Doesn't surprise me. The USPS is doing some idiotic things with their Informed Delivery emails that I get every morning.

Sometimes they contain inbound and outbound tracking links. If I click on a tracking link, I land on a webpage that requires me to log in. That's annoying. So I copy-and-paste that tracking code into Google, and Google gives me a link that does not require me to log in.

The USPS has trained people to happily provide authentication information whenever someone pretends to be the USPS. No wonder scammers are abusing it.