{"id":102490,"date":"2024-12-06T11:59:48","date_gmt":"2024-12-06T19:59:48","guid":{"rendered":"https:\/\/www.intego.com\/mac-security-blog\/?p=102490"},"modified":"2025-03-13T13:39:05","modified_gmt":"2025-03-13T20:39:05","slug":"beware-of-fake-package-delivery-texts-and-e-mails-heres-what-to-look-for","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/beware-of-fake-package-delivery-texts-and-e-mails-heres-what-to-look-for\/","title":{"rendered":"Beware of fake package delivery texts and e-mails! Here’s what to look for"},"content":{"rendered":"

\"\"<\/p>\n

Cybercriminals have a bag of tricks that they use to deceive victims. One of the most common scams is fake package delivery notifications<\/strong>. They may come as text messages\u2014via SMS or even iMessage\u2014or as e-mails.<\/p>\n

Such scam messages often claim that there’s something wrong with a package delivery. The goal is to trick recipients into clicking on a link, or calling a phone number, in the message. This may be a phishing link, trying to obtain additional information from the recipient, potentially including their e-mail address and a password they commonly use. (This is one reason why you should never reuse passwords<\/a>, and always enable two-factor authentication<\/a>.)<\/p>\n

An example package delivery scam text (sent via iMessage)<\/h3>\n

Let’s take a look at a recent example of such a scam message sent to an Intego team member:<\/p>\n

\"\"<\/p>\n

The message claims that “Your package cannot be delivered due to incorrect address information.” It provides a URL (Web address) that starts out with “https:\/\/usps.com”\u2014but note the next character in the address; it’s a hyphen. If it ended with .com or .com\/ that would be one thing. But the domain portion continues.<\/p>\n

What’s really going on here is that the domain isn’t usps.com, but rather com-track[redacted]fu.top<\/code>; the “usps.” part is really just a subdomain<\/em>, designed to trick you into seeing usps.com and ignoring everything after that. But details matter, and that stray “-” is the clue that something is amiss. In this case, the domain actually ends in .top (not .com); .top domains are frequently used by scammers.<\/p>\n

Thankfully, Apple didn’t turn this into a clickable link on the recipient’s iPhone, so it would have taken a little effort to copy and paste (or retype) the scam URL into a browser. But the Messages app on macOS typically does treat URLs as links\u2014so be careful.<\/p>\n

Note that although some scam messages may come via a standard old SMS text message, this one actually came via Apple’s iMessage service. Don’t assume that iMessages are more trustworthy than SMS or RCS texts when receiving something unsolicited; scams can come via any of these services into the Messages app.<\/p>\n

And, of course, scams can masquerade as any package delivery service. In this case, the scammer claimed to be USPS; you may also see scams related to UPS, FedEx, DHL, OnTrac, ShipBob, Royal Mail, or other shipping services.<\/p>\n

What should you do if you receive a text message that’s a scam?<\/h3>\n

If you get a package-related text message and you’re confident that it’s a scam like the one above, tap on “Report Junk.” You’ll be asked to confirm; “Report this conversation as junk by sending it to Verizon [or your carrier] and Apple from your phone number.” Tap the “Delete and Report Junk” button to proceed.<\/p>\n

\"\"<\/p>\n

What does a legitimate package delivery text message look like?<\/h3>\n

Here’s an example of a legitimate message I received recently from FedEx:<\/p>\n

\"\"<\/p>\n

Pay close attention to the domain part of the URL; it’s fedex.com followed immediately by a slash. This is, in fact, the legitimate FedEx site.<\/p>\n

If you’re ever unsure, ask a trusted family member or friend who’s good at discerning whether something may be a scam or not.<\/p>\n

What about if I receive a fraudulent package alert e-mail?<\/h3>\n

Phishing e-mails that claim to be from package delivery services may, in some cases, be a little more difficult to identify. Scammers have more options for message formatting, and may choose to hide the URL behind a clickable link. See our recent article on how to safely check whether a link is safe without clicking on it<\/a>.<\/p>\n

Is this link safe? How to check safely\u2014without clicking on it<\/a><\/p><\/blockquote>\n