USPS jumps to first place as most imitated brand in phishing attacks
guard.io
guard.io
Edit to be clear: I don't think these people are dumb, and I'm sure there is some scenario in which I could fall victim to a similar claim. This is more a comment on people generally as opposed to "those people."
Are enough people buying online AND losing track of their orders that they will just blindly take the bait? I fail to see how this vector is more lucrative than the "your computer is infected" route.
Anecdotally for me, roughly once every ~10-20 orders does the attack coincide with an order that I'm waiting for. But then I know where the order is coming from, I know which courier is handling my package, and the store 9/10 times have an online tracker and the shop itself will alert me if there are any delivery shenanigans going on.
I'm not falling for these scams, but I'm also quite ignorant about most of the planned package traffic to my house.
Maybe I'm not the target market for these operators.
the timing of the text makes it more believable.
But to kibitz on the second: a validated phone account remains by far the easiest 2FA mechanism to deploy and rely on, and 2FA remains by far more secure than simple password authentication. Advocate for apps and hardware keys all you want, don't dump on an extemely valuable technology, please. The worst possible situation would be for someone to "take your advice" and refuse to use any 2FA at all.
It was your interpretation that I advise people to not use any 2FA at all. I won't honor the request to not dump on SMS, as I am perfectly happy to dump on an "extremely valuable technology" on technical demerits, on the grounds of security while simultaneously acknowledging highly debatable, highly questionable positive merits on grounds of user-experience, which more often than not oppose each other. Why do you construct a single-faceted single-shot ability for us to evaluate SMS? It sucks and it also doesn't, and saying it sucks isn't going to entirely destroy its already-terrible reputation amongst technicals. I would much rather have a message sent to my email address since that is harder to lose than a text message or phone number, and it costs me far less per month.
No, to be clear, it's the obvious interpretation of a non-expert user, which is why your advice is so dangerous. They don't have a yubikey, don't understand how the apps work, and are faced with a decision to either enable SMS 2FA or not. And you're telling them not to, so they won't. And we'll all suffer.
Again, work the other side of the problem if this is important to you. Make the other solutions better and educate people about them. Don't tell them not to use something that might very well save their bank account.
But they almost certainly do have a phone, any vaguely modern phone is also a valid hardware credential - and given how much time people spend using a phone it might even be more practical for them.
I would argue that the problem is we've made the inconvenience symbolic - people see me sign in at work (with a Yubico Security Key 2 typically) and assume that's some sort of get out or workaround rather than, in reality, the much more secure option that my employer was too cheap to provide. They intuit that the thing they're doing is annoying and takes more effort so logically it must be more secure not less, right ?
"Ooh I'm not sure about these texts from Big Bank, maybe I should call them instead... Oh it did the 2FA code text, I guess it's legitimate"
There are usually quite a few give aways:
Iffy url, not the same as the real one though semi plausible often - say app-usps.com
Usually no personal info like your name / address
The one that finalizes it is that of fields like tracking number or credit card no they usually take anything without checking, like "rubbish12345".
At that point I usually get bored with it.
The USPS will never text you, I asked. They only do things by mail :]
Rather the USPS will never text you unprompted. There are a number of services (like package tracking) where the USPS will text you.
PS: Sorry for the pedantry
(Passport document acceptance is by appointment, not sure what other services might be)
Not surprised people are falling for these.
Sometimes they contain inbound and outbound tracking links. If I click on a tracking link, I land on a webpage that requires me to log in. That's annoying. So I copy-and-paste that tracking code into Google, and Google gives me a link that does not require me to log in.
The USPS has trained people to happily provide authentication information whenever someone pretends to be the USPS. No wonder scammers are abusing it.
https://www.usps.com/business/every-door-direct-mail.htm
I’ve tried every opt-out I can find and it still doesn’t stop.
I've done it, and in a matter of weeks the junk just disappears for the most part. Lasts ten years, and I think we're about due for a re-up at our house, as the junk is leaking back in.
Return it to the sender.
True. It’s surprisingly effective, though. Another route is to fish around for their return envelope and send them a pretty leaf or whatnot, but that could just spur them into paying more attention to you.
This technically only works for first-class mail. Bulk mail doesn’t have return services.
...win-win?
https://consumer.ftc.gov/articles/how-stop-junk-mail says it's free to stop getting mail for dead people. I was executor for my mom and aunt in 2017 and still get mail for them both. Turns out it's now $1 to stop that. https://www.ims-dm.com/cgi/ddnc.php Screw you Hillsdale College.
Like other countries.
> and because USA population has the most excess money to steal.
No, it doesn't. Many other countries have a lot more wealth in their general population. There are many people in the US with higher salaries than other places however don't think they have the most excess money to steal.
I think everyone is missing a major factoid. Microsoft is second, it'll be used in every language in almost every country. Yet, it's piped to the post by a large amount by a US only target. People do things for a reason especially when it comes to money. The US market is clearly the most profitable. But my question remains is that because there are so many or that they're dumb?
https://en.wikipedia.org/wiki/List_of_countries_by_wealth_pe...
Your question seems like a false dichotomy.
Since we can assume the US does not have as much disposal cash as the EU since they earn less yet have more wealth. They have less people than the EU. It's that USPS converts specifically well. It looks very likely the reason it's USPS is that folks from the US are very easy to trick.
While I understand it's unpleasing for US citizens to admit that their population is easier to trick. But if they improve their education and stop being so far down in the charts this might not be the case.
Anyway, US GDP is far in excess of EU GDP, for example. https://www.lemonde.fr/en/opinion/article/2023/09/04/the-gdp...
You aren't doing your contintent-mates any favors with your flailing attempt to prove European intellectual superiority.
That makes the US a good target, regardless of success rates, as long as they're not extremely low.