Last updated on January 15th, 2024 at 04:30 am
Scammers have been busy impersonating the United States Postal Service in fake text messages this week. The texts are designed to trick recipients into revealing their personal and financial information, putting their identity and hard earned cash at risk.
The scam
The text messages, many examples of which have been posted on the subreddit r/scams, inform the recipient that their USPS package “has arrived at the warehouse,” but “cannot be delivered due to incomplete address information.” Recipients are then urged to reply to the text and follow a link to provide the correct address information.
Safe Not Scammed used the online virtual sandbox Any.Run to visit one link (uspodm[.]top) used by the scammers. (Never click on suspicious links using your own devices!) The website it led to displayed what looked like a clone of a real USPS tracking page. The page said “Delivery failed, addressee unknown,” and offered the recipient a chance to “Schedule a Redelivery.”
Clicking the “Schedule a Redelivery” button led to a page asking for the recipient’s address to confirm whether redelivery was available. After entering their address, the recipient was then asked to pay a 30c redelivery fee. However, anyone entering their information on the site is giving it directly to scammers who will abuse it for far more than 30c.
What to do if you fall for the scam
If you fall for the scam, call your financial institution immediately and tell them you entered your financial information on a phishing site. The bank may refund any fraudulent charges the scammers made if you contact them quickly. They will also cancel your card and send you a new one to prevent further unauthorized charges.
You should also be on the lookout for scams sent via regular mail since you entered your address on the fraudulent site. Additionally, pay close attention to any pieces of mail from the USPS, because the scammers may attempt to forward your mail to an address they control.
How to avoid these scams in the future
To avoid falling for similar scams in the future, avoid clicking on links in text messages unless you are absolutely sure they are legitimate.
For example, the legitimate address for the USPS website is www.usps.com, whereas the address of one of the fake USPS sites was uspodm[.]top. In general, you should be extra cautious about sites with an address that ends in .top, as they are often scams!
Any site claiming to be USPS that asks you to pay a re-delivery fee is also a scam, as USPS will re-deliver for free. Additionally, USPS will not text you unless you explicitly give them permission to do so for that particular package. So, if you haven’t done that, you can safely disregard any text claiming to be from the postal service.
The takeaway
Scammers have been sending out text messages pretending to be from USPS in order to steal personal and financial information. If you receive a text claiming to be from USPS that asks you to click a link to update your address, don’t do it. Instead, just delete the text.
I fell for it, but thankfully I didn’t give them my bank account info. Unfortunately, they got my home address.
Sorry to hear that you fell for the scam, but I’m glad the fraudsters didn’t get your financial information! As they have your address, the scammers might try sending you scams by snail mail, so be extra cautious about any letters you receive. They could also try re-directing your mail, but USPS will send a physical confirmation letter before the forwarding starts, so if you receive anything like that, contact the Postal Service right away. Stay safe!