USPS package smishing and fake redelivery scam¶

Primanje hitne tekstualne poruke u kojoj se tvrdi da paket poštanske službe Sjedinjenih Država ne može biti isporučen zbog nepotpune ulice sada je jedna od najčešćih sajber prijetnji na mobilnim uređajima. Ovi phishing napadi usluge kratkih poruka (SMS), poznati kao smishing, prikazuju realističan poštanski brend, simulirane barkodove za praćenje i službeni jezik. Poruka vas usmjerava na lažnu web stranicu na kojoj se od vas traži da potvrdite svoju kućnu adresu i platite malu naknadu za ponovnu isporuku, obično između 0,30 USD i 3,00 USD, unosom broja vaše debitne ili kreditne kartice, datuma isteka, sigurnosnog koda i podataka o naplati.

Mala naknada za ponovnu isporuku je samo obmanjujući mehanizam dizajniran da uhvati sve podatke o vašoj kreditnoj kartici i lične podatke o identitetu. Nakon što se podnose, kriminalne mreže odmah pokreću neovlaštene maloprodajne transakcije na mreži, upisuju vašu karticu u ponavljajuće lažne pretplate ili pokušavaju preuzeti račun koristeći presretače jednokratnih lozinki u realnom vremenu. U nekim slučajevima na Android uređajima, klik na zlonamjernu vezu pokreće tiho preuzimanje bankarskih trojanskih aplikacija koje prate pritisak na tipke i presreću višefaktorske kodove za autentifikaciju. Poduzimanje trenutnih mjera ograničavanja vaših platnih kartica, mobilnog uređaja i kreditnih datoteka može neutralizirati financijski gubitak i spriječiti dugoročnu krađu identiteta.

Uradi ovo sada¶

Ako ste kliknuli na lažnu poštansku tekstualnu vezu ili poslali detalje plaćanja na web stranici za ponovnu dostavu, odmah poduzmite ovih šest radnji:

1. Zaključajte ili otkažite kompromitovanu platnu karticu odmah:
   • Otvorite aplikaciju za mobilno bankarstvo ili pozovite izdavaoca kartice koristeći broj za hitne slučajeve koji je odštampan na poleđini kartice.
   • Koristite kontrole kartice aplikacije da trenutno prebacite status kartice na "Zaključano" ili prijavite karticu kao ugroženu.
   • Zatražite hitnu zamjensku karticu s potpuno novim šesnaestocifrenim brojem računa, datumom isteka i CVV sigurnosnim kodom.
2. Pregledajte transakcije na čekanju i osporite lažne troškove:
   • Provjerite svoju nedavnu historiju transakcija za nepoznate mikro naplate ili neovlaštene autorizacije trgovca na čekanju.
   • Uputite svoju banku da odbije sva ponavljajuća ovlaštenja za pretplatu i izda formalno povraćaj sredstava prema saveznim pravilima o zaštiti potrošača.
   • Izričito navedite predstavniku za prevare: "Unio sam podatke svoje kartice na lažnoj web stranici za krađu identiteta koja se lažno predstavlja za poštansku dostavu."
3. Provjerite ima li na svom mobilnom uređaju neovlaštenih aplikacija ili profila:
   • Na Androidu otvorite Postavke -> Aplikacije i provjerite ima li nedavno instaliranih nepoznatih aplikacija (kao što su lažni uređaji za praćenje paketa ili Flash playeri).
   • Na iPhone uređaju otvorite Postavke -> Općenito -> VPN & Upravljanje uređajima i provjerite da nisu instalirani neovlašteni konfiguracijski profili za upravljanje mobilnim uređajima (MDM) ili certifikati preduzeća.
   • Ako se pronađe nepoznata aplikacija ili konfiguracijski profil, odmah je uklonite i ponovo pokrenite uređaj.
4. Proslijedite zlonamjernu tekstualnu poruku da prijavite pošiljaoca:
   • Kopirajte tijelo tekstualne poruke i proslijedite ga direktno na kratki kod univerzalnog operatera za neželjenu poštu 7726 (koji označava SPAM).
   • Proslijedite poruku i podatke o pošiljaocu Poštanskoj inspekcijskoj službi Sjedinjenih Država na spam@uspis.gov.
   • Napravite snimak ekrana tekstualne poruke i URL-a web stranice prije nego što izbrišete nit razgovora.
5. Zaštitite svoj lični identitet ako ste dostavili punu adresu i lične podatke:
   • Ako je obrazac za krađu identiteta zatražio vaš broj socijalnog osiguranja, datum rođenja ili djevojačko prezime majke, tretirajte svoj identitet kao otkriven.
   • Postavite privremena upozorenja o prijevari ili potpuno zamrzavanje vaših kreditnih datoteka na Equifax, Experian i TransUnion.
   • Redovno pratite svoje kreditne izvještaje zbog neovlaštenih upita ili novootvorenih trgovačkih linija.
6. Prijavite napadni portal federalnim bazama podataka o sajber sigurnosti:
   • Podnesite prijavu za internet kriminal Centru za žalbe na Internetu FBI-a na adresi ic3.gov.
   • Pošaljite zlonamjerni phishing URL Google sigurnom pregledavanju i Agenciji za kibernetičku sigurnost i sigurnost infrastrukture (CISA) kako biste zaštitili druge potrošače.
   • Prijavite lažnu poslovnu praksu Federalnoj trgovinskoj komisiji na adresi reportfraud.ftc.gov.

Dijagram toka trijaže incidenata¶

Slijedite ovaj korak po korak donošenje odluke kako biste procijenili svoj nivo izloženosti, spriječili potencijalnu prevaru s karticama i osigurali svoj mobilni pametni telefon:

flowchart TD
    A["Primljen SMS sa zahtjevom za neuspješnu poštansku dostavu"] --> B{"Jeste li kliknuli na web link u tekstu?"}
    B -->|"Ne: Samo primljeni tekst"| C["Proslijedite SMS na 7726 i spam@uspis.gov, obrišite poruku, blokirajte broj"]
    B -->|"Da: kliknuta na vezu"| D{"Jeste li unijeli podatke o kartici, lozinku ili lične podatke?"}
    D -->|"Ne: Odmah zatvorite pretraživač"| E["Očistite keš mobilnog pretraživača i kolačiće, provjerite da li uređaj ima preuzete datoteke"]
    D -->|"Da: Poslana kartica ili podaci"| F["Call Card Issuer Fraud Unit Immediately to Cancel Card"]
    F --> G["Dispute Pending Charges and Revoke Recurring Authorizations"]
    G --> H{"Da li ste dostavili broj socijalnog osiguranja ili datum rođenja?"}
    H -->|"Da: Potpuni identitet otkriven"| I["Zamrznite sigurnost na Equifax, Experian i TransUnion"]
    H -->|"No: Only card entered"| J["Pratite bankovne izvode 60 dana, provjerite kreditne izvještaje"]
    I --> K["Prijavite phishing URL na FBI IC3, FTC i CISA"]
    J --> K

How postal smishing operations function¶

Postal delivery smishing is not executed by isolated hobbyists; it is orchestrated by organized cybercrime syndicates using distributed spam hardware, reverse proxy phishing kits, and automated financial cash-out pipelines.

+-----------------------------------------------------------------------------+
|                     POSTAL SMISHING ATTACK ARCHITECTURE                     |
+-----------------------------------------------------------------------------+
|                                                                             |
|  1. Mass SMS Blast             SIM farms and compromised iMessage botnets   |
|     (Millions daily)           send automated texts to sequential numbers.  |
|                                                                             |
|  2. Spoofed Redelivery URL     Victim clicks lookalike domain               |
|     (Reverse proxy kit)        (e.g., usps-redeliver-tracking-hub.com).     |
|                                                                             |
|  3. Fake Tracking Interface    Page displays realistic USPS branding,       |
|     (Address verification)     simulated tracking status, and address form. |
|                                                                             |
|  4. Card Harvesting Trap       Page demands $0.35 redelivery fee;           |
|     (CVV, expiration, ZIP)     captures complete payment credentials.       |
|                                                                             |
|  5. Real-Time OTP Intercept    Scammer attempts Apple Pay provisioning;     |
|     (Adversary-in-the-Middle)  tricks victim into typing bank SMS code.     |
|                                                                             |
+-----------------------------------------------------------------------------+

The mass distribution infrastructure: SIM farms and botnets¶

Criminal syndicates blast millions of smishing messages daily to mobile phone subscribers across entire area codes using specialized hardware:

• Hardware SIM Farms (GSM Modems): Racks of multi-channel GSM modems containing hundreds of prepaid cellular SIM cards purchased with stolen funds or activated under fake names. These devices automatically rotate telephone numbers to bypass carrier spam filters.
• Compromised iMessage and RCS Botnets: Attackers use software scripts to hijack Apple iMessage and Google RCS accounts, allowing them to send blue-bubble messages or encrypted RCS texts directly to victims over data channels, completely bypassing cellular carrier SMS firewalls.
• Smishing-as-a-Service (SmaaS): Dark web threat actors sell turn-key smishing kits that include fresh lists of active mobile phone numbers, automated SMS gateway APIs, and pre-hosted postal templates for a subscription fee.

Reverse proxy phishing kits and lookalike domains¶

When a victim taps the link in the message, the web browser loads a sophisticated reverse proxy phishing framework (such as Modlishka, Evilginx, or custom postal kits):

• Domain Typosquatting: Attackers register lookalike domains that mimic official government services, such as usps-tracking-support-redelivery.com, post-office-portal-us.com, or usps-update-delivery-info.org.
• Dynamic Geotargeting: The phishing server inspects the incoming visitor's IP address. If the visitor is located in the United Kingdom, the server redirects them to a fake Royal Mail template; if in Canada, to a fake Canada Post portal; and if in the United States, to a fake USPS landing page.
• Bot and Crawler Cloaking: The server automatically detects search engine indexing crawlers, cybersecurity researchers, and threat scanning bots, serving them a harmless blank page or a 404 error while delivering the malicious phishing template exclusively to genuine mobile smartphone users.

The real-time adversary-in-the-middle payment trap¶

The payment page appears to process a trivial charge, such as 0.35 USD, 1.20 USD, or 2.99 USD, under the guise of an "administrative redelivery fee" or "package holding surcharge":

• When you type your card details and click "Submit," the phishing kit does not process a 0.35 USD charge.
• Instead, an automated bot in the background takes your sixteen-digit card number, CVV code, and billing ZIP code and immediately attempts to bind your card to a mobile wallet (such as Apple Pay, Google Wallet, or Samsung Pay) on the attacker's smartphone.
• When your bank detects the new wallet enrollment, it generates an authentic SMS verification passcode sent directly to your phone.
• The fake postal website immediately displays an authentic-looking field reading: "For security, enter the 6-digit verification code sent by your bank."
• If you type that code into the website, the attacker's script submits it to your bank, successfully adding your card to their physical smartphone. The scammer can now make unlimited contactless purchases in retail stores until your card limit is exhausted.

Identifying fake postal text messages¶

Official postal carriers adhere to strict digital communication protocols. Recognizing the structural differences between legitimate notifications and fraudulent smishing messages allows you to spot threats instantly.

Kompromis mobilnog uređaja: phishing naspram bankarskih trojanaca¶

Dok većina napada na poštansku dostavu traži podatke o kreditnoj kartici i podatke o identitetu putem web obrazaca, neke kampanje primjenjuju mobilni zlonamjerni softver dizajniran za uspostavljanje trajnog pristupa na pametnim telefonima.

+-----------------------------------------------------------------------------+
|                     SMARTPHONE THREAT VECTOR MATRIX                         |
+-----------------------------------------------------------------------------+
|                                                                             |
|  Device Platform       Attack Vector                  Technical Impact      |
|  -------------------------------------------------------------------------  |
|  Apple iOS             Web Phishing Form              Harvests card, CVV,   |
|  (iPhone)              (No APK installation)          and billing address   |
|                                                                             |
|  Apple iOS             Malicious MDM Profile          Installs rogue root   |
|  (iPhone)              (Prompt to install profile)    certificates and VPN  |
|                                                                             |
|  Google Android        Web Phishing Form              Harvests card, CVV,   |
|  (Samsung, Pixel)      (No APK installation)          and billing address   |
|                                                                             |
|  Google Android        Malicious APK Download         Deploys banking       |
|  (Sideloaded App)      (TeaBot, FluBot, Anatsa)       trojan with keylogger |
|                                                                             |
+-----------------------------------------------------------------------------+

Apple iOS: profili mobilne konfiguracije i Safari phishing¶

Na Apple uređajima koji koriste iOS, mobilni operativni sistem zabranjuje direktnu instalaciju aplikacija izvan službenog App Store-a osim ako se prihvati profil upravljanja mobilnim uređajem za preduzeća:

• Ako ste samo posjetili web stranicu u Safariju i upisali svoje podatke o plaćanju, vaš fizički iPhone nije zaražen zlonamjernim softverom. Kompromis je ograničen na podatke koje ste dostavili na obrascu.
• Međutim, ako vas web lokacija zatraži da preuzmete "USPS sigurnosni certifikat" ili "profil isporuke" i uputi vas u Postavke da instalirate konfiguracijski profil, odmah odbijte upit.
• Zlonamjerni MDM profil omogućava napadaču da usmjeri sav vaš internet promet preko lažnog proxy servera, presrećući lozinke i nešifrirane podatke.
• Da biste provjerili ima li lažnih profila na vašem iPhoneu, otvorite Postavke -> Općenito -> VPN & Upravljanje uređajima. Ako se pojavi bilo koji nepoznati profil, dodirnite ga i odaberite Ukloni upravljanje.

Google Android: APK bankovni trojanci sa strane¶

Na Android uređajima prevaranti često pokušavaju da prevare korisnike da preuzmu i instaliraju datoteke paketa zlonamjernih aplikacija (APK):

• Web lokacija za krađu identiteta prikazuje upozorenje: "Da biste pratili svoj paket u realnom vremenu, preuzmite službeni USPS Mobile Tracking Assistant."
• Pregledač preuzima datoteku pod nazivom USPS_Track.apk ili Package_Service.apk.
• Ako dodirnete preuzetu datoteku i zaobiđete sigurnosna upozorenja za Android (kao što je dozvoljavanje instalacije iz nepoznatih izvora), instalirat ćete moćni bankarski trojanac (kao što je TeaBot, FluBot ili Anatsa).

• Kada žrtva slučajno odobri instalaciju bočno učitanog APK-a, zlonamjerni softver odmah traži dozvolu da omogući usluge pristupačnosti za Android. Ove funkcije pristupačnosti su prvobitno dizajnirane da pomognu korisnicima sa fizičkim invaliditetom čitanjem teksta na ekranu naglas ili automatizacijom pokreta. Međutim, bankarski trojanci iskorištavaju pristup pristupačnosti kako bi uspostavili potpunu administrativnu kontrolu nad mobilnim operativnim sistemom:

• Kejlogovanje u realnom vremenu i skraping ekrana: Zlonamjerna pozadinska usluga bilježi svaki znak upisan na tastaturi, bilježi korisnička imena, glavne lozinke i lične identifikacijske brojeve u svim aplikacijama.

• Malicious Screen Overlays: Kada žrtva otvori legitimnu aplikaciju za bankarstvo ili kriptovalutu, trojanac detektuje pokretanje aplikacije i trenutno prikazuje prozirni ili u pikselima savršen lažni ekran za prijavu direktno preko originalne aplikacije. Kada unesete svoje vjerodajnice, oni se šalju serveru napadača dok se aplikacija ruši ili prikazuje simulirani ekran za učitavanje.
• Automatsko presretanje SMS-a: Trojanac presreće dolazne SMS tekstualne poruke koje sadrže jednokratne šifre koje šalju banke, tiho briše obavještenja tako da ih nikada ne vidite i prenosi šifre za autentifikaciju prevarantu u roku od nekoliko milisekundi.

Korak po korak protokol za zadržavanje ugroženih platnih kartica¶

Kada su akreditivi za plaćanje uneseni u lažni portal za ponovnu isporuku, poduzimanje odlučnih radnji s vašom finansijskom institucijom zaustavlja neovlaštene naplate.

flowchart TD
    A["Detalji kartice uneseni na stranicu lažne ponovne isporuke"] --> B["Otvorite aplikaciju za mobilno bankarstvo i odmah zaključajte karticu"]
    B --> C["Odjel za prevare 24/7 izdavaoca pozivnih kartica"]
    C --> D["Zahtjev za potpuno otkazivanje i ponovno izdavanje kartice"]
    D --> E["Pregledajte sve transakcije od posljednja 72 sata"]
    E --> F{"Postoje li neovlaštene naplate ili čekanja na čekanju?"}
    F -->|"Da"| G["Pokrenite potrošački spor u skladu sa Uredbom Z/E za lažne artikle"]
    F -->|"Ne: Uhvaćen prije optužbe"| H["Potvrdite da nisu dodani digitalni novčanici (Apple/Google Pay)."]
    G --> I["Opozovite sve tokenizirane pretplate povezane s ukradenom karticom"]
    H --> I
    I --> J["Monitor Checking Account and Credit Card for 60 Days"]

Locking and reissuing compromised payment cards¶

Do not wait to see whether an unauthorized charge appears on your statement. The moment you realize the website was illegitimate, initiate card cancellation:

• Prijavite se na mobilnu aplikaciju svoje banke i pronađite sigurnosne postavke kartice. Dodirnite Zaključaj karticu ili Zamrzni karticu da spriječite pokušaje autorizacije u stvarnom vremenu.
• Kontaktirajte odeljenje za prevare banke izdavaoca 24 sata dnevno, 7 dana u nedelji koristeći telefonski broj utisnut na poleđini vaše fizičke kartice.
• Jasno navedite: "Pogrešno sam unio broj svoje kartice, datum isteka i CVV kod na internetskoj phishing web stranici. Treba mi odmah otkazati ovu karticu i izdati zamjena novim brojem računa."
• Potvrdite sa predstavnikom da banka onemogućuje ažuriranja tokeniziranih trgovaca. Mnogi izdavaoci kreditnih kartica učestvuju u automatizovanim uslugama ažuriranja kartica koje trgovcima automatski daju broj vaše nove kartice kada se kartica ponovo izda; izričito zahtijevati od banke da prekine sve postojeće ponavljajuće veze s trgovcima.

Osporavanje lažnih transakcija prema saveznom zakonu o potrošačima¶

Ako su napadači uspjeli izvršiti neovlaštene naplate prije nego što ste zaključali karticu, savezni bankarski statuti ograničavaju vašu ličnu finansijsku odgovornost:

• Zakon o poštenom naplati kredita (FCBA, 12 CFR, dio 1026 / Uredba Z): Za transakcije kreditnom karticom, vaša maksimalna zakonska odgovornost prema saveznom zakonu za neovlaštene troškove iznosi 50 USD. Većina velikih izdavalaca kartica (Visa, Mastercard, American Express, Discover) održavaju politiku nulte odgovornosti koja se u potpunosti odriče ove naknade od 50 USD kada odmah prijavite prijevaru.
• Electronic Fund Transfer Act (EFTA, 12 CFR Part 1005 / Regulation E): For debit card transactions linked to checking accounts, timing is critical. If you notify your bank within two business days of learning about the compromise, your liability is capped at 50 USD. If you report between two and sixty calendar days after your monthly statement is transmitted, your liability rises to 500 USD. Beyond sixty days, you risk losing all money stolen from your account.
• Vodite pisani dnevnik svakog telefonskog razgovora sa bankom, uključujući datum, vrijeme, ime predstavnika i broj predmeta spora.

Mobile device decontamination and security hardening¶

Čišćenje i učvršćivanje vašeg mobilnog uređaja sprečava stalni nadzor, prikupljanje akreditiva i ponavljajuće napade neželjene pošte.

+-----------------------------------------------------------------------------+
|                     SMARTPHONE DECONTAMINATION CHECKLIST                    |
+-----------------------------------------------------------------------------+
|                                                                             |
|  [X] Clear Mobile Browser Cache: Purge Safari, Chrome, or Firefox cache,    |
|      cookies, and website data to remove cached phishing sessions.          |
|                                                                             |
|  [X] Audit Installed Applications: Inspect all apps, removing any unknown  |
|      software, especially apps installed outside official app stores.       |
|                                                                             |
|  [X] Audit Accessibility Permissions (Android): Revoke accessibility       |
|      access for any third-party app not explicitly trusted.                |
|                                                                             |
|  [X] Remove Enterprise MDM Profiles (iOS): Delete unfamiliar device        |
|      management certificates under Settings -> VPN & Device Management.     |
|                                                                             |
|  [X] Enable Spam Filtering: Activate native carrier and operating system    |
|      spam call and message filters (Silence Unknown Callers / Spam Shield). |
|                                                                             |
+-----------------------------------------------------------------------------+

Čišćenje keša mobilnog pretraživača i pohrane sesija¶

Web lokacije za krađu identiteta pohranjuju skripte za praćenje, tokene sesije i lokalne objekte predmemorije unutar vašeg mobilnog preglednika kako bi pratili odgovore posjetitelja:

• iOS Safari: Otvorite Postavke -> Safari -> Obriši historiju i podatke o web lokaciji. Odaberite "Sva historija" i potvrdite. Ovo zatvara sve otvorene kartice pretraživača i briše pohranjene kolačiće, keširane slike i unose lokalne web baze podataka.
• Android Google Chrome: Open Chrome, tap the three dots in the upper right corner, select Settings -> Privacy and security -> Clear browsing data. Choose "All time," check "Cookies and site data" and "Cached images and files," and tap Clear data.

Neutralizacija zlonamjernih Android aplikacija¶

If you downloaded and installed an application file from a phishing link on an Android phone, remove the threat immediately:

• Restart your Android smartphone in Safe Mode (on most models, press and hold the Power button, then touch and hold the "Power off" icon on the screen until the "Reboot to safe mode" prompt appears). Safe Mode prevents third-party malware apps from running in the background.
• Open Settings -> Apps -> See all apps.
• Scroll through the list looking for suspicious applications without proper corporate icons, apps with generic names (such as "Package Service," "System Update," "Flash Player," or "USPS Assist"), or apps installed on the day of the incident.
• Select the suspicious application, tap Force Stop, then tap Uninstall.
• If the "Uninstall" button is greyed out, the malware has obtained Device Administrator privileges. Open Settings -> Security -> Device admin apps, locate the malicious app, toggle off its administrator permissions, and proceed with uninstallation.

Filtering smishing messages at the operating system level¶

Both Apple iOS and Google Android include built-in filtering tools to silence unsolicited text messages from numbers not stored in your contacts:

• Apple iOS: Open Settings -> Messages, scroll down to "Message Filtering," and toggle on Filter Unknown Senders. This creates a separate tab in your Messages application for incoming texts from unknown numbers, silencing notification sounds and keeping malicious links out of your primary view.
• Google Android (Google Messages): Open Google Messages, tap your profile avatar in the upper right, tap Messages settings -> Spam protection, and toggle on Enable spam protection. This crowdsourced neural filtering engine automatically detects and routes suspected smishing texts to your "Spam & Blocked" folder without vibrating your phone.

Official reporting channels and postal law enforcement¶

Submitting detailed fraud reports to federal agencies helps postal inspectors map spam syndicates, seize fraudulent domains, and take down criminal server infrastructure.

+-----------------------------------------------------------------------------+
|                      OFFICIAL FRAUD REPORTING DIRECTORY                     |
+-----------------------------------------------------------------------------+
|                                                                             |
|  Organization             Contact Channel           Purpose                 |
|  -------------------------------------------------------------------------  |
|  Carrier Spam Service     Forward SMS to 7726       Triggers carrier-wide   |
|                           (Universal shortcode)     spam block              |
|                                                                             |
|  US Postal Inspection     spam@uspis.gov            Federal criminal        |
|  Service (USPIS)          1-877-876-2455            investigation of fraud  |
|                                                                             |
|  FBI Internet Crime       ic3.gov                   Transnational cyber-    |
|  Complaint Center (IC3)                             crime tracking          |
|                                                                             |
|  Federal Trade            reportfraud.ftc.gov       Consumer deceptive trade|
|  Commission (FTC)                                   practice reporting      |
|                                                                             |
|  Google Safe Browsing     safebrowsing.google.com/  Submits malicious URL   |
|                           safebrowsing/report_phish for browser blocking    |
|                                                                             |
+-----------------------------------------------------------------------------+

Reporting to the United States Postal Inspection Service¶

The United States Postal Inspection Service is the federal law enforcement agency responsible for investigating mail fraud, postal counterfeiting, and smishing attacks targeting USPS customers:

• Forward the smishing text message to spam@uspis.gov.
• In your email body, include a screenshot of the text message showing the originating phone number, the date and time received, and the exact website URL displayed in the message.
• USPIS cyber investigators coordinate with domain registrars, hosting providers, and federal prosecutors to seize fraudulent domains and shut down phishing infrastructure.

Reporting to mobile telecommunications carriers via 7726¶

The universal shortcode 7726 (spelling SPAM on a standard telephone keypad) is maintained by mobile network operators worldwide (including AT&T, Verizon, T-Mobile, Vodafone, and EE):

• Copy the text of the fraudulent message.
• Create a new outgoing text message addressed to 7726 and paste the text.
• Your carrier will immediately reply with an automated prompt asking for the originating phone number or email address that sent the spam.
• Reply with the sender's phone number.
• Carrier threat analysis centers use these aggregated reports to update real-time network-level SMS firewalls, blocking identical messages before they reach millions of other subscribers.

Zaštita od preuzimanja računa USPS Informed Delivery i preusmjeravanja pošte¶

Opasan sekundarni vektor poštanskog napada uključuje lažno kreiranje naloga na legitimnoj platformi USPS Informed Delivery. Kada napadači uhvate vaše puno ime, fizičku adresu i podatke o platnoj kartici, ponekad pokušavaju registrirati neovlašteni račun na vaše ime na usps.com:

• Zloupotreba funkcije informirane isporuke: Informirana dostava omogućava stanovnicima da pregledaju digitalne slike dolazne pošte veličine pisma u sivim tonovima i prate pakete koji su planirani da stignu na njihovu adresu. Ako cyber kriminalac registruje račun koristeći vašu adresu, može vidjeti skenirane slike dolaznih bankovnih izvoda, poreznih dokumenata, pisama o zamjeni kreditne kartice i prepiske vlade prije nego što pošta stigne u vaše fizičko sanduče.
• Unauthorized Change of Address (COA): Attackers may use harvested personal information to submit an electronic Change of Address request through the postal service, diverting your physical mail to a vacant home, package drop, or commercial mail receiving agency. Once your mail is redirected, criminals intercept newly issued credit cards, replacement debit cards, and sensitive financial records without your knowledge.
• Verifying Account Status: Visit usps.com, go to the Informed Delivery portal, and attempt to sign in or create an account with your personal details. If the platform indicates that an account already exists for your address under an email address you do not recognize, contact USPS customer service immediately.
• In-Person Identity Verification: If an unauthorized account was created, visit your local post office branch with two forms of government identification and proof of address. Request that postal clerks terminate the unauthorized digital account and place a fraud hold on your physical delivery address to block electronic address changes.

Stress management and health consequences¶

Falling victim to an online scam often produces acute emotional distress, self-blame, and feelings of vulnerability. Discovering that a simple tap on your phone handed your credit card number or personal identity details to criminals can trigger physical shock, insomnia, elevated blood pressure, and anxiety.

Recognize that postal smishing messages are professionally designed by criminal teams who exploit the fact that millions of people await packages every day. If the stress of a financial compromise causes chest tightness, shortness of breath, severe shaking, or panic, seek medical attention immediately. Consider completing a certified first aid, CPR, and psychological first aid course through the Red Cross, St John Ambulance, or a local provider to build confidence and practical competence in managing physical shock and acute health crises during family emergencies.

Često postavljana pitanja¶

Does the United States Postal Service ever send text messages about package deliveries?¶

The United States Postal Service only sends text notifications to customers who have explicitly registered for tracking updates on the official website (usps.com) for a specific tracking number, or who have enrolled in Informed Delivery. Legitimate automated text messages from USPS arrive exclusively from the official five-digit shortcode 28777 (USPS) and never contain links directing users to update address details or pay redelivery fees. The postal service never sends unsolicited text messages demanding personal information or credit card numbers to release a package.

What should I do if I entered my credit card details but closed the webpage before submitting?¶

Modern reverse proxy phishing kits frequently use automated form-tracking scripts, such as keyloggers or real-time websocket connections, that capture keystrokes as you type them into individual input boxes, even if you never click the final "Submit" or "Continue" button. Because your card number, expiration date, and CVV code may have been transmitted in real time, you must treat the card as compromised. Contact your financial institution immediately to lock and replace the payment card.

Why do scammers only ask for a tiny fee like 0.35 USD instead of hundreds of dollars?¶

Scammers intentionally request a negligible fee between 0.30 USD and 3.00 USD because consumers rarely hesitate to spend a small amount to resolve a delayed package. This low dollar amount bypasses human skepticism and avoids triggering automated bank fraud rules that scrutinize high-value transactions. Once the scammer captures the full card credentials, they use the stolen data to enroll your card into mobile wallets or initiate unauthorized high-dollar retail transactions.

Can scammers steal my money if I only clicked the link but did not type any information?¶

If you only clicked the link in Safari, Chrome, or another standard mobile browser and immediately closed the tab without submitting information, installing an application, or downloading a configuration profile, your financial accounts remain secure. Modern mobile operating systems isolate web browser tabs within secure sandboxes, preventing websites from extracting stored passwords or payment cards without user interaction. Clear your browser cache and website data as a standard security precaution.

What is the difference between a real USPS tracking number and a fake tracking number in a text?¶

Authentic USPS tracking numbers adhere to standardized formats, typically consisting of 20 to 22 numerical digits starting with 9 (for domestic packages), or 13 alphanumeric characters beginning with two letters, followed by nine digits, and ending with US (for international shipments). Smishing text messages often include completely fabricated strings of random letters and numbers, or omit the tracking number entirely while directing you to click a link. You can verify any tracking number safely by going directly to usps.com and entering the code into the official tracking search bar.

Izvori provjereni¶

• United States Postal Inspection Service (USPIS, United States): Public Awareness Advisory: Smishing Package Delivery Scams and Postal Phishing (uspis.gov).
• Federal Trade Commission (FTC, United States): Consumer Alert: Fake Package Delivery Text Messages and Smishing Attacks (consumer.ftc.gov).
• Cybersecurity and Infrastructure Security Agency (CISA, United States): Combating Mobile Phishing and Smishing Threats: Guidance for Consumers and Organizations (cisa.gov).
• Federal Communications Commission (FCC, United States): Consumer Guide: Robotexts, Smishing, and Package Delivery Scams (fcc.gov).
• National Cyber Security Centre (NCSC, United Kingdom): Phishing and Smishing Scams: Identifying and Reporting Malicious SMS Messages (ncsc.gov.uk).
• Canadian Anti-Fraud Centre (CAFC, Canada): Fraud Prevention: Package Delivery and Courier Smishing Schemes (antifraudcentre-centreantifraude.ca).

Povezani vodiči¶

• Odgovor na kršenje podataka i curenje lozinke
• MFA phishing and adversary-in-the-middle bypass
• QR code phishing and quishing defense
• Krađa paketa i piraterija na trijemu
• Prevare i prevare