Elyse Betters Picaro / ZDNET
I've been anxiously expecting a package from UPS. That's why a text I received the other day caught my eye. Claiming to be from UPS, the message said that the carrier attempted to deliver the package on June 27, but the delivery couldn't be completed. The date was one when my wife and I were away, so this seemed legitimate at first glance.
Also: Got a suspicious E-ZPass text? Don't click the link (and what to do if you already did)
However, I've written plenty of cybersecurity stories, and I keep abreast of the latest news in the world of cybercrime. I know that UPS scam messages have been making the rounds, especially at this time of year. Naturally, my spider sense started tingling even before I read the text itself. But after reviewing the message and checking out all the details, I realized this was clearly a scam.
Scammers like to schedule specific types of scams for certain times of the year. During tax season, you'll see a lot of scams that spoof the IRS. During the holiday season, gift card scams ramp up. And during the summer, missed-delivery scams are popular since the crooks know that people are often away on vacation.
Delivery scams are also popular now because big shopping events like Amazon Prime Day (July 8 to July 11) and Walmart's competing sales (July 7 to July 13) are creating massive numbers of packages, J Stephen Kowski, field CTO at SlashNext Email Security, told ZDNET.
"Scammers know people are expecting more packages than usual during these promotional periods, so their fake delivery alerts are more likely to fool someone who's actually waiting for multiple orders," Kowski explained. "These classic phishing campaigns have been running for years, targeting UPS, USPS, FedEx, and international services like Royal Mail in the UK and the South African Post Office, but they come in waves, and summer sales season is prime time for package-related deception."
How the UPS scam works
This particular UPS scam is a savvy one, at least in some ways. I received the message on my iPhone, with the sender labeled as unknown. By default, links in a text message from an unknown sender are disabled, so you can't click on them to open them. But the scammer used a sneaky trick to get around this obstacle.
Also: Clicked on a phishing link? 7 steps to take immediately to protect your accounts
... continue reading