Dr. Rachel McNealey is an Assistant Professor in the School of Criminal Justice and a Center Associate with the MSU Center for Cybercrime Investigation & Training. In this op-ed, she discusses Smishing and how to avoid falling victim.
Recently, you or someone you know may have received a text saying that the USPS tried to deliver your package but was mysteriously unsuccessful. Now, apparently, your purchased goods are sitting at an unnamed warehouse waiting to be claimed. The text tells you to just follow the link and enter some info (often paying a small processing fee), and your package will be right on its way!
In reality, these texts are part of a wave of socially engineered smishing (SMS + phishing) campaigns designed to collect recipients’ sensitive information by impersonating legitimate agencies. Phone numbers and emails are concerningly easy for scammers to collect. There are techniques such as buying large quantities of stolen personal data online, which can be done both on the dark web and the everyday web. However, scammers can also simply web-scrape sites that contain and/or show individuals’ contact information or obtain unauthorized access to businesses’ mailing lists. The only thing left for them to do is automate an urgent-sounding message to those emails or phone numbers and wait for their recipients to click a link or enter their information in response to the persuasive alert.
For many, these texts are made all the more convincing by the fact that they pop up when one is, in fact, expecting a package. This happy coincidence (for the scammers) is a result of their widespread distribution strategy involving thousands of phone numbers –while some people receive a text when they are indeed awaiting a package, there are many others for whom the text is out of context and clearly a scam. However, this is part of the scammers’ strategy: the fact is, if you send thousands of people a text regarding an in-transit package, there is a good chance that at least a few of those people will actually have a package on the way. Of those individuals, some may be concerned by the new status update and follow the false instructions. The interconnected nature of sensitive information means that bad actors only need a few individuals to heed the text and enter their information to make for a lucrative day of scamming. From there, the collected information can be sold, used fraudulently, or used to obtain more of the individual’s information by attempting access to other accounts. There is also the payout from unsuspecting customers who pay the alleged processing fee.
The USPS is not the only organization whose name has been co-opted for these types of scams. Recently, U.S. residents have also received scam text messages claiming that they have an unpaid toll debt and including a phone number (usually overseas) to call and settle the balance. As general good practice, everyone is encouraged to always check and verify the number requesting money or information. When in doubt: delete! However, in a chaotic digital world, it is easy to overlook details that may seem obvious in hindsight. If you are using any form of payment for online transactions, you should also keep an eye out for unauthorized transactions and suspicious bank statements.
The best way to protect against this type of scam is to be aware of how organizations such as the USPS actually contact their customers – the USPS only sends text updates to those who have registered for the service using a tracking number and, most importantly, emphasize that they do not charge for these services and will never send a link. The USPS urges that, if a customer is concerned about the status of their package, they should go directly to USPS.com and follow the tracking process on their website.
