Between now and the end of December, nearly everyone you know is waiting on a package. Most of them are waiting on several. That is the situation a fake shipping notification was built to exploit. The message claims that a delivery failed, an address is incomplete, or a fee is due. It then offers a link that will fix everything. The Federal Trade Commission’s holiday warning makes the same observation. Shoppers expect extra deliveries this time of year, a few of them surprise gifts, and scammers count on it.
Why a Fake Shipping Notification Works in December
The usual advice for an unwanted message is to ignore anything you did not ask for. In December that advice stops working, because you did ask for it. You ordered the sweater, the toy, and the gift for your brother-in-law. You cannot say which store is shipping which one. A real notice about a package you are waiting on earns your trust before you read a word of it. A fake shipping notification borrows that trust.
Go Look It Up Yourself
The replacement rule is short: never use the message as your way in. Close the message. Then find the shipment yourself, in the app or on the website of the store where you bought the item. You can also use the carrier’s own site. The FTC gives the same instruction. Look up the shipping status at the store where you made the purchase. To reach the carrier, use a phone number or website you already know is real. Ignore any contact details the message supplies. Amazon gives its own customers the same advice. Verify a suspicious message through the app or website, and never call a number that came by text or email.
Recently I received a call from a customer about an email that claimed to come from Amazon. We confirmed that the sender was not Amazon. I told the caller to ignore the email, sign in to the account directly, and look up the order there. We never tested the link, so I cannot tell you what it would have done. The advice did not depend on knowing.
This rule holds even when the page looks perfect, which is the part people miss. A criminal who sends a fake shipping notification can build a page that passes your login straight through to the real store. You sign in, see your actual orders, and conclude that everything is fine. Meanwhile the criminal keeps the signed-in session your login created. Security researchers call this adversary-in-the-middle phishing. I explained in July why an ordinary second login step does not stop it. Landing in your real account after you clicked a message proves nothing. Only the route you took to get there proves anything.
What to Do If You Clicked a Fake Shipping Notification
If you already clicked, do not wait to see whether anything happens. Tell whoever handles your IT the same day. The sooner someone checks that account, the less a criminal can do with it. Do not feel foolish about it either. These messages work because they arrive in the one month when you really are expecting packages.
Offices face a larger version of the same problem, because one person usually accepts deliveries for the whole staff. Agree on a single rule that everyone can repeat. Nobody opens a delivery message from its link. Anyone who is unsure checks the order with the person who placed it. That rule costs nothing, and it works no matter how convincing the next message looks.
Your packages do not need that link to reach you. Look up each one yourself, even when you are certain the message is real. Then the fake shipping notification has nothing left to work with.
Until next time, keep IT simple.
Dave
