WASHINGTON — As people are tracking packages to make sure the gifts they bought their loved ones arrive in time for Christmas day, the United States Postal Inspector Service (USPIS) is also warning customers about a series of scams concerning bogus packages.
People across the country have reported receiving text messages that read, "USPS package has arrived at the warehouse and could not be delivered due to an invalid zip code address being detected. Please confirm the zip code address information in the link."
Brian Harris with the USPIS says these types of messages are an example of what is known as "smishing" which is when a scammer uses text messages to deceive victims into clicking malicious links or give up sensitive information.
"The ultimate goal is to obtain your financial account. So you're talking about wiping out your hard earned savings you're also talking about impacts to your credit report," Harris told WUSA9.
The messages contain fraudulent links like https://usps.com-packagesue.net and a series of instructions to follow. Experts say the use of ".com" and ".net" should be a red flag for users.
The Federal Communications Commission (FCC) says, "A typical smishing scam message may seem like it's from a bank – maybe your bank – and include a link or phone number to bait you into clicking or calling. If you do, you stand a good chance of being hooked. And that's when the scammers get to work, manipulating your personal information, which they can sell and/or use in other scams. Smishers may also try to entice you into downloading malware to your device."
The FCC advises people to:
- Never click links, reply to text messages or call numbers you don't recognize.
- Do not respond, even if the message requests that you "text STOP" to end messages.
- Delete all suspicious texts.
- Make sure your smart device OS and security apps are updated to the latest version.
- Consider installing anti-malware software on your device for added security.
- Protect any sensitive personal information - bank accounts, health records, social media accounts, etc. - by using multi-factor authentication to access it.
Whether it's a text message, phone call, or an email, Harris says the best way to verify is contacting the postal service directly, "You can easily go on the postal service website and enter that tracking number."
The FCC recommend victims of a scams to report cases to law enforcement.