was damaged, the address information was lost and my package couldn’t be delivered. It informed me that I had 12 hours to update my delivery information.  This appeared to be a classic smishing scheme.  Smishing (SMS + Phishing) is a scam where someone tries to trick the victim into giving away personal and financial information by impersonating a person or company.

I received a deceptive text claiming to be USPS stating that my package was damaged, the address information was lost and my package couldn’t be delivered. This appeared to be a classic smishing scheme.  Smishing (SMS + Phishing) is a scam where someone tries to trick the victim into giving away personal and financial information by impersonating a person or company.

It seems like every month or so, I receive another letter in the mail, informing me that my data has been compromised in a company’s data breach. Often, the personal information stolen in the breach includes login credentials, phone numbers, addresses, social security numbers, and even driver's license numbers. With every data breach, hackers are obtaining puzzle pieces to either impersonate my identity or hack my other online accounts.

Keep in mind that by the time we receive a notification of a data breach, months may have already passed, during which a hacker could misuse our information.  It can take some companies a long time to figure out what has been stolen, if they even know that they have been breached in the first place.

With the increasing prevalence of company data breaches, we all need to take a more proactive approach to keeping our information secure.  Here are 3 steps I take to proactively protect myself from future company data breaches.

The first step I take is to make sure that all of my account passwords are strong and unique.

A strong password involves a complex combination of alphanumeric, symbols and upper & lower case characters. Length is an important factor.   Typically, a strong password contains at least 12 characters or more.

I personally use LastPass as my password manager.  The benefit of using a password manager, like LastPass, is that it helps me create and store complex passwords.  That way, I don’t have to worry about the specifics and also don’t have to remember the password, which can be tough when designing a truly complex password.

In the context of a company data breach, it’s really important to use unique passwords among various accounts.  If a hacker obtains login credentials containing username and password, guess what they will do?  They are going to try that username and password on other websites.

Reusing passwords is really dangerous, because a leaked username and password can lead to unauthorized access as hackers attempt to login to other websites using that same username and password.

3 Steps I Take to Protect Myself from Company Data Breaches

Use 2-Factor Authentication Everywhere Possible

The second step that I take is to use 2-factor authentication everywhere possible.  That way, if my password is stolen in a data breach or data leak, attackers still need that 2nd factor of authentication to access my account.  This might be a lifesaver in preventing unauthorized access to my accounts.

Also, we all carry phones around with us all day anyways so, the hassle factor of using a 2-factor authentication app or SMS authentication is relatively small.

When hackers obtain my personal information they may try to impersonate me by attempting to make modifications to my existing accounts or open new accounts.

To help monitor this, I use credit monitoring to watch for changes to my credit accounts.  This includes notifications for new credit accounts created in my name with my social security number.

There are a lot of credit monitoring services available.  I simply use Credit Karma’s free credit monitoring service.  They send a lot of email, but they do send notifications when changes are observed with my accounts as reported to credit reporting agencies.

Free annual credit reports are available from each of the three credit reporting agencies (Experian, Equifax and Transunion); however, I think it’s important to continually monitor credit accounts for any changes.

A better solution to credit monitoring would be to just freeze my credit at each of the credit reporting agencies.  This is not something that I have done personally yet.  However, I think it’s a great step and I plan to do this in the near future.  

Freezing my credit might create some new hassles including unfreezing my credit accounts to apply for new credit such as buying a car, house or getting a new credit card.  However, my rationale is that these company data breaches are an ongoing problem, so it’s just a matter of time before someone tries to use my social security number to open an account in my name.  I’d rather deal with the hassle of unfreezing credit accounts versus dealing with the fallout from unauthorized accounts being created through identity theft.

These are three of the security practices that I use to help protect myself against future company data breaches.  Note that none of these security practices prevent the data being stolen in the first place.  The sad news is that nothing we do will prevent that, because once we give up our information to a company or service, we are largely entrusting our data to that organization's security practices and defenses.

Before we give companies our information, we need to ask ourselves if we trust them to keep our data safe and monitor for intrusive hackers.  Also, do they really need the information that they are requesting?  We must be prepared to accept that any information we give a third-party could be stolen or leaked in a data breach.

With the increasing prevalence of company data breaches, we all need to take a more proactive approach to keeping our information secure.  Here are 3 steps I take to proactively protect myself from future company data breaches.

In Episode 5 of The HappyPath Media Show, we covered a story about a Bay Area family who experienced a crazy ordeal involving scammers using AI technology. The mother received a phone call from someone who she believed to be her son, claiming that he was in a car accident and had been arrested.  The phone call was convincingly realistic sounding and resembling the voice of her son who happened to be away at college.

Apparently, the scam played out by the scammers passing the call to a (fake) police officer who informed the mother that her son had been in a car accident involving the injury of a pregnant woman.  According to the fake police office, the son had been arrested.  These details were obviously used to heighten the emotional elements of this scam, which was already a tense and frightening story.

Following the conversation with the fake police officer, the call was passed to a fake public defender.  The mother was informed that her son’s bail was reduced from $50,000 to $15,000 and that she needed to get the money quickly.  She was informed not to tell anyone why she needed the money in order to protect her son’s reputation.

The family was convinced by the urgency and seeming legitimacy of the situation.  The parents withdrew the demanded amount, but the scam unraveled when the fake "public defender" said that he was going to send a courier to collect the money.  This raised some red flags for them.  As suspicions were heightened, the family did the right thing and contacted both the police department and the son directly.  It turns out that neither the police department nor the son were aware of the situation and everyone was safe.

Terrifying AI Voice Cloning Scam That Nearly Succeeded

This is a frightening scam where AI voice cloning is used to make the story more believable.  With some basic voice samples, a scammer can now convincingly mimic a person's voice.  This tricks victims into believing that they are talking to the real person.

In this story, the use of the son’s voice not only helped make the scam more believable, but helped heighten the emotional stress of the situation. Oftentimes, scammers will use emotion to get their victims to act quickly without much thought.

Unfortunately, with all this deep fake technology, we are entering a world where you can’t trust anything.  In this story, the family did the right thing.  They ended the conversation with the scammers and directly contacted both the police department and the son.  

Always question emotionally charged communications where someone is asking for sensitive information or money.  Ask yourself, “Did I contact them, or did they contact me?”.  If it’s the latter, it’s best to hang up and dial directly.

This story is very frightening because it brings to light the dangers of AI technology in the wrong hands.  We are all going to have to be more vigilant and proactive verifying our communications to ensure we’re not being scammed or taken advantage of.

A terrifying story about how AI voice cloning technology is used in an attempt to trick parents into thinking their son had been arrested.  The scam involves talking to fake police officers and fake public defenders in an attempt to collect fake bail for the son.

A Terrifying AI Voice Cloning Scam That Nearly Succeeded

Ep 08: Fake Security Apps, Real Estate Fraud, and Crypto Schemes

Fake Security Apps, Real Estate Fraud, and Crypto Schemes

Ep07: Pig-butchering and Crypto, a 23andme Breach Update, an FBI PSA About Couriers, and More AI Scams

Pig-butchering and Crypto, a 23andme Breach Update, an FBI PSA About Couriers, and More AI Scams

Ep 06: A Twitter/X account hack, LastPass phishing, the Mother of all Breaches, and what are these popups?!

A Twitter/X account hack, LastPass phishing, the Mother of all Breaches, and what are these popups?!

Join us on the HappyPath as we explore self improvement, personal growth and mental wellness.

HappyPath Media | Conversations About Personal Growth

We are a sister and brother team.  Anne has advanced degrees in education and Ryan is an engineer.

We've teamed up to share our own personal experiences, thoughts and experiments as we explore how to improve our lives through personal development, health, finance, wellness and more.

We started a podcast because it's fun to share our thoughts and personal experiences.  They are just down right interesting.

Come join the conversation as we venture on the HappyPath!

Conversations About Personal Growth

Join us on the HappyPath as we explore self improvement, personal growth and mental wellness.

Hi, We're Anne & Ryan

Listen to The HappyPath Media Show

Recent Episodes

Recent Articles

How This USPS Phishing Text Scam Is Really Sneaky but Detectable

3 Steps I Take to Protect Myself from Company Data Breaches

A Terrifying AI Voice Cloning Scam That Nearly Succeeded