This morning, I got a text from UPS—
or so it claimed.
I was skeptical because UPS usually sends emails with a link to a page on the official UPS website. From there, you can choose to track via text, email, or both.
The biggest clue the message was fake: UPS's tracking info always comes from UPS.com. This text, however, directed me to a site called
servicefyr . pics / us.
I reported it to UPS. Hopefully, it will follow up with the site's domain registrar about its unsound practices.
As it turns out, the Federal Trade Commission has documented this practice since 2020. Although the top year for smishes was 2021 with 378,000 documented, 2024 saw 247,000 incidents. Surprise, surprise: “Fake package delivery problems," usually from someone pretending to be from the U.S. Postal Service, were Number 1 on that list.
The industry term for this scam is "smishing.”
Smishing is phishing. Whereas "phishing" is done via email, smishing is targeted specifically toward mobile phones and SMS/text messaging.
According to the online security company Sentinel One: "In such an attack, malicious messages are sent to mobile phones, similar to messages sent by legitimate sites like a bank, a store, or a governmental agency. The attacker will aim to make a victim click on a malicious link or fill out a form full of sensitive information via text message. Such scams could lead to identity theft, unauthorized access to personal or corporate accounts, and financial fraud. With the growing need for mobile communication, smishing has also surfaced as one of the most highly utilized channels by cybercriminals who target such innocent users."
