USPS package smishingን ናይ ሓሶት ዳግመ-ምብጻሕ ምትላልን።¶

ብሰንኪ ዘይምሉእ ኣድራሻ ጎደና ፓኬጅ ኣገልግሎት ፖስታ ሕቡራት መንግስታት ኣመሪካ ክበጽሕ ከምዘይክእል ዝገልጽ ህጹጽ መልእኽቲ ቴክስት ምቕባሉ፡ ሕጂ ሓደ ካብቶም ኣብ ሞባይል መሳርሒታት ዝፍጠሩ ልሙዳት ስግኣታት ሳይበር ኮይኑ ኣሎ። እዞም ብስሚሺንግ ዝፍለጡ ናይ ሓጺር መልእኽቲ ኣገልግሎት (SMS) ፊሽንግ መጥቃዕቲ፡ ​​ክውንነታዊ ፖስታ ምልክት ንግዲ፡ ምምሳል ምክትታል ባርኮድን ወግዓዊ ቋንቋን ዘርእዩ እዮም። እቲ መልእኽቲ ናብ ሓደ ናይ ምትላል መልክዕ ዘለዎ መርበብ ሓበሬታ ይመርሓካ፣ ኣብኡ ድማ ኣድራሻ ገዛኻ ከተረጋግጽን ንእሽቶ ናይ ዳግመ-ምብጻሕ ክፍሊት ክትከፍልን ትሕተት፣ እዚ ድማ ብተለምዶ ካብ 0.30 ዶላር ክሳብ 3.00 ዶላር ኣመሪካ፣ ቁጽሪ ደቢት ወይ ክረዲት ካርድካ፣ ዕለት ምውዳእ ግዜኻ፣ ኮድ ውሕስነትን ዝርዝር ሕሳብ ሕሳብካን ብምእታው እዩ።

እቲ ንእሽቶ ክፍሊት ዳግመ-ምብጻሕ፡ ምሉእ ሓበሬታ ክረዲት ካርድካን ውልቃዊ መዛግብቲ መንነትካን ንምሓዝ ዝተዳለወ መታለሊ ኣገባብ ጥራይ እዩ። ሓንሳብ ምስ ቀረበ፡ ገበነኛ መርበባት ብኡንብኡ ዘይተፈቕደ ናይ ኦንላይን ቸርች ትራንዛክሽን የበግሱ፡ ካርድካ ኣብ ተደጋጋሚ ናይ ምትላል ምዝገባ ይምዝግቡ፡ ወይ ድማ ኣብ ሓቀኛ ግዜ ናይ ሓደ ግዜ ፓስዎርድ ኢንተርሰፕተራት ተጠቒሞም ኣካውንት ምውሳድ ይፍትኑ። ኣብ ገለ ኣጋጣሚታት ኣብ መሳርሒታት ኣንድሮይድ፡ ነቲ ጐዳኢ መላግቦ ምጥዋቕ፡ ድምጺ መፍትሕ ምውቃዕ ዝከታተሉን ብዙሕ ረቛሒታት ዘለዎም ናይ ምርግጋጽ ኮዳት ዝዓግቱን ናይ ባንክ ትሮጃን መተግበሪታት ድምጺ ኣልቦ ምውራድ የበግስ። ኣብ ካርድ ክፍሊትካ፡ ሞባይልካን ፋይላት ልቓሕካን ቅልጡፍ ናይ ምዕጋት ስጉምትታት ምውሳድ፡ ፋይናንሳዊ ክሳራ ከውጽእን ንነዊሕ እዋን ዝጸንሕ ስርቂ መንነት ክከላኸልን ይኽእል።

እዚ ሕጂ ግበሩ¶

ናይ ሓሶት ናይ ፖስታ ጽሑፍ ሊንክ እንተ ጠዊቕካ ወይ ኣብ ዳግመ-ምብጻሕ መርበብ ሓበሬታ ዝርዝር ክፍሊት እንተ ኣቕሪብካ፡ ነዞም ሽዱሽተ ስጉምትታት ብቕልጡፍ ውሰድ፤

1. ኣብ ዋጋ ዕዳጋ ዝኣተወ ናይ ክፍሊት ካርድ ኣብዚ ሕጂ እዋን ዕጸዎ ወይ ስርዝዎ:
   • ናይ ሞባይል ባንኪ ኣፕካ ክፈት ወይ ድማ ኣብ ድሕሪት ካርድካ ዝተሓትመ ናይ ህጹጽ ምትላል ቁጽሪ ተጠቒምካ ናብቲ ካርድ ዘውጽእ ሰብ ደውል።
   • ነቲ ናይ ኣፕ ካርድ መቆጻጸሪታት ተጠቒምካ ብቕጽበት ኩነታት ካርድኻ ናብ "ተዓጽዩ" ንምቕያር ወይ ድማ ነታ ካርድ ኣብ ሓደጋ ከም ዝኣተወት ክትሕብር።
   • ምሉእ ብምሉእ ሓድሽ ዓሰርተ ሽዱሽተ ኣሃዝ ዘለዎ ቁጽሪ ሕሳብ፣ ዕለት ምውዳእን ኮድ ድሕነት ሲቪቪን ዘለዎ ቅልጡፍ መተካእታ ካርድ ሕተት።
2. ኣብ ምጽባይ ዝርከቡ ትራንዛክሽን ምግምጋምን ናይ ምትላል ክስታት ምክታዕን፤
   • ኣብ ቀረባ እዋን ዝገበርካዮ ትራንዛክሽን ታሪኽ ንዘይትፈልጦ ማይክሮ-ክፍሊት ወይ ኣብ ምጽባይ ዘይተፈቕደ ፍቓድ ነጋዳይ መርምር።
   • ንባንክኻ ንኹሉ ተደጋጋሚ ናይ ምዝገባ ፍቓድ ክነጽግን ብመሰረት ሕግታት ሓለዋ ተጠቀምቲ ፌደራል ወግዓዊ ምምላስ ክፍሊት ከውጽእን መምርሒ ሃቦ።
   • ንወኪል ምትላል ብግልጺ ግለጾ፡ "ዝርዝር ካርደይ ኣብ ናይ ምትላል መርበብ ሓበሬታ ፊሽንግ ብፖስታ ምብጻሕ ኣምሲለ ኣእትየዮ።"
3. ሞባይልካ ዘይተፈቐደ ኣፕ ወይ ፕሮፋይል እንተሃልዩ መርምር:
   • ኣብ ኣንድሮይድ Settings -> Apps ብምኽፋት ኣብ ቀረባ እዋን ዝተተኽሉ ዘይፍለጡ ኣፕሊኬሽናት (ከም ናይ ሓሶት ፓኬጅ ትራከር ወይ ፍላሽ ፕለየር) ምህላዎም መርምሩ።
   • ኣብ iPhone Settings -> General -> VPN & Device Management ብምኽፋት ፍቓድ ዘይብሉ ናይ ሞባይል መሳርሒ ምሕደራ (MDM) ውቅር ፕሮፋይላት ወይ ናይ ትካል ምስክር ወረቐት ከምዘይተተኽለ ኣረጋግጽ።
   • If an unknown application or configuration profile is found, remove it immediately and restart the device.
4. Forward the malicious text message to report the sender:
   • Copy the text message body and forward it directly to the universal carrier spam shortcode 7726 (which spells SPAM).
   • Forward the message and sender details to the United States Postal Inspection Service at spam@uspis.gov.
   • Take a screenshot of the text message and website URL before deleting the conversation thread.
5. Protect your personal identity if you submitted full address and personal data:
   • If the phishing form requested your Social Security number, date of birth, or mother's maiden name, treat your identity as exposed.
   • Place temporary fraud alerts or full security freezes on your credit files at Equifax, Experian, and TransUnion.
   • Monitor your credit reports regularly for unauthorized inquiries or newly opened trade lines.
6. Report the smishing portal to federal cybersecurity databases:
   • File an internet crime complaint with the FBI Internet Crime Complaint Center at ic3.gov.
   • Submit the malicious phishing URL to Google Safe Browsing and the Cybersecurity and Infrastructure Security Agency (CISA) to protect other consumers.
   • Report the deceptive business practice to the Federal Trade Commission at reportfraud.ftc.gov.

Incident triage flowchart¶

Follow this step-by-step decision pathway to assess your level of exposure, contain potential card fraud, and secure your mobile smartphone:

flowchart TD
    A["Received SMS Claiming Postal Delivery Failure"] --> B{"Did you click the web link in the text?"}
    B -->|"No: Only received text"| C["Forward SMS to 7726 and spam@uspis.gov, delete message, block number"]
    B -->|"Yes: Clicked link"| D{"Did you enter card details, password, or personal info?"}
    D -->|"No: Closed browser immediately"| E["Clear mobile browser cache and cookies, check device for downloaded files"]
    D -->|"Yes: Submitted card or info"| F["ካርድ ንምስርዛር ብቕልጡፍ ናብ ኣሃዱ ምትላል ኣወሃሃዲ ካርድ ደውሉ።"]
    F --> G["ክስታት ኣብ ምጽባይ ዘሎ ክርክርን ተደጋጋሚ ፍቓድ ምድምሳስን።"]
    G --> H{"ቁጽሪ ማሕበራዊ ድሕነት ወይ ዕለት ልደት ኣቕሪብኩም ዶ?"}
    H -->|"እወ፦ ምሉእ መንነት ተቓሊዑ"| I["ኣብ ኢክዊፋክስ፣ ኤክስፐርያንን ትራንስዩኒዮንን ናይ ጸጥታ ፍሪዝ ኣቐምጥ"]
    H -->|"ኣይፋልን፡ ካርድ ጥራይ እዩ ኣትዩ።"| J["ን60 መዓልታት ናይ ባንክ መግለጺታት ምክትታል፣ ናይ ልቓሕ ጸብጻባት ምርግጋጽ"]
    I --> K["ፊሺንግ URL ናብ FBI IC3, FTC, ከምኡውን CISA ሪፖርት ግበሩ"]
    J --> K

ስርሒታት ስሚሽ ፖስታ ከመይ ይሰርሑ¶

Postal delivery smishing is not executed by isolated hobbyists; it is orchestrated by organized cybercrime syndicates using distributed spam hardware, reverse proxy phishing kits, and automated financial cash-out pipelines.

+-----------------------------------------------------------------------------+
|                     POSTAL SMISHING ATTACK ARCHITECTURE                     |
+-----------------------------------------------------------------------------+
|                                                                             |
|  1. Mass SMS Blast             SIM farms and compromised iMessage botnets   |
|     (Millions daily)           send automated texts to sequential numbers.  |
|                                                                             |
|  2. Spoofed Redelivery URL     Victim clicks lookalike domain               |
|     (Reverse proxy kit)        (e.g., usps-redeliver-tracking-hub.com).     |
|                                                                             |
|  3. Fake Tracking Interface    Page displays realistic USPS branding,       |
|     (Address verification)     simulated tracking status, and address form. |
|                                                                             |
|  4. Card Harvesting Trap       Page demands $0.35 redelivery fee;           |
|     (CVV, expiration, ZIP)     captures complete payment credentials.       |
|                                                                             |
|  5. Real-Time OTP Intercept    Scammer attempts Apple Pay provisioning;     |
|     (Adversary-in-the-Middle)  tricks victim into typing bank SMS code.     |
|                                                                             |
+-----------------------------------------------------------------------------+

The mass distribution infrastructure: SIM farms and botnets¶

ሲንዲካታት ገበነኛታት ፍሉይ ሃርድዌር ተጠቒሞም መዓልታዊ ናብ ተጠቀምቲ ሞባይል ቴሌፎን ኣብ መላእ ከባቢ ኮድታት ብሚልዮናት ዝቑጸሩ ስሚሽንግ መልእኽትታት ይፍንፍሑ፤

• ሃርድዌር ሲም ፋርምስ (GSM Modems): ብዝተሰርቀ ገንዘብ ዝተዓደጉ ወይ ​​ብናይ ሓሶት ኣስማት ዝተንቀሳቐሱ ኣማኢት ቅድመ ክፍሊት ዘለዎም ሴሉላር ሲም ካርድታት ዝሓዘ ብዙሕ ቻነላት ዘለዎ GSM ሞደም ዝሓዘ ራክስ። እዞም መሳርሒታት ብኣውቶማቲክ ቁጽሪ ተሌፎን ብምዝውዋር ንናይ ተሸከምቲ ስፓም ፍልተር ይሓልፉ።
• ኣብ ዋጋ ዕዳጋ ዝኣተዉ iMessage and RCS Botnets: ኣጥቃዕቲ ንኣፕል iMessageን Google RCSን ኣካውንታት ንምጭዋይ ሶፍትዌር ስክሪፕት ይጥቀሙ፣ እዚ ድማ ሰማያዊ-ቡምባ መልእኽቲ ወይ ምስጢራዊ RCS ጽሑፋት ብቐጥታ ናብ ግዳያት ብዳታ ቻነላት ክሰዱ የኽእሎም፣ ምሉእ ብምሉእ ንናይ ሞባይል ተሸካሚ ኤስኤምኤስ ፋየርዎል ሓሊፎም።
• Smishing-as-a-Service (SmaaS): Dark web threat actors sell turn-key smishing kits that include fresh lists of active mobile phone numbers, automated SMS gateway APIs, and pre-hosted postal templates for a subscription fee.

Reverse proxy phishing kits and lookalike domains¶

When a victim taps the link in the message, the web browser loads a sophisticated reverse proxy phishing framework (such as Modlishka, Evilginx, or custom postal kits):

• Domain Typosquatting: Attackers register lookalike domains that mimic official government services, such as usps-tracking-support-redelivery.com, post-office-portal-us.com, or usps-update-delivery-info.org.
• Dynamic Geotargeting: The phishing server inspects the incoming visitor's IP address. If the visitor is located in the United Kingdom, the server redirects them to a fake Royal Mail template; if in Canada, to a fake Canada Post portal; and if in the United States, to a fake USPS landing page.
• Bot and Crawler Cloaking: The server automatically detects search engine indexing crawlers, cybersecurity researchers, and threat scanning bots, serving them a harmless blank page or a 404 error while delivering the malicious phishing template exclusively to genuine mobile smartphone users.

The real-time adversary-in-the-middle payment trap¶

The payment page appears to process a trivial charge, such as 0.35 USD, 1.20 USD, or 2.99 USD, under the guise of an "administrative redelivery fee" or "package holding surcharge":

• When you type your card details and click "Submit," the phishing kit does not process a 0.35 USD charge.
• Instead, an automated bot in the background takes your sixteen-digit card number, CVV code, and billing ZIP code and immediately attempts to bind your card to a mobile wallet (such as Apple Pay, Google Wallet, or Samsung Pay) on the attacker's smartphone.
• When your bank detects the new wallet enrollment, it generates an authentic SMS verification passcode sent directly to your phone.
• The fake postal website immediately displays an authentic-looking field reading: "For security, enter the 6-digit verification code sent by your bank."
• If you type that code into the website, the attacker's script submits it to your bank, successfully adding your card to their physical smartphone. The scammer can now make unlimited contactless purchases in retail stores until your card limit is exhausted.

Identifying fake postal text messages¶

Official postal carriers adhere to strict digital communication protocols. Recognizing the structural differences between legitimate notifications and fraudulent smishing messages allows you to spot threats instantly.

Mobile device compromise: phishing versus banking trojans¶

While most postal delivery smishing attacks seek credit card details and identity data through web forms, some campaigns deploy mobile malware designed to establish persistent access on smartphones.

+-----------------------------------------------------------------------------+
|                     SMARTPHONE THREAT VECTOR MATRIX                         |
+-----------------------------------------------------------------------------+
|                                                                             |
|  Device Platform       Attack Vector                  Technical Impact      |
|  -------------------------------------------------------------------------  |
|  Apple iOS             Web Phishing Form              Harvests card, CVV,   |
|  (iPhone)              (No APK installation)          and billing address   |
|                                                                             |
|  Apple iOS             Malicious MDM Profile          Installs rogue root   |
|  (iPhone)              (Prompt to install profile)    certificates and VPN  |
|                                                                             |
|  Google Android        Web Phishing Form              Harvests card, CVV,   |
|  (Samsung, Pixel)      (No APK installation)          and billing address   |
|                                                                             |
|  Google Android        Malicious APK Download         Deploys banking       |
|  (Sideloaded App)      (TeaBot, FluBot, Anatsa)       trojan with keylogger |
|                                                                             |
+-----------------------------------------------------------------------------+

Apple iOS: mobile configuration profiles and Safari phishing¶

On Apple devices running iOS, the mobile operating system prohibits direct application installation outside the official App Store unless an enterprise mobile device management profile is accepted:

• If you only visited the website in Safari and typed your payment details, your physical iPhone is not infected with malware. The compromise is limited to the data you submitted on the form.
• However, if the website prompted you to download a "USPS Security Certificate" or "Delivery Profile" and directed you into Settings to install a configuration profile, reject the prompt immediately.
• A malicious MDM profile allows an attacker to route all your internet traffic through a rogue proxy server, intercepting passwords and unencrypted data.
• To check for rogue profiles on your iPhone, open Settings -> General -> VPN & Device Management. If any unknown profile appears, tap it and select Remove Management.

Google Android: sideloaded APK banking trojans¶

On Android devices, scammers frequently attempt to trick users into downloading and installing malicious application package (APK) files:

• The phishing website displays an alert: "To track your package in real time, download the official USPS Mobile Tracking Assistant."
• The browser downloads a file named USPS_Track.apk ወይ Package_Service.apk.
• If you tap the downloaded file and bypass Android security warnings (such as allowing installation from unknown sources), you install a potent banking trojan (such as TeaBot, FluBot, or Anatsa).

• When a victim accidentally authorizes installation of a sideloaded APK, the malware immediately requests permission to enable Android Accessibility Services. These accessibility features are originally designed to help users with physical disabilities by reading screen text aloud or automating gestures. However, banking trojans exploit accessibility access to establish complete administrative control over the mobile operating system:

• Real-Time Keylogging and Screen Scraping: The malicious background service records every character typed into the keyboard, capturing usernames, master passwords, and personal identification numbers across all applications.

• Malicious Screen Overlays: When the victim opens a legitimate banking or cryptocurrency application, the trojan detects the app launch and instantly renders a transparent or pixel-perfect counterfeit login screen directly over the genuine app. When you enter your credentials, they are sent to the attacker server while the app crashes or shows a simulated loading screen.
• Automated SMS Interception: The trojan intercepts incoming SMS text messages containing one-time passcodes sent by banks, silently deletes the notifications so you never see them, and transmits the authentication codes to the scammer within milliseconds.

Step-by-step containment protocol for compromised payment cards¶

When payment credentials have been entered into a fraudulent redelivery portal, taking decisive action with your financial institution halts unauthorized charges.

flowchart TD
    A["Card Details Entered on Fake Redelivery Page"] --> B["Open Mobile Banking App and Lock Card Immediately"]
    B --> C["Call Card Issuer 24/7 Fraud Department"]
    C --> D["Request Complete Card Cancellation and Reissue"]
    D --> E["Review All Transactions from Last 72 Hours"]
    E --> F{"Are there unauthorized charges or pending holds?"}
    F -->|"እወ"| G["Initiate Regulation Z / E Consumer Dispute for Fraudulent Items"]
    F -->|"No: Caught before charges"| H["Verify No Digital Wallets (Apple/Google Pay) Were Added"]
    G --> I["Revoke All Tokenized Subscriptions Linked to Stolen Card"]
    H --> I
    I --> J["Monitor Checking Account and Credit Card for 60 Days"]

Locking and reissuing compromised payment cards¶

Do not wait to see whether an unauthorized charge appears on your statement. The moment you realize the website was illegitimate, initiate card cancellation:

• Log in to your bank's mobile application and locate the card security settings. Tap Lock Card or Freeze Card to prevent real-time authorization attempts.
• Contact the issuing bank's 24/7 fraud department using the telephone number stamped on the reverse side of your physical card.
• State clearly: "I mistakenly entered my card number, expiration date, and CVV code on an online phishing website. I need this card canceled immediately and a replacement issued with a new account number."
• Confirm with the representative that the bank disables tokenized merchant updates. Many credit card issuers participate in automated card updater services that automatically give merchants your new card number when a card is reissued; explicitly request that the bank sever all existing recurring merchant links.

Disputing fraudulent transactions under federal consumer law¶

If the attackers managed to execute unauthorized charges before you locked the card, federal banking statutes limit your personal financial liability:

• Fair Credit Billing Act (FCBA, 12 CFR Part 1026 / Regulation Z): For credit card transactions, your maximum legal liability under federal law for unauthorized charges is 50 USD. Most major card issuers (Visa, Mastercard, American Express, Discover) maintain zero-liability policies that waive this 50 USD fee entirely when you report fraud promptly.
• Electronic Fund Transfer Act (EFTA, 12 CFR Part 1005 / Regulation E): For debit card transactions linked to checking accounts, timing is critical. If you notify your bank within two business days of learning about the compromise, your liability is capped at 50 USD. If you report between two and sixty calendar days after your monthly statement is transmitted, your liability rises to 500 USD. Beyond sixty days, you risk losing all money stolen from your account.
• Maintain a written log of every telephone conversation with your bank, including the date, time, representative name, and dispute case number.

Mobile device decontamination and security hardening¶

Cleaning and hardening your mobile device prevents ongoing surveillance, credential harvesting, and repetitive smishing spam attacks.

+-----------------------------------------------------------------------------+
|                     SMARTPHONE DECONTAMINATION CHECKLIST                    |
+-----------------------------------------------------------------------------+
|                                                                             |
|  [X] Clear Mobile Browser Cache: Purge Safari, Chrome, or Firefox cache,    |
|      cookies, and website data to remove cached phishing sessions.          |
|                                                                             |
|  [X] Audit Installed Applications: Inspect all apps, removing any unknown  |
|      software, especially apps installed outside official app stores.       |
|                                                                             |
|  [X] Audit Accessibility Permissions (Android): Revoke accessibility       |
|      access for any third-party app not explicitly trusted.                |
|                                                                             |
|  [X] Remove Enterprise MDM Profiles (iOS): Delete unfamiliar device        |
|      management certificates under Settings -> VPN & Device Management.     |
|                                                                             |
|  [X] Enable Spam Filtering: Activate native carrier and operating system    |
|      spam call and message filters (Silence Unknown Callers / Spam Shield). |
|                                                                             |
+-----------------------------------------------------------------------------+

Purging mobile browser cache and session storage¶

Phishing websites store tracking scripts, session tokens, and local cache objects within your mobile browser to track visitor responses:

• iOS Safari: Open Settings -> Safari -> Clear History and Website Data. Select "All History" and confirm. This closes all open browser tabs and deletes stored cookies, cached images, and local web database entries.
• Android Google Chrome: Open Chrome, tap the three dots in the upper right corner, select Settings -> Privacy and security -> Clear browsing data. Choose "All time," check "Cookies and site data" and "Cached images and files," and tap Clear data.

Neutralizing malicious Android applications¶

If you downloaded and installed an application file from a phishing link on an Android phone, remove the threat immediately:

• Restart your Android smartphone in Safe Mode (on most models, press and hold the Power button, then touch and hold the "Power off" icon on the screen until the "Reboot to safe mode" prompt appears). Safe Mode prevents third-party malware apps from running in the background.
• Open Settings -> Apps -> See all apps.
• Scroll through the list looking for suspicious applications without proper corporate icons, apps with generic names (such as "Package Service," "System Update," "Flash Player," or "USPS Assist"), or apps installed on the day of the incident.
• Select the suspicious application, tap Force Stop, then tap Uninstall.
• If the "Uninstall" button is greyed out, the malware has obtained Device Administrator privileges. Open Settings -> Security -> Device admin apps, locate the malicious app, toggle off its administrator permissions, and proceed with uninstallation.

Filtering smishing messages at the operating system level¶

Both Apple iOS and Google Android include built-in filtering tools to silence unsolicited text messages from numbers not stored in your contacts:

• Apple iOS: Open Settings -> Messages, scroll down to "Message Filtering," and toggle on Filter Unknown Senders. This creates a separate tab in your Messages application for incoming texts from unknown numbers, silencing notification sounds and keeping malicious links out of your primary view.
• Google Android (Google Messages): Open Google Messages, tap your profile avatar in the upper right, tap Messages settings -> Spam protection, and toggle on Enable spam protection. This crowdsourced neural filtering engine automatically detects and routes suspected smishing texts to your "Spam & Blocked" folder without vibrating your phone.

Official reporting channels and postal law enforcement¶

Submitting detailed fraud reports to federal agencies helps postal inspectors map spam syndicates, seize fraudulent domains, and take down criminal server infrastructure.

+-----------------------------------------------------------------------------+
|                      OFFICIAL FRAUD REPORTING DIRECTORY                     |
+-----------------------------------------------------------------------------+
|                                                                             |
|  Organization             Contact Channel           Purpose                 |
|  -------------------------------------------------------------------------  |
|  Carrier Spam Service     Forward SMS to 7726       Triggers carrier-wide   |
|                           (Universal shortcode)     spam block              |
|                                                                             |
|  US Postal Inspection     spam@uspis.gov            Federal criminal        |
|  Service (USPIS)          1-877-876-2455            investigation of fraud  |
|                                                                             |
|  FBI Internet Crime       ic3.gov                   Transnational cyber-    |
|  Complaint Center (IC3)                             crime tracking          |
|                                                                             |
|  Federal Trade            reportfraud.ftc.gov       Consumer deceptive trade|
|  Commission (FTC)                                   practice reporting      |
|                                                                             |
|  Google Safe Browsing     safebrowsing.google.com/  Submits malicious URL   |
|                           safebrowsing/report_phish for browser blocking    |
|                                                                             |
+-----------------------------------------------------------------------------+

Reporting to the United States Postal Inspection Service¶

The United States Postal Inspection Service is the federal law enforcement agency responsible for investigating mail fraud, postal counterfeiting, and smishing attacks targeting USPS customers:

• Forward the smishing text message to spam@uspis.gov.
• In your email body, include a screenshot of the text message showing the originating phone number, the date and time received, and the exact website URL displayed in the message.
• USPIS cyber investigators coordinate with domain registrars, hosting providers, and federal prosecutors to seize fraudulent domains and shut down phishing infrastructure.

Reporting to mobile telecommunications carriers via 7726¶

The universal shortcode 7726 (spelling SPAM on a standard telephone keypad) is maintained by mobile network operators worldwide (including AT&T, Verizon, T-Mobile, Vodafone, and EE):

• Copy the text of the fraudulent message.
• Create a new outgoing text message addressed to 7726 and paste the text.
• Your carrier will immediately reply with an automated prompt asking for the originating phone number or email address that sent the spam.
• Reply with the sender's phone number.
• Carrier threat analysis centers use these aggregated reports to update real-time network-level SMS firewalls, blocking identical messages before they reach millions of other subscribers.

Protecting against USPS Informed Delivery account takeover and mail diversion¶

A dangerous secondary vector of postal smishing involves fraudulent account creation on the legitimate USPS Informed Delivery platform. When attackers harvest your full name, physical street address, and payment card details, they sometimes attempt to register an unauthorized account in your name on usps.com:

• Informed Delivery Feature Abuse: Informed Delivery allows residents to preview greyscale digital images of incoming letter-sized mail and track packages scheduled to arrive at their address. If a cybercriminal registers an account using your address, they can view scanned images of incoming bank statements, tax documents, credit card replacement letters, and government correspondence before the mail reaches your physical mailbox.
• Unauthorized Change of Address (COA): Attackers may use harvested personal information to submit an electronic Change of Address request through the postal service, diverting your physical mail to a vacant home, package drop, or commercial mail receiving agency. Once your mail is redirected, criminals intercept newly issued credit cards, replacement debit cards, and sensitive financial records without your knowledge.
• Verifying Account Status: Visit usps.com, go to the Informed Delivery portal, and attempt to sign in or create an account with your personal details. If the platform indicates that an account already exists for your address under an email address you do not recognize, contact USPS customer service immediately.
• In-Person Identity Verification: If an unauthorized account was created, visit your local post office branch with two forms of government identification and proof of address. Request that postal clerks terminate the unauthorized digital account and place a fraud hold on your physical delivery address to block electronic address changes.

Stress management and health consequences¶

Falling victim to an online scam often produces acute emotional distress, self-blame, and feelings of vulnerability. Discovering that a simple tap on your phone handed your credit card number or personal identity details to criminals can trigger physical shock, insomnia, elevated blood pressure, and anxiety.

Recognize that postal smishing messages are professionally designed by criminal teams who exploit the fact that millions of people await packages every day. If the stress of a financial compromise causes chest tightness, shortness of breath, severe shaking, or panic, seek medical attention immediately. Consider completing a certified first aid, CPR, and psychological first aid course through the Red Cross, St John Ambulance, or a local provider to build confidence and practical competence in managing physical shock and acute health crises during family emergencies.

ብተደጋጋሚ ዝሕተቱ ሕቶታት¶

Does the United States Postal Service ever send text messages about package deliveries?¶

The United States Postal Service only sends text notifications to customers who have explicitly registered for tracking updates on the official website (usps.com) for a specific tracking number, or who have enrolled in Informed Delivery. Legitimate automated text messages from USPS arrive exclusively from the official five-digit shortcode 28777 (USPS) and never contain links directing users to update address details or pay redelivery fees. The postal service never sends unsolicited text messages demanding personal information or credit card numbers to release a package.

What should I do if I entered my credit card details but closed the webpage before submitting?¶

Modern reverse proxy phishing kits frequently use automated form-tracking scripts, such as keyloggers or real-time websocket connections, that capture keystrokes as you type them into individual input boxes, even if you never click the final "Submit" or "Continue" button. Because your card number, expiration date, and CVV code may have been transmitted in real time, you must treat the card as compromised. Contact your financial institution immediately to lock and replace the payment card.

Why do scammers only ask for a tiny fee like 0.35 USD instead of hundreds of dollars?¶

Scammers intentionally request a negligible fee between 0.30 USD and 3.00 USD because consumers rarely hesitate to spend a small amount to resolve a delayed package. This low dollar amount bypasses human skepticism and avoids triggering automated bank fraud rules that scrutinize high-value transactions. Once the scammer captures the full card credentials, they use the stolen data to enroll your card into mobile wallets or initiate unauthorized high-dollar retail transactions.

Can scammers steal my money if I only clicked the link but did not type any information?¶

If you only clicked the link in Safari, Chrome, or another standard mobile browser and immediately closed the tab without submitting information, installing an application, or downloading a configuration profile, your financial accounts remain secure. Modern mobile operating systems isolate web browser tabs within secure sandboxes, preventing websites from extracting stored passwords or payment cards without user interaction. Clear your browser cache and website data as a standard security precaution.

What is the difference between a real USPS tracking number and a fake tracking number in a text?¶

Authentic USPS tracking numbers adhere to standardized formats, typically consisting of 20 to 22 numerical digits starting with 9 (for domestic packages), or 13 alphanumeric characters beginning with two letters, followed by nine digits, and ending with US (for international shipments). Smishing text messages often include completely fabricated strings of random letters and numbers, or omit the tracking number entirely while directing you to click a link. You can verify any tracking number safely by going directly to usps.com and entering the code into the official tracking search bar.

ምንጭታት ተፈቲሾም¶

• ኣገልግሎት መርመራ ፖስታ ሕቡራት መንግስታት ኣመሪካ (USPIS, ሕቡራት መንግስታት ኣመሪካ): ኣማኻሪ ንቕሓት ህዝቢ: ስሚሺንግ ፓኬጅ ኣወሃህባ ምትላልን ፖስታ ፊሽንግን (uspis.gov).
• ኮሚሽን ንግዲ ፌደራል (FTC, ሕቡራት መንግስታት ኣመሪካ): መጠንቀቕታ ተጠቃሚ: ናይ ሓሶት ፓኬጅ ምብጻሕ ናይ ጽሑፍ መልእኽትን ስሚሽ መጥቃዕትን (consumer.ftc.gov).
• ኤጀንሲ ድሕነት ሳይበርን ትሕተ ቅርጽን (CISA, United States): ምምካት ሞባይል ፊሺንግን ስሚሺንግ ስግኣታትን: መምርሒ ንተጠቀምትን ትካላትን (cisa.gov).
• Federal Communications Commission (FCC, United States): Consumer Guide: Robotexts, Smishing, and Package Delivery Scams (fcc.gov).
• ሃገራዊ ማእከል ድሕነት ሳይበር (NCSC, United Kingdom): ምጭፍላቕን ስሚሽንግን ምትላል: ምልላይን ምሕባርን ጐዳኢ መልእኽትታት ኤስኤምኤስ (ncsc.gov.uk).
• ማእከል ጸረ ምትላል ካናዳ (CAFC, ካናዳ): ምክልኻል ምትላል: መደባት ምብጻሕ ፓኬጅን መልእኽተኛታትን (antifraudcentre-centreantifraude.ca).

ተዛመድቲ መምርሒታት¶

• ምላሽ ምጥሓስ ዳታን ምፍሳስ ፓስዎርድን።
• MFA phishing and adversary-in-the-middle bypass
• QR code phishing and quishing defense
• ስርቂ ዕሹግን ሽፍትነት በረንዳን
• ምትላልን ምትላልን