You may have received something like this statement via text message: “USPS: the scheduled delivery for parcel XXXX has changed. Please confirm here [link].”
If so, you are one of the many individuals across the country hit with robotext messages purporting to be from the United States Postal Service®.
These robotexts, part of the smishing family of cyberthreats, use the fraudulent practice of sending text messages pretending to be from reputable companies to get individuals to reveal their personal information.
In July 2022, according to spam-blocking app Robo-Killer, consumers received more than 12 billion robotexts — that’s 44 text messages for every individual in the United States (see robokiller.com/spam-text-insights).
If you’ve been getting these types of scam messages more often lately, it’s likely because of the Federal Communications Commission’s mandate that voice providers implement call verification software. This mandate pushed a lot of scammers away from robocalls and into robotexts (see fcc.gov/call-authentication).
The rise of robotexts is not a good thing for consumers because, in general, we trust text messages more than we do phone calls, even when they are from a number that we may not recognize.
“I would argue that, in a way, robotexts are actually more dangerous,” said Teresa Murray at Public Interest Research Group, a consumer watchdog group. “Maybe not more annoying, but more dangerous because it’s more difficult for consumers to determine whether a robotext is legitimate or not.”
According to an article by CyberScoop, this is because “common lures for smishing campaigns include posing as delivery services — such as USPS® and Amazon — or tech support for a work email account (see cyberscoop.com/robotext-scam-fcc-malware-smishing-phishing). The sense of urgency the text messages spark can be enough to make even the savviest consumer let their guard down.”
With the holidays around the corner, many of us will begin using delivery services like USPS and Amazon much more, which could leave you wondering if that text is about an actual package coming your way or something more malicious.
Follow these tips to keep you safe from robotexts:
n Don’t click on suspicious links. If you do not recognize a number, you should not click on the link in the text.
n Don’t respond to a suspicious text. Delete all suspicious text messages or send the message to SPAM (7726), a centralized spam-reporting service used by wireless carriers (or spam@uspis.gov).
n Call the source of the text. Most companies will not reach out via text message. Call the company directly to confirm whether they sent a legit text request.
n Look for misspelled words. Often the messages will have spelling or grammatical errors.
n Block or filter the number. Depending on what type of cell phone you have, there are options to block the sender’s number or filter messages by known and unknown senders.
For more information about package tracking text scams, visit the U.S. Postal Inspection Service website at uspis.gov/news/scam-article/smishing-package-tracking-text-scams.
— Corporate Information Security Office,
Chief Information Security Officer, 9-22-22
