The coronavirus pandemic brought out a lot of things in people, both admirable and not-quite-as-such, but it really brought out the online shopper in a lot of us. More packages than ever are being left on more doorsteps than ever (which was already happening anyway, the virus just accelerated things), and that means a lot of delivery confirmations and notifications arriving in email inboxes and text messages. Usually, these contain a link to the seller or carrier’s website, where you can track the status of a delivery.
Never ones to leave a potentially-lucrative situation unexploited, scammers are leveraging this deluge of notices to launch phishing attacks disguised as alerts regarding the shipment or delivery of online purchases. The messages contain a link that leads to a website created solely to harvest personal information, install malicious software onto your computer or device, or both.
Some phishing messages attempt to impersonate the seller (Amazon or Walmart, for example), while others appear to come from the company shipping the item (USPS, UPS, FedEx, etc.). Some target college students who found themselves sent home abruptly in March, and refer to deliveries that have supposedly been waiting for them to pick up for six or seven months.
The first step you can take in avoid this type of phishing is to be as organized as possible, and make sure you know what you have ordered, whom you ordered from, and when. If you’re only waiting on one package from Amazon, and one other being shipped via USPS, you will be instantly suspicious of a notification from Walmart or UPS.
You can also decline to click or tap links in emails or text messages. If you want to check on a shipment, use the information originally provided by the seller and visit the correct website directly (which will be simple if you’re already doing that “be organized” thing I just mentioned). As always, notifications and confirmations from real companies, while brief, will almost always have correct spelling (and grammar when/if present). Misspelled words, dropped plurals, incorrect verb tense—these are all signs that something is a little “off” about a shipping confirmation.