The other morning, while lying in my bed and hitting the snooze button for the third time, I did what we all do and grabbed my phone.  To my surprise, I received a deceptive text claiming to be USPS stating that my package was damaged, the address information was lost and my package couldn’t be delivered.  Sarcastically, I mutter to myself “Oh no!  What am I to do?”.

This appeared to be a classic smishing scheme.  Smishing (SMS + Phishing) is a scam where someone tries to trick the victim into giving away personal and financial information by impersonating a person or company.  This could be used to steal login credentials, credit card numbers, social security numbers and other sensitive information.  In some cases, it may lead to activating a virus or malware on our device that could steal sensitive information.

This is why I never click on links that I don’t trust.  Always practice Stop, Think, and then Click.

Thankfully, I’m pretty skeptical of all texts and emails these days because phishing and scamming have become so prolific, it’s hard to trust even legitimate communications.  However some key observations stood out to me in reviewing this text message.

This was the biggest red flag for me.  Fortunately, I wasn’t expecting a package so I had no sense of urgency or concern regarding the matter.

However, if I were expecting a package, like an expensive electronic gadget, I would be concerned about receiving my package in a timely manner.  In this case, the language that the scammer used “Please be sure to update the delivery address information in the link within 12 hours” would have created a real sense of urgency for me to act.

Urgency is a common tactic that scammers use to get us to act without thinking.  They first invoke emotion with fear such as “oh no, my package isn’t going to arrive” and then amplify it with the thought “oh no, I only have 12 hours to act”, otherwise I won’t get my package.

#2: USPS will not initiate contact via email or text message

According to the United States Postal Inspection Service (USPIS):

“The Postal Service offers free tools to track specific packages, but customers are required to either register online, or initiate a text message, and provide a tracking number. USPS does not charge for these services! USPS will not send customers text messages or e-mails without a customer first requesting the service with a tracking number, and it will NOT contain a link. So, if you did not initiate the tracking request for a specific package directly from USPS and it contains a link: don’t click the link!”

#3: The text message link is not from the official usps.com website

As we established in Number #2, USPS will not send a link, but we’re going through our investigative steps here.

The link contained “usps” as a subdomain, which is not the official USPS domain, indicating a scam.  The scammers were hoping that I would gloss over the fact that they are attempting to send me to a different domain that they, the attacker controls.

For a URL to the USPS website, we’d expect the text right before .com to be “usps”.  USPS’s domain name is “usps.com”.

Subdomain spoofing uses familiar words (e.g. “usps”) as a subdomain to trick users into clicking on a link to a website that the attacker controls.

https://usps.attacker123.com is owned and controlled by attacker123.com, not USPS.

#4: The text message was from a phone number

“USPS utilizes the 5-digit short codes to send and receive SMS to and from mobile phones.”

The presence of a shortcode isn’t a foolproof way to decipher smishing texts vs legitimate texts, but it’s a helpful piece of information.  Because we know that USPS uses the 5-digit SMS short codes, we know that we can dismiss any text message claiming to be USPS that use a regular phone number.  It automatically becomes a red flag.

Again, worth noting that according to USPIS:

“USPS will not send customers text messages or e-mails without a customer first requesting the service with a tracking number, and it will NOT contain a link”.

How This USPS Phishing Text Scam Is Really Sneaky but Detectable

Well, I somewhat screwed up here.  My plan was to visit the link in a sandboxed environment to safely share what the scammers have in place.  However, I let this task sit in my backlog for too long and the site is no longer active.  Which overall is a good thing.

Hypothetically, let me share what I think we’d see.  I think we’d very likely see a website that gives us the impression that we landed at the official USPS website.  From here, it could go a few different ways.

By impersonating the official website, they might try to trick me into logging into a fake login form.  This would allow them to steal my login credentials and allow the scammer (now hacker) to be able to take over my account.

Scenario 2: Stolen Sensitive Personal Information from a Phishing Attack

Remember, in this scam they told me I had 12 hours to update my delivery address to retrieve the damaged package.  Because of this, I’d expect at a minimum that the scammers would have a form that collects personal information.  It would also likely include sensitive personal information that they could use to steal my identity in other attacks.

Scenario 3: Stolen Financial Information from a Phishing Attack

They might ask for credit card or bank account information to perform “processing” in the recovery of my package.  Remember, in this hypothetical scenario, the scammer’s page is impersonating the USPS website, which is an organization that I and most of us would generally trust with payment information.

I’d expect a payment request scam to be combined with Scenario 2 in the collection of personal information.

There could be something on the page that triggers the installation of viruses or malware, which could further steal information from the device that I’m using.

What I’d Do If I Fell For Any Of These Scam Scenarios

Note, there may be other scam scenarios that I haven’t covered or thought about at the moment.

How I’d Handle an Account Takeover Attack

If I were to give up my credentials through a malicious login form and realize it within a timely manner; I’d immediately change the login credentials and enable two-factor authentication.  Hopefully, in this case, I’d be able to beat the hackers before they take over my account.  If they do take over the account, then I’m at the mercy of the service (hypothetically USPS) to help me recover my account.

Because I don’t reuse passwords, my exposure should be limited to the account that has been taken over.  However, if I were reusing passwords, I’d need to immediately change the passwords for those accounts with reused passwords so they don’t also get hacked as a result of this phishing attack.

How I’d Handle Stolen Personal Information from a Phishing Attack

If I were to give up my sensitive personal information, then I need to be in a position where I need to play a little defense.  I personally use Credit Karma to monitor my credit accounts so, I’d pay close attention to any changes there.  Additionally, I’d consider freezing my accounts at the credit reporting agencies (Equifax, Experian and Transunion).  

Note that free annual credit reports are available from each of the three credit reporting agencies. However, if I knowingly gave my personal information to a scammer, I’d want to keep closer tabs on my credit to make sure financial accounts are not opened in my name.

Additionally, I’d keep a close eye on all of my accounts for any strange activity that may be as a result of this hack.

How I’d Handle Stolen Financial Information from a Phishing Attack

If I were to give up financial information, then I’d immediately call my bank or credit card company and freeze those accounts.  If it’s a credit card, it’s likely a little easier to cancel and get a replacement card.

Freezing a bank account or debit card might be a little more impactful to my daily life, but I’ve got to prevent the criminals from taking my money.  I imagine banks are very used to dealing with fraudulent and unauthorized transactions so they should be able to guide me through the appropriate steps in this process.

How I’d Handle a Virus or Malware Attack

If I realize that I have visited a malicious website, I am at a minimum running a virus or malware scan on that computer or device.  Before doing so, I’m going to make sure that the anti-virus software has the latest updates.

In specific situations where I believe the attack is more severe, I might take the additional step of completely wiping my harddrive, reformatting and reinstalling everything from scratch.  This is a little more extreme and before doing so, it might be a good idea to consult a computer repair specialist.

Hopefully, the awareness of these deceptive USPS smishing (SMS + phishing) schemes and my rambling hypotheticals & investigation tactics will empower you to identify and feel confident in tackling these attacks.  If it’s too late and you have been scammed, the FTC has a great resource called What To Do if You Were Scammed.

If interested in being more proactive in your approach to your online security, then check out our Free More Secure in 5 Challenge.  In just 5 days we’ll help you set up some foundational security practices to help protect you and your accounts.

I received a deceptive text claiming to be USPS stating that my package was damaged, the address information was lost and my package couldn’t be delivered. It informed me that I had 12 hours to update my delivery information.  This appeared to be a classic smishing scheme.  Smishing (SMS + Phishing) is a scam where someone tries to trick the victim into giving away personal and financial information by impersonating a person or company.

I received a deceptive text claiming to be USPS stating that my package was damaged, the address information was lost and my package couldn’t be delivered. This appeared to be a classic smishing scheme.  Smishing (SMS + Phishing) is a scam where someone tries to trick the victim into giving away personal and financial information by impersonating a person or company.

It seems like every month or so, I receive another letter in the mail, informing me that my data has been compromised in a company’s data breach. Often, the personal information stolen in the breach includes login credentials, phone numbers, addresses, social security numbers, and even driver's license numbers. With every data breach, hackers are obtaining puzzle pieces to either impersonate my identity or hack my other online accounts.

Keep in mind that by the time we receive a notification of a data breach, months may have already passed, during which a hacker could misuse our information.  It can take some companies a long time to figure out what has been stolen, if they even know that they have been breached in the first place.

With the increasing prevalence of company data breaches, we all need to take a more proactive approach to keeping our information secure.  Here are 3 steps I take to proactively protect myself from future company data breaches.

The first step I take is to make sure that all of my account passwords are strong and unique.

A strong password involves a complex combination of alphanumeric, symbols and upper & lower case characters. Length is an important factor.   Typically, a strong password contains at least 12 characters or more.

I personally use LastPass as my password manager.  The benefit of using a password manager, like LastPass, is that it helps me create and store complex passwords.  That way, I don’t have to worry about the specifics and also don’t have to remember the password, which can be tough when designing a truly complex password.

In the context of a company data breach, it’s really important to use unique passwords among various accounts.  If a hacker obtains login credentials containing username and password, guess what they will do?  They are going to try that username and password on other websites.

Reusing passwords is really dangerous, because a leaked username and password can lead to unauthorized access as hackers attempt to login to other websites using that same username and password.

3 Steps I Take to Protect Myself from Company Data Breaches

Use 2-Factor Authentication Everywhere Possible

The second step that I take is to use 2-factor authentication everywhere possible.  That way, if my password is stolen in a data breach or data leak, attackers still need that 2nd factor of authentication to access my account.  This might be a lifesaver in preventing unauthorized access to my accounts.

Also, we all carry phones around with us all day anyways so, the hassle factor of using a 2-factor authentication app or SMS authentication is relatively small.

When hackers obtain my personal information they may try to impersonate me by attempting to make modifications to my existing accounts or open new accounts.

To help monitor this, I use credit monitoring to watch for changes to my credit accounts.  This includes notifications for new credit accounts created in my name with my social security number.

There are a lot of credit monitoring services available.  I simply use Credit Karma’s free credit monitoring service.  They send a lot of email, but they do send notifications when changes are observed with my accounts as reported to credit reporting agencies.

Free annual credit reports are available from each of the three credit reporting agencies (Experian, Equifax and Transunion); however, I think it’s important to continually monitor credit accounts for any changes.

A better solution to credit monitoring would be to just freeze my credit at each of the credit reporting agencies.  This is not something that I have done personally yet.  However, I think it’s a great step and I plan to do this in the near future.  

Freezing my credit might create some new hassles including unfreezing my credit accounts to apply for new credit such as buying a car, house or getting a new credit card.  However, my rationale is that these company data breaches are an ongoing problem, so it’s just a matter of time before someone tries to use my social security number to open an account in my name.  I’d rather deal with the hassle of unfreezing credit accounts versus dealing with the fallout from unauthorized accounts being created through identity theft.

These are three of the security practices that I use to help protect myself against future company data breaches.  Note that none of these security practices prevent the data being stolen in the first place.  The sad news is that nothing we do will prevent that, because once we give up our information to a company or service, we are largely entrusting our data to that organization's security practices and defenses.

Before we give companies our information, we need to ask ourselves if we trust them to keep our data safe and monitor for intrusive hackers.  Also, do they really need the information that they are requesting?  We must be prepared to accept that any information we give a third-party could be stolen or leaked in a data breach.

With the increasing prevalence of company data breaches, we all need to take a more proactive approach to keeping our information secure.  Here are 3 steps I take to proactively protect myself from future company data breaches.

In Episode 5 of The HappyPath Media Show, we covered a story about a Bay Area family who experienced a crazy ordeal involving scammers using AI technology. The mother received a phone call from someone who she believed to be her son, claiming that he was in a car accident and had been arrested.  The phone call was convincingly realistic sounding and resembling the voice of her son who happened to be away at college.

Apparently, the scam played out by the scammers passing the call to a (fake) police officer who informed the mother that her son had been in a car accident involving the injury of a pregnant woman.  According to the fake police office, the son had been arrested.  These details were obviously used to heighten the emotional elements of this scam, which was already a tense and frightening story.

Following the conversation with the fake police officer, the call was passed to a fake public defender.  The mother was informed that her son’s bail was reduced from $50,000 to $15,000 and that she needed to get the money quickly.  She was informed not to tell anyone why she needed the money in order to protect her son’s reputation.

The family was convinced by the urgency and seeming legitimacy of the situation.  The parents withdrew the demanded amount, but the scam unraveled when the fake "public defender" said that he was going to send a courier to collect the money.  This raised some red flags for them.  As suspicions were heightened, the family did the right thing and contacted both the police department and the son directly.  It turns out that neither the police department nor the son were aware of the situation and everyone was safe.

Terrifying AI Voice Cloning Scam That Nearly Succeeded

This is a frightening scam where AI voice cloning is used to make the story more believable.  With some basic voice samples, a scammer can now convincingly mimic a person's voice.  This tricks victims into believing that they are talking to the real person.

In this story, the use of the son’s voice not only helped make the scam more believable, but helped heighten the emotional stress of the situation. Oftentimes, scammers will use emotion to get their victims to act quickly without much thought.

Unfortunately, with all this deep fake technology, we are entering a world where you can’t trust anything.  In this story, the family did the right thing.  They ended the conversation with the scammers and directly contacted both the police department and the son.  

Always question emotionally charged communications where someone is asking for sensitive information or money.  Ask yourself, “Did I contact them, or did they contact me?”.  If it’s the latter, it’s best to hang up and dial directly.

This story is very frightening because it brings to light the dangers of AI technology in the wrong hands.  We are all going to have to be more vigilant and proactive verifying our communications to ensure we’re not being scammed or taken advantage of.

A terrifying story about how AI voice cloning technology is used in an attempt to trick parents into thinking their son had been arrested.  The scam involves talking to fake police officers and fake public defenders in an attempt to collect fake bail for the son.

A Terrifying AI Voice Cloning Scam That Nearly Succeeded

There’s a new scam on Facebook that is picking up steam called the “I Can’t Believe He’s Gone” scam.  This scam post is sometimes accompanied with a fake news article (e.g. traffic accident) or just a link.  The phrasing is designed to create curiosity and entice users to click on the link, which leads to malware.

If you have been with us for any amount of time, you know that we advocate for “Stop, Think, then Click '' on everything and anything on the internet.  Especially, when something evokes emotion, which is how these scammers use psychological tricks to fool you into clicking.

The “I Can’t Believe He’s Gone” text and accompanying link is often posted by a hacked Facebook account.  Typically, it’s someone you trust and know, which helps fool lots of people into the scam.  Hopefully, you will have noticed that this type of posting is out of character for your friend who has been hacked.  With the practice of “Stop, Think, then Click”, you probably noticed (without clicking) that the link takes you to an unfamiliar website or source.  This is a huge red flag and if you follow the practices we teach, you know to stay clear of links to unknown and unfamiliar websites.

Beware the "I Can't Believe He's Gone" Posts Are Scams

Both Anne and Ryan have come across this scam in the wild.  It seems to accompany a shocking news piece about a traffic accident, sparking immediate curiosity and concern. This emotional response is why the scam is so successful.  Most people will click the link right away.

Apparently, when clicked, the user is redirected through multiple sites, a technique designed to gather personal information to better deceive the user with an attack. This process, known as 'fingerprinting,' collects data about your browser. The attacker’s goal is likely to redirect the user to spoofed (fake) websites resembling websites that the victim is familiar with.  This could be spoofed (fake) news outlets and banking websites.  The goal is to steal login credentials, personal information or trick the user into installing malware.

If you’ve clicked a malicious link, then it’s important that you take immediate action.  Here are some things that you can do:

If you’re in a situation where clicking close on the browser opens more pop-ups, consider using keyboard shortcuts to force close the browser.  On Windows, use Ctrl+Alt+Delete to force close applications. On Mac, Option+Command+Escape performs a similar function.

3) Consider updating your passwords and enabling two-factor authentication.

4) Monitor your accounts for suspicious activity.

In cases of a severe breach of your computer, devices or information, contact your bank and credit cards to temporarily freeze your accounts.  Let them know the situation so they can thwart any impersonation attacks on your financial institution.  At this point, it would be prudent to monitor your credit to watch for any suspicious activity.  Another consideration would be to employ professional help from a trusted computer repair shop to ensure your devices are free of malware.

In closing, you are your first line of defense when it comes to avoiding these situations. By practicing “Stop, Think, then Click”, you can hopefully avoid a lot of these situations.   Always be proactive in your digital interactions to avoid scams, phishing and malware.

There's a new scam on Facebook called the "I Can't Believe He's Gone" scam.  This attack tricks the user into clicking a link and leads them to malware or phishing.

Urgent Warning to Facebook Users: The "I Can't Believe He's Gone" Scam

Recently, Anne came across an interesting story that was shared by an Instagrammer who refurbishes furniture.  Apparently, she uses Facebook Marketplace as a source for acquiring furniture. 

The story talks about the common practice of reserving items on Facebook Marketplace by sending upfront money with an app like Venmo.  This is a bad idea!  This is a common scam where criminals will copy and paste legitimate listings and trick buyers into sending money for non-existent items.  Never do this, unless you’re willing to lose your money.

According to the story, the Instagrammer and her sister had been victims of a direct attack on their Venmo accounts.  Apparently, they were contacted by a scammer via phone who pretended to be a Venmo representative.  They were warned (falsely) that attackers were attempting to access their accounts.  The scammer followed up the phone call with an email, advising them to login to their accounts.  However, it sounds like the link to their accounts was a spoofed website (fake), allowing the scammers to capture their legitimate account logins with a fake website that they control.

As you can probably guess, the scammers took control of the Venmo accounts, locking them out and taking the money.  According to the story, the Instagrammer was able to recover $1500 from her compromised account.  However, it sounds like her sister remains locked out of hers.

How Venmo Phishing Scheme Led To Account Takeover

This is an all too common occurrence.  Take note that the scammer got the victims into a heightened emotional state about unauthorized access into a financial account.  Most of us are in an excitable state after hearing this.  It somewhat blinds us from questioning the legitimacy of the conversation to begin with and that’s what the scammers are aiming for.

When communicating with anyone who claims to be a financial institution or operating in an official capacity, always be skeptical.  Especially, when they are the ones who contact you.  If you think that it could be a legitimate conversation, always politely hang up and find the contact information yourself (official website).

If you use Venmo or any other payment application, always make sure you’re using a strong password that hasn’t been reused with any other account.  Also make sure that you have two-factor authentication enabled on your account.  Always think twice before linking your bank account to an application that isn’t set up with secure authentication methods such as two-factor authentication.

With Venmo and Paypal there are a lot of scams being played out to steal money from customers.  If you see anything unusual or suspicious, such as unexpected funds appearing in your account or other alarming events, make sure that you notify the payment platform right away via their official contact methods that you found yourself (official website).

We recently came across a story that involved an Instagrammer and her sister being tricked in a phishing scheme that led to their Venmo accounts to being taken over by criminals.

How Venmo Phishing Scheme Led to Account Takeover

With winter weather hitting different parts of the United States, we're all thinking about driving in snow, and the fun activities like skiing and snowboarding. However, what you are not thinking about is how scammers are paying attention to weather patterns in an effort to exploit you.

Recently, the FTC issued a consumer alert warning that scammers are posing as fake utility workers. This means that a fake utility worker could knock on your door, claiming there are urgent repairs due to the winter storm. Events such as power outages or damage due to recent weather provide convincing cover for their scams.

Be extremely cautious and if they ask for cash, don’t give it to them.  This is a classic scam sign. Utility companies don't operate this way. Anyone showing up at your door telling you that you owe money is likely a scammer.  Don’t worry, if you owe money, your utility company will bill you.

It's also an opportunity for shady and unlicensed contractors to take advantage of the winter conditions. They might offer to repair storm damage for cash, but if you pay upfront, there is the possibility that they might disappear with your cash. Always check that the work is done to your satisfaction and as agreed upon before making any payments to anyone.

Winter Weather Brings Utility Scams

I recall an incident from my college days where a friend and I encountered someone posing as a Comcast internet utility worker.  It was almost convincing, because the scammer was wearing an orange vest and a clipboard, going from house to house. My friend quickly realized something was off and gave the scammer a piece of his mind, making a huge scene in the neighborhood.

This is just a reminder to always be skeptical when someone claims they're from a utility company and requests immediate payment. It's okay to doubt their authenticity. Politely decline and say you'll contact the company directly. Here’s the catch with that – do not trust any contact information that they provide.  

Sometimes, elaborate and sophisticated scams involve more than one “actor”.  Meaning that actor 1, the fake utility worker, provides you with a phone number to call actor 2 who is someone pretending to be your utility company.  This fake representative of your utility company will tell you to follow the instructions of actor 1.  See how sneaky all of this is?

The right move here is to excuse yourself and look up the official utility company website and get the contact information from there – the original source.  This is the only way to verify whether or not the suspected scammer is legitimate or not.

Scammers often play on your emotions and need for essential services like electricity and heating, especially in winter. They might claim you owe money and threaten to cut off your utilities. Again, this is not how utility companies operate – this is a huge red flag.

These scams when conducted via the phone or email often result in the scammer asking you to make payment via wire transfer, cryptocurrency or gift cards.  All of these payment sources should be screaming “red flags” to you!  They choose these payment sources in the scams, because they are often irreversible.  Typically, once you send the money, it’s gone!

If you ever fall victim to such scams, contact the service you used to send the money (your bank, crypto broker, gift card vendor) and try to stop the transaction. Hey, it's always worth a shot, but your money is most likely gone.  Also, inform your local police, as a crime has occurred. Notifying law enforcement might help protect others in your area from being targeted.

So, with winter’s arrival be extra vigilant against these scams and protect yourself and your neighbors. Enjoy the winter weather safely, and remember, we're all in this together. Stay safe!

References:
https://consumer.ftc.gov/consumer-alerts/2024/01/tracking-first-winter-storms-year-so-are-scammers
https://consumer.ftc.gov/articles/scammers-pretend-be-your-utility-company

Scammers are paying attention to weather patterns in an effort to exploit you.

Winter Utility Scams: The Dangers Lurking Beyond the Snow

We're excited to announce that we have launched The HappyPath Media Show.  The first episode is available now on major podcast platforms Youtube, Spotify, Apple Podcasts & Amazon.

In the first episode of The HappyPath Media Show, Anne & Ryan talk about some of the surprising stories about safety and privacy online. Throughout this episode, we share tips and tricks to be aware, feel empowered, and stay safe, on the HappyPath.

How One Man Lost $800K From an Internet Popup

In this episode, we chat about: 
1. How one man lost his nest egg to a Microsoft support scam and reasons why pop ups like this might come up on your computer. 

2. What scammers can access through your phone when you download malicious apps and things to ensure you're using your phone safely. 

3. A notice Ryan personally received in the mail, and some red flags it set off.

📰 CBS article: https://www.cbsnews.com/news/fbi-warns-elder-fraud-crime-rates-rising-scammers-steal-billions-each-year/ ⁠
📱Deakin University (@deakinlife) Instagram Reel⁠: https://www.instagram.com/reel/CyKPokSvBxZ/
📬 Welltok Notice⁠: https://welltoknotice.wpenginepowered.com/
🔒Malware Bytes⁠: https://www.malwarebytes.com/

If you enjoyed this episode, please like and subscribe!

We're excited to announce that we have launched The HappyPath Media Show.  The first episode is available now on major podcast platforms.

How This USPS Phishing Text Scam Is Really Sneaky but Detectable

How This USPS Phishing Text Scam Is Really Sneaky but Detectable

Recent Articles

How This USPS Phishing Text Scam Is Really Sneaky but Detectable

3 Steps I Take to Protect Myself from Company Data Breaches

A Terrifying AI Voice Cloning Scam That Nearly Succeeded

Urgent Warning to Facebook Users: The "I Can't Believe He's Gone" Scam

How Venmo Phishing Scheme Led to Account Takeover

Winter Utility Scams: The Dangers Lurking Beyond the Snow

The HappyPath Media Show Has Launched