USPS bukjasy smishing we galp gowşuryş kezzaplygy¶

Amerikanyň Birleşen Ştatlarynyň poçta gullugy bukjasynyň doly däl köçe salgysy sebäpli iberilip bilinmejekdigini öňe sürýän gyssagly tekst habaryny almak häzirki wagtda ykjam enjamlarda iň köp ýaýran kiber howplardan biridir. Bu gysga habar hyzmaty (SMS) fişing hüjümleri, smishing diýlip atlandyrylýar, hakyky poçta markasyny, simulirlenen yzarlaýyş ştrih-kodlaryny we resmi dili görkezýär. Habar, debet ýa-da kredit kartoçkasynyň belgisini, möhleti, howpsuzlyk kody we hasaplaşyk jikme-jikliklerini girizip, öý salgyňyzy barlamagy we adatça 0.30 ABŞ dollaryndan 3.00 ABŞ dollary aralygynda töleg tölemegi talap edilýän galp görnüşli web sahypasyna ugrukdyrýar.

Ujypsyzja töleg, diňe kredit kartoçka maglumatlaryňyzy we şahsy şahsyýet ýazgylaryňyzy almak üçin döredilen aldaw mehanizmidir. Jenaýatçylykly ulgamlar tabşyrylandan soň derrew rugsatsyz onlaýn bölekleýin amallary başlaýarlar, kartoçkalaryňyzy gaýtalanýan galp abunalara ýazýarlar ýa-da bir gezeklik parol saklaýjylary ulanyp, hasabyňyzy almaga synanyşýarlar. Käbir ýagdaýlarda, Android enjamlarynda zyýanly baglanyşyga basmak, düwmeleriň urulmagyna gözegçilik edýän we köp faktorly tanamak kodlaryny saklaýan bank trojan programmalarynyň sessiz göçürilmegine sebäp bolýar. Töleg kartoçkalaryňyzda, ykjam enjamyňyzda we karz faýllaryňyzda gyssagly çäklendirme çäreleri görmek, maliýe ýitgilerini zyýansyzlandyryp we uzak möhletli şahsyýet ogurlygynyň öňüni alyp biler.

Indi et¶

Galp poçta tekst baglanyşygyna bassaňyz ýa-da gowşuryş web sahypasynda töleg maglumatlaryny iberen bolsaňyz, derrew şu alty çäräni görüň:

1. ** Häzirki wagtda ylalaşylan töleg kartasyny gulplaň ýa-da ýatyryň **:
   • Jübi bank programmaňyzy açyň ýa-da kartyňyzyň arka tarapynda çap edilen gyssagly galplyk belgisini ulanyp, kartoçkany çagyryň.
   • Kart ýagdaýyňyzy derrew "Gulplanan" ýa-da kartoçkanyň bozulandygyny habar bermek üçin programma kartoçkalaryny ulanyň.
   • Doly täze on alty sanly hasap belgisi, möhleti we CVV howpsuzlyk kody bilen derrew çalyşmak kartasyny soraň.
2. ** Garaşylýan amallary we galp tölegleri gözden geçiriň **:
   • Nätanyş mikro tölegler ýa-da birugsat täjir rugsatlaryna garaşmak üçin soňky geleşik taryhyňyzy barlaň.
   • Bankyňyza gaýtalanýan abunalyk ygtyýarlyklaryndan ýüz öwürmegi we sarp edijileri goramagyň federal düzgünlerine laýyklykda resmi töleg tölemegi tabşyryň.
   • Galplyk wekiline aç-açan aýdyň: "Poçta iberilmegini görkezýän galp balykçy web sahypasyna kartoçkamyň jikme-jikliklerini girizdim".
3. ** Jübi enjamyňyzy rugsatsyz programmalar ýa-da profiller üçin barlaň **:
   • Android-de Sazlamalar -> Programmalary açyň we ýakynda gurlan näbelli programmalary barlaň (ýasama paket yzarlaýjylary ýa-da Flash pleýerler).
   • “IPhone” -da Sazlamalar -> Umumy -> VPN we Enjam Dolandyryşyny açyň we birugsat ykjam enjam dolandyryşy (MDM) konfigurasiýa profiliniň ýa-da kärhana şahadatnamalarynyň gurulmandygyny barlaň.
   • If an unknown application or configuration profile is found, remove it immediately and restart the device.
4. Forward the malicious text message to report the sender:
   • Copy the text message body and forward it directly to the universal carrier spam shortcode 7726 (which spells SPAM).
   • Forward the message and sender details to the United States Postal Inspection Service at spam@uspis.gov.
   • Take a screenshot of the text message and website URL before deleting the conversation thread.
5. Protect your personal identity if you submitted full address and personal data:
   • If the phishing form requested your Social Security number, date of birth, or mother's maiden name, treat your identity as exposed.
   • Place temporary fraud alerts or full security freezes on your credit files at Equifax, Experian, and TransUnion.
   • Monitor your credit reports regularly for unauthorized inquiries or newly opened trade lines.
6. Report the smishing portal to federal cybersecurity databases:
   • File an internet crime complaint with the FBI Internet Crime Complaint Center at ic3.gov.
   • Submit the malicious phishing URL to Google Safe Browsing and the Cybersecurity and Infrastructure Security Agency (CISA) to protect other consumers.
   • Report the deceptive business practice to the Federal Trade Commission at reportfraud.ftc.gov.

Incident triage flowchart¶

Follow this step-by-step decision pathway to assess your level of exposure, contain potential card fraud, and secure your mobile smartphone:

flowchart TD
    A["Received SMS Claiming Postal Delivery Failure"] --> B{"Did you click the web link in the text?"}
    B -->|"No: Only received text"| C["Forward SMS to 7726 and spam@uspis.gov, delete message, block number"]
    B -->|"Yes: Clicked link"| D{"Did you enter card details, password, or personal info?"}
    D -->|"No: Closed browser immediately"| E["Clear mobile browser cache and cookies, check device for downloaded files"]
    D -->|"Yes: Submitted card or info"| F["Call Card Issuer Fraud Unit Immediately to Cancel Card"]
    F --> G["Dispute Pending Charges and Revoke Recurring Authorizations"]
    G --> H{"Did you submit Social Security number or date of birth?"}
    H -->|"Yes: Full identity exposed"| I["Place Security Freezes at Equifax, Experian, and TransUnion"]
    H -->|"No: Only card entered"| J["Monitor bank statements for 60 days, verify credit reports"]
    I --> K["Report Phishing URL to FBI IC3, FTC, and CISA"]
    J --> K

How postal smishing operations function¶

Postal delivery smishing is not executed by isolated hobbyists; it is orchestrated by organized cybercrime syndicates using distributed spam hardware, reverse proxy phishing kits, and automated financial cash-out pipelines.

+-----------------------------------------------------------------------------+
|                     POSTAL SMISHING ATTACK ARCHITECTURE                     |
+-----------------------------------------------------------------------------+
|                                                                             |
|  1. Mass SMS Blast             SIM farms and compromised iMessage botnets   |
|     (Millions daily)           send automated texts to sequential numbers.  |
|                                                                             |
|  2. Spoofed Redelivery URL     Victim clicks lookalike domain               |
|     (Reverse proxy kit)        (e.g., usps-redeliver-tracking-hub.com).     |
|                                                                             |
|  3. Fake Tracking Interface    Page displays realistic USPS branding,       |
|     (Address verification)     simulated tracking status, and address form. |
|                                                                             |
|  4. Card Harvesting Trap       Page demands $0.35 redelivery fee;           |
|     (CVV, expiration, ZIP)     captures complete payment credentials.       |
|                                                                             |
|  5. Real-Time OTP Intercept    Scammer attempts Apple Pay provisioning;     |
|     (Adversary-in-the-Middle)  tricks victim into typing bank SMS code.     |
|                                                                             |
+-----------------------------------------------------------------------------+

The mass distribution infrastructure: SIM farms and botnets¶

Criminal syndicates blast millions of smishing messages daily to mobile phone subscribers across entire area codes using specialized hardware:

• Hardware SIM Farms (GSM Modems): Racks of multi-channel GSM modems containing hundreds of prepaid cellular SIM cards purchased with stolen funds or activated under fake names. These devices automatically rotate telephone numbers to bypass carrier spam filters.
• Compromised iMessage and RCS Botnets: Attackers use software scripts to hijack Apple iMessage and Google RCS accounts, allowing them to send blue-bubble messages or encrypted RCS texts directly to victims over data channels, completely bypassing cellular carrier SMS firewalls.
• Smishing-as-a-Service (SmaaS): Dark web threat actors sell turn-key smishing kits that include fresh lists of active mobile phone numbers, automated SMS gateway APIs, and pre-hosted postal templates for a subscription fee.

Reverse proxy phishing kits and lookalike domains¶

When a victim taps the link in the message, the web browser loads a sophisticated reverse proxy phishing framework (such as Modlishka, Evilginx, or custom postal kits):

• Domain Typosquatting: Attackers register lookalike domains that mimic official government services, such as usps-tracking-support-redelivery.com, post-office-portal-us.com, or usps-update-delivery-info.org.
• Dynamic Geotargeting: The phishing server inspects the incoming visitor's IP address. If the visitor is located in the United Kingdom, the server redirects them to a fake Royal Mail template; if in Canada, to a fake Canada Post portal; and if in the United States, to a fake USPS landing page.
• Bot and Crawler Cloaking: The server automatically detects search engine indexing crawlers, cybersecurity researchers, and threat scanning bots, serving them a harmless blank page or a 404 error while delivering the malicious phishing template exclusively to genuine mobile smartphone users.

The real-time adversary-in-the-middle payment trap¶

The payment page appears to process a trivial charge, such as 0.35 USD, 1.20 USD, or 2.99 USD, under the guise of an "administrative redelivery fee" or "package holding surcharge":

• When you type your card details and click "Submit," the phishing kit does not process a 0.35 USD charge.
• Instead, an automated bot in the background takes your sixteen-digit card number, CVV code, and billing ZIP code and immediately attempts to bind your card to a mobile wallet (such as Apple Pay, Google Wallet, or Samsung Pay) on the attacker's smartphone.
• When your bank detects the new wallet enrollment, it generates an authentic SMS verification passcode sent directly to your phone.
• The fake postal website immediately displays an authentic-looking field reading: "For security, enter the 6-digit verification code sent by your bank."
• If you type that code into the website, the attacker's script submits it to your bank, successfully adding your card to their physical smartphone. The scammer can now make unlimited contactless purchases in retail stores until your card limit is exhausted.

Identifying fake postal text messages¶

Official postal carriers adhere to strict digital communication protocols. Recognizing the structural differences between legitimate notifications and fraudulent smishing messages allows you to spot threats instantly.

Mobile device compromise: phishing versus banking trojans¶

Poçta ibermek bilen baglanyşykly hüjümleriň köpüsi web formalary arkaly kredit kartoçkalarynyň jikme-jikliklerini we şahsyýet maglumatlaryny gözleýän bolsa, käbir kampaniýalar smartfonlarda yzygiderli elýeterliligi üpjün etmek üçin döredilen ykjam zyýanly programma üpjünçiligini ýerleşdirýärler.

+-----------------------------------------------------------------------------+
|                     SMARTPHONE THREAT VECTOR MATRIX                         |
+-----------------------------------------------------------------------------+
|                                                                             |
|  Device Platform       Attack Vector                  Technical Impact      |
|  -------------------------------------------------------------------------  |
|  Apple iOS             Web Phishing Form              Harvests card, CVV,   |
|  (iPhone)              (No APK installation)          and billing address   |
|                                                                             |
|  Apple iOS             Malicious MDM Profile          Installs rogue root   |
|  (iPhone)              (Prompt to install profile)    certificates and VPN  |
|                                                                             |
|  Google Android        Web Phishing Form              Harvests card, CVV,   |
|  (Samsung, Pixel)      (No APK installation)          and billing address   |
|                                                                             |
|  Google Android        Malicious APK Download         Deploys banking       |
|  (Sideloaded App)      (TeaBot, FluBot, Anatsa)       trojan with keylogger |
|                                                                             |
+-----------------------------------------------------------------------------+

Apple iOS: ykjam konfigurasiýa profilleri we Safari fişing¶

IOS bilen işleýän Apple enjamlarynda ykjam operasiýa ulgamy, kärhananyň ykjam enjamlaryny dolandyrmak tertibi kabul edilmese, resmi programma dükanynyň daşynda göni programma gurmagy gadagan edýär:

• Diňe Safari web sahypasyna girip, töleg maglumatlaryňyzy ýazan bolsaňyz, fiziki iPhone-yňyza zyýanly programma üpjünçiligi ýok. Ylalaşyk, anketada tabşyran maglumatlaryňyz bilen çäklenýär.
• Şeýle-de bolsa, web sahypasy "USPS Howpsuzlyk Şahadatnamasyny" ýa-da "Eltip bermek profilini" göçürip alsaňyz we konfigurasiýa profilini gurmak üçin Sazlamalara ugrukdyran bolsa, haýal etmän ret ediň.
• A malicious MDM profile allows an attacker to route all your internet traffic through a rogue proxy server, intercepting passwords and unencrypted data.
• To check for rogue profiles on your iPhone, open Settings -> General -> VPN & Device Management. If any unknown profile appears, tap it and select Remove Management.

Google Android: sideloaded APK banking trojans¶

On Android devices, scammers frequently attempt to trick users into downloading and installing malicious application package (APK) files:

• The phishing website displays an alert: "To track your package in real time, download the official USPS Mobile Tracking Assistant."
• The browser downloads a file named USPS_Track.apk or Package_Service.apk.
• If you tap the downloaded file and bypass Android security warnings (such as allowing installation from unknown sources), you install a potent banking trojan (such as TeaBot, FluBot, or Anatsa).

• When a victim accidentally authorizes installation of a sideloaded APK, the malware immediately requests permission to enable Android Accessibility Services. These accessibility features are originally designed to help users with physical disabilities by reading screen text aloud or automating gestures. However, banking trojans exploit accessibility access to establish complete administrative control over the mobile operating system:

• ** Hakyky wagt açar ýazgysy we ekrany döwmek **: Zyýanly fon hyzmaty, ähli programmalarda ulanyjy atlaryny, baş parollaryny we şahsy şahsyýet belgilerini ele alyp, klawiaturada ýazylan her bir belgini ýazga alýar.

• ** Zyýanly ekran örtükleri **: Pidany kanuny bank ýa-da cryptocurrency goýmasy açanda, trojan programmanyň açylyşyny anyklaýar we derrew hakyky programmanyň üstünden aç-açan ýa-da piksel taýdan ýasalan galp giriş ekranyny görkezýär. Şahsyýet maglumatlaryňyzy girizeniňizde, programma ýykylanda ýa-da simulirlenen ýükleme ekrany görkezilende hüjümçi serwerine iberilýär.
• Automated SMS Interception: The trojan intercepts incoming SMS text messages containing one-time passcodes sent by banks, silently deletes the notifications so you never see them, and transmits the authentication codes to the scammer within milliseconds.

Töleg kartoçkalary üçin ädimme-ädim saklamak protokoly¶

Töleg resminamalary galp gowşuryş portalyna girizilende, maliýe edaraňyz bilen aýgytly çäre görmek rugsatsyz tölegleri saklaýar.

flowchart TD
    A["Galp gowşuryş sahypasyna girizilen kartoçka maglumatlary"] --> B["Jübi bank programmasyny açyň we derrew gulplama"]
    B --> C["Çagyryş kartoçkasy 24/7 Galplyk bölümi"]
    C --> D["Request Complete Card Cancellation and Reissue"]
    D --> E["Soňky 72 sagatdan ähli amallary gözden geçiriň"]
    E --> F{"Are there unauthorized charges or pending holds?"}
    F -->|"Yes"| G["Initiate Regulation Z / E Consumer Dispute for Fraudulent Items"]
    F -->|"No: Caught before charges"| H["Verify No Digital Wallets (Apple/Google Pay) Were Added"]
    G --> I["Revoke All Tokenized Subscriptions Linked to Stolen Card"]
    H --> I
    I --> J["Monitor Checking Account and Credit Card for 60 Days"]

Locking and reissuing compromised payment cards¶

Do not wait to see whether an unauthorized charge appears on your statement. The moment you realize the website was illegitimate, initiate card cancellation:

• Log in to your bank's mobile application and locate the card security settings. Tap Lock Card or Freeze Card to prevent real-time authorization attempts.
• Fiziki kartyňyzyň ters tarapynda möhürlenen telefon belgisini ulanyp, bankyň 24/7 galplyk bölümine ýüz tutuň.
• State clearly: "I mistakenly entered my card number, expiration date, and CVV code on an online phishing website. I need this card canceled immediately and a replacement issued with a new account number."
• Confirm with the representative that the bank disables tokenized merchant updates. Many credit card issuers participate in automated card updater services that automatically give merchants your new card number when a card is reissued; explicitly request that the bank sever all existing recurring merchant links.

Federal sarp ediji kanunlary boýunça galp amallary jedel etmek¶

If the attackers managed to execute unauthorized charges before you locked the card, federal banking statutes limit your personal financial liability:

• Fair Credit Billing Act (FCBA, 12 CFR Part 1026 / Regulation Z): For credit card transactions, your maximum legal liability under federal law for unauthorized charges is 50 USD. Most major card issuers (Visa, Mastercard, American Express, Discover) maintain zero-liability policies that waive this 50 USD fee entirely when you report fraud promptly.
• ** Elektron gaznany geçirmek kanuny (EFTA, 12 CFR Bölüm 1005 / Düzgünnama E) **: Hasaplary barlamak bilen baglanyşykly debet kartoçkalary üçin wagt gaty möhümdir. Ylalaşyk barada öwreneniňizden iki iş gününiň dowamynda bankyňyza habar berseňiz, jogapkärçiligiňiz 50 ABŞ dollaryna deňdir. Aýlyk hasabatyňyz iberilenden soň iki-altmyş senenama gününiň arasynda hasabat berseňiz, jogapkärçiligiňiz 500 ABŞ dollaryna çenli ýokarlanýar. Altmyş günden soň, hasabyňyzdan ogurlanan ähli pullary ýitirmek howpy abanýar.
• Bankyňyz bilen geçirilen her telefon söhbetdeşliginiň ýazmaça gündeligini, senesini, wagtyny, wekiliniň adyny we jedelleriň belgisini saklaň.

Mobile device decontamination and security hardening¶

Cleaning and hardening your mobile device prevents ongoing surveillance, credential harvesting, and repetitive smishing spam attacks.

+-----------------------------------------------------------------------------+
|                     SMARTPHONE DECONTAMINATION CHECKLIST                    |
+-----------------------------------------------------------------------------+
|                                                                             |
|  [X] Clear Mobile Browser Cache: Purge Safari, Chrome, or Firefox cache,    |
|      cookies, and website data to remove cached phishing sessions.          |
|                                                                             |
|  [X] Audit Installed Applications: Inspect all apps, removing any unknown  |
|      software, especially apps installed outside official app stores.       |
|                                                                             |
|  [X] Audit Accessibility Permissions (Android): Revoke accessibility       |
|      access for any third-party app not explicitly trusted.                |
|                                                                             |
|  [X] Remove Enterprise MDM Profiles (iOS): Delete unfamiliar device        |
|      management certificates under Settings -> VPN & Device Management.     |
|                                                                             |
|  [X] Enable Spam Filtering: Activate native carrier and operating system    |
|      spam call and message filters (Silence Unknown Callers / Spam Shield). |
|                                                                             |
+-----------------------------------------------------------------------------+

Purging mobile browser cache and session storage¶

Phishing websites store tracking scripts, session tokens, and local cache objects within your mobile browser to track visitor responses:

• iOS Safari: Open Settings -> Safari -> Clear History and Website Data. Select "All History" and confirm. This closes all open browser tabs and deletes stored cookies, cached images, and local web database entries.
• Android Google Chrome: Open Chrome, tap the three dots in the upper right corner, select Settings -> Privacy and security -> Clear browsing data. Choose "All time," check "Cookies and site data" and "Cached images and files," and tap Clear data.

Neutralizing malicious Android applications¶

If you downloaded and installed an application file from a phishing link on an Android phone, remove the threat immediately:

• Restart your Android smartphone in Safe Mode (on most models, press and hold the Power button, then touch and hold the "Power off" icon on the screen until the "Reboot to safe mode" prompt appears). Safe Mode prevents third-party malware apps from running in the background.
• Open Settings -> Apps -> See all apps.
• Scroll through the list looking for suspicious applications without proper corporate icons, apps with generic names (such as "Package Service," "System Update," "Flash Player," or "USPS Assist"), or apps installed on the day of the incident.
• Select the suspicious application, tap Force Stop, then tap Uninstall.
• If the "Uninstall" button is greyed out, the malware has obtained Device Administrator privileges. Open Settings -> Security -> Device admin apps, locate the malicious app, toggle off its administrator permissions, and proceed with uninstallation.

Filtering smishing messages at the operating system level¶

Both Apple iOS and Google Android include built-in filtering tools to silence unsolicited text messages from numbers not stored in your contacts:

• Apple iOS: Open Settings -> Messages, scroll down to "Message Filtering," and toggle on Filter Unknown Senders. This creates a separate tab in your Messages application for incoming texts from unknown numbers, silencing notification sounds and keeping malicious links out of your primary view.
• Google Android (Google Messages): Open Google Messages, tap your profile avatar in the upper right, tap Messages settings -> Spam protection, and toggle on Enable spam protection. This crowdsourced neural filtering engine automatically detects and routes suspected smishing texts to your "Spam & Blocked" folder without vibrating your phone.

Official reporting channels and postal law enforcement¶

Submitting detailed fraud reports to federal agencies helps postal inspectors map spam syndicates, seize fraudulent domains, and take down criminal server infrastructure.

+-----------------------------------------------------------------------------+
|                      OFFICIAL FRAUD REPORTING DIRECTORY                     |
+-----------------------------------------------------------------------------+
|                                                                             |
|  Organization             Contact Channel           Purpose                 |
|  -------------------------------------------------------------------------  |
|  Carrier Spam Service     Forward SMS to 7726       Triggers carrier-wide   |
|                           (Universal shortcode)     spam block              |
|                                                                             |
|  US Postal Inspection     spam@uspis.gov            Federal criminal        |
|  Service (USPIS)          1-877-876-2455            investigation of fraud  |
|                                                                             |
|  FBI Internet Crime       ic3.gov                   Transnational cyber-    |
|  Complaint Center (IC3)                             crime tracking          |
|                                                                             |
|  Federal Trade            reportfraud.ftc.gov       Consumer deceptive trade|
|  Commission (FTC)                                   practice reporting      |
|                                                                             |
|  Google Safe Browsing     safebrowsing.google.com/  Submits malicious URL   |
|                           safebrowsing/report_phish for browser blocking    |
|                                                                             |
+-----------------------------------------------------------------------------+

Reporting to the United States Postal Inspection Service¶

The United States Postal Inspection Service is the federal law enforcement agency responsible for investigating mail fraud, postal counterfeiting, and smishing attacks targeting USPS customers:

• Forward the smishing text message to spam@uspis.gov.
• In your email body, include a screenshot of the text message showing the originating phone number, the date and time received, and the exact website URL displayed in the message.
• USPIS cyber investigators coordinate with domain registrars, hosting providers, and federal prosecutors to seize fraudulent domains and shut down phishing infrastructure.

Reporting to mobile telecommunications carriers via 7726¶

The universal shortcode 7726 (spelling SPAM on a standard telephone keypad) is maintained by mobile network operators worldwide (including AT&T, Verizon, T-Mobile, Vodafone, and EE):

• Copy the text of the fraudulent message.
• Create a new outgoing text message addressed to 7726 and paste the text.
• Your carrier will immediately reply with an automated prompt asking for the originating phone number or email address that sent the spam.
• Reply with the sender's phone number.
• Carrier threat analysis centers use these aggregated reports to update real-time network-level SMS firewalls, blocking identical messages before they reach millions of other subscribers.

Protecting against USPS Informed Delivery account takeover and mail diversion¶

A dangerous secondary vector of postal smishing involves fraudulent account creation on the legitimate USPS Informed Delivery platform. When attackers harvest your full name, physical street address, and payment card details, they sometimes attempt to register an unauthorized account in your name on usps.com:

• Informed Delivery Feature Abuse: Informed Delivery allows residents to preview greyscale digital images of incoming letter-sized mail and track packages scheduled to arrive at their address. If a cybercriminal registers an account using your address, they can view scanned images of incoming bank statements, tax documents, credit card replacement letters, and government correspondence before the mail reaches your physical mailbox.
• Unauthorized Change of Address (COA): Attackers may use harvested personal information to submit an electronic Change of Address request through the postal service, diverting your physical mail to a vacant home, package drop, or commercial mail receiving agency. Once your mail is redirected, criminals intercept newly issued credit cards, replacement debit cards, and sensitive financial records without your knowledge.
• Verifying Account Status: Visit usps.com, go to the Informed Delivery portal, and attempt to sign in or create an account with your personal details. If the platform indicates that an account already exists for your address under an email address you do not recognize, contact USPS customer service immediately.
• In-Person Identity Verification: If an unauthorized account was created, visit your local post office branch with two forms of government identification and proof of address. Request that postal clerks terminate the unauthorized digital account and place a fraud hold on your physical delivery address to block electronic address changes.

Stress management and health consequences¶

Falling victim to an online scam often produces acute emotional distress, self-blame, and feelings of vulnerability. Discovering that a simple tap on your phone handed your credit card number or personal identity details to criminals can trigger physical shock, insomnia, elevated blood pressure, and anxiety.

Recognize that postal smishing messages are professionally designed by criminal teams who exploit the fact that millions of people await packages every day. If the stress of a financial compromise causes chest tightness, shortness of breath, severe shaking, or panic, seek medical attention immediately. Consider completing a certified first aid, CPR, and psychological first aid course through the Red Cross, St John Ambulance, or a local provider to build confidence and practical competence in managing physical shock and acute health crises during family emergencies.

Freygy-ýygydan berilýän soraglar¶

Does the United States Postal Service ever send text messages about package deliveries?¶

The United States Postal Service only sends text notifications to customers who have explicitly registered for tracking updates on the official website (usps.com) for a specific tracking number, or who have enrolled in Informed Delivery. Legitimate automated text messages from USPS arrive exclusively from the official five-digit shortcode 28777 (USPS) and never contain links directing users to update address details or pay redelivery fees. The postal service never sends unsolicited text messages demanding personal information or credit card numbers to release a package.

What should I do if I entered my credit card details but closed the webpage before submitting?¶

Modern reverse proxy phishing kits frequently use automated form-tracking scripts, such as keyloggers or real-time websocket connections, that capture keystrokes as you type them into individual input boxes, even if you never click the final "Submit" or "Continue" button. Because your card number, expiration date, and CVV code may have been transmitted in real time, you must treat the card as compromised. Contact your financial institution immediately to lock and replace the payment card.

Why do scammers only ask for a tiny fee like 0.35 USD instead of hundreds of dollars?¶

Scammers intentionally request a negligible fee between 0.30 USD and 3.00 USD because consumers rarely hesitate to spend a small amount to resolve a delayed package. This low dollar amount bypasses human skepticism and avoids triggering automated bank fraud rules that scrutinize high-value transactions. Once the scammer captures the full card credentials, they use the stolen data to enroll your card into mobile wallets or initiate unauthorized high-dollar retail transactions.

Can scammers steal my money if I only clicked the link but did not type any information?¶

If you only clicked the link in Safari, Chrome, or another standard mobile browser and immediately closed the tab without submitting information, installing an application, or downloading a configuration profile, your financial accounts remain secure. Modern mobile operating systems isolate web browser tabs within secure sandboxes, preventing websites from extracting stored passwords or payment cards without user interaction. Clear your browser cache and website data as a standard security precaution.

What is the difference between a real USPS tracking number and a fake tracking number in a text?¶

Authentic USPS tracking numbers adhere to standardized formats, typically consisting of 20 to 22 numerical digits starting with 9 (for domestic packages), or 13 alphanumeric characters beginning with two letters, followed by nine digits, and ending with US (for international shipments). Smishing text messages often include completely fabricated strings of random letters and numbers, or omit the tracking number entirely while directing you to click a link. You can verify any tracking number safely by going directly to usps.com and entering the code into the official tracking search bar.

Sources checked¶

• United States Postal Inspection Service (USPIS, United States): Public Awareness Advisory: Smishing Package Delivery Scams and Postal Phishing (uspis.gov).
• Federal Trade Commission (FTC, United States): Consumer Alert: Fake Package Delivery Text Messages and Smishing Attacks (consumer.ftc.gov).
• Cybersecurity and Infrastructure Security Agency (CISA, United States): Combating Mobile Phishing and Smishing Threats: Guidance for Consumers and Organizations (cisa.gov).
• Federal Communications Commission (FCC, United States): Consumer Guide: Robotexts, Smishing, and Package Delivery Scams (fcc.gov).
• National Cyber Security Centre (NCSC, United Kingdom): Phishing and Smishing Scams: Identifying and Reporting Malicious SMS Messages (ncsc.gov.uk).
• Canadian Anti-Fraud Centre (CAFC, Canada): Fraud Prevention: Package Delivery and Courier Smishing Schemes (antifraudcentre-centreantifraude.ca).

Degişli gollanmalar¶

• Data breach response and password leaks
• MFA phishing and adversary-in-the-middle bypass
• QR code phishing and quishing defense
• Package theft and porch piracy
• Scams and fraud