There's an issue with your package

The issue is: there is no package. It’s a scam.

A package delivery scam usually starts with a text message that looks like it’s from UPS, FedEx or USPS. The text might say “there’s an issue with your package” or “you missed a delivery.” Then it will include a link where you can provide missing information. 

As with any unexpected text or email: don’t click the link!

Are package delivery scams one of the Ishings?

Yes, they are! Package delivery scams are an example of “smishing” – short for SMS phishing. Typical smishing scams try to trick you into clicking a link that steals your personal data, login details, or bank information, or leads you to download malware. Package delivery scams are most common via text, but can also arrive as email phishing. For more info on this, check out the recording of Tech Tuesday: Beware the Ishings! Common Cybersecurity Scams. 

I am actually expecting a package. How do I tell if a package delivery text is real or fake?

One of the reasons package delivery scams are so effective is that online shopping is a daily activity for millions of people, and many of us are expecting packages all the time, so it’s easy to pass off a text from a mail carrier as the real thing.  

But fake delivery scam notifications have a few warning signs:

• Message is unexpected. Unless you’ve specifically requested text delivery updates for a particular shipment, USPS won’t send them. If you get one, it’s fake.  
• Sense of urgency. Scammers will say things like “immediate action required” to get you to respond quickly. Real delivery services won’t pressure you like this.
• Request for sensitive data. Legit delivery services won’t ask you for personal or financial information to complete a delivery. 
• Embedded links. If the suspicious text has a link, it’s smishing. Don’t click it. Real USPS or FedEx text messages don’t include links for package tracking updates or payments.

What to do if you give your info away to a package delivery scam 

• Tell your bank. They can monitor your account for suspicious activity. 
• Update your passwords.
• Watch your financial accounts. Review your bank statements, credit card activity, and credit reports for a few months.

How to report package delivery scams

Reporting helps shut scammers down. It also helps others avoid the same traps. 

• Report the scam to the shipping services. Notify the delivery service by forwarding a screenshot of the fake communication. Contact Information: spam@uspis.gov, fraud@ups.com, abuse@fedex.com, phishing@dhl.com
• Contact the credit bureaus: Reach out to Equifax, Experian, and TransUnion to freeze your credit or place a fraud alert on your credit profile. 
• Notify the FTC (Federal Trade Commission): The FTC monitors scam trends and advocates for consumers. You can report the package delivery text message at 1-877-FTC-HELP or reportfraud.ftc.gov.

October is National Cybersecurity Awareness Month, an annual collaborative effort between government and industry to ensure you have the resources you need to maintain your security online. Throughout October, we’ll be sending you tips on protecting your information and avoiding malicious attempts to extract your personal data. Visit https://its.weill.cornell.edu/cybersecurity for more info.

Sources:

•  https://www.afbank.com/article/package-delivery-scam-messages-what-to-dotimes&regi_id=47579090&segment_id=206587&user_id=993edb6fe01e2e1285add6039b0984cf
• https://bankiowa.bank/articles/the-rising-threat-of-package-delivery-fraud-how-to-protect-yourself
• https://www.aba.com/advocacy/community-programs/consumer-resources/protect-your-money/package-delivery-scams