By REBECCA RUTHERFORD
Los Alamos
For the Los Alamos Daily Post

Got a text message claiming to be from the USPS about your package? Think twice before you click, this is one of the most common smishing scams out there!

What is smishing? Smishing is a form of phishing that involves a text message or phone number. Victims will typically receive a deceptive text message intended to lure the recipient into providing their personal or financial information.

These scammers often attempt to disguise themselves as a government agency, bank, or other company to lend legitimacy to their claims.

Fraudulent text message received by the author. Courtesy image

A few things stood out to me that this is a phish:

The message isn’t from a phone number, it is from an email ending in .ru. This is the Internet country code top level domain (ccTLD) for Russia. ccTLDs represent specific geographical locations worldwide to show search engines and users what country the content is based in.

The linked domain is not a .gov domain, it’s a generic top level domain (gTLD), ending in .top. A quick whois domain search reveals this site was just created and registered this month, another sign that a link is likely to be a scam. 

Message tries to instill a sense of urgency by saying that the shipment is on hold, and tries to get the user to click the link to release the shipment. Sense of urgency is another sign something is likely a phish.

Have you ever known anyone working at the US Postal service to wish you “a wonderful day”? Obvious scam right here. Kidding…mostly. Although one sign of a scam is overly friendly or odd language. 

Apple makes it really easy to report things that are spam, just click the “report junk” at the bottom of the text message.

How to report junk on your iPhone messages app

The USPS issued a press release about this earlier this month, here.  You can just delete and ignore these messages, or you can report them to the USPS:

To report USPS related smishing, send an email to spam@uspis.gov (not a typo, this goes to the USPS Inspection Service).

• • • • • • Without clicking on the web link, copy the body of the suspicious text message and paste into a new email.
          • Provide your name in the email, and also attach a screenshot of the text message showing the phone number of the sender and the date sent.
          • Include any relevant details in your email, for example: if you clicked the link, if you lost money, if you provided any personal information, or if you experienced any impacts to your credit or person.
          • The Postal Inspection Service will contact you if more information is needed.
          • Forward the smishing/text message to 7726 (this will assist with reporting the scam phone number).

Never interact with these messages, just ignore and delete or report them to the USPS.  If you aren’t sure if a message is legitimate always go directly to the company’s website, never click on a suspicious link. 

Stay safe online, watch out for scams and don’t click those links!

Editor’s note: Rebecca Rutherford works in information technology at Los Alamos National Laboratory.