LANSING, Mich. — Now that many people are mailing gifts for the holiday season, Michigan Attorney General Dana Nessel is warning residents about fraudulent smishing text messages that claim to be from the United States Postal Service (USPS).
Smishing is when a text message is sent by a scammer, who claims to be from a trusted entity. The message entices the victim by saying that they must provide them with a password, account number, debit card, or social security number. Many times, the USPS smishing scam messages are about an alleged delayed package, and then requires a purchase for updates.
In many of the text messages, the sender’s email comes from a public domain instead of the organization’s domain. The suggested link also does not match the public facing website for the USPS, and there are typos throughout the message. An example of a common USPS smishing scam can be found below:
A list of ways to protect your phone number and information can be found below:
- Don’t share your phone number unless you know the person or organization well.
- Don’t assume a text is legitimate because it comes from a familiar phone number or area code. Spammers use caller ID spoofing to make it appear the text is from a trusted or local source.
- Don’t provide personal or financial information in response to the unsolicited text or at a website linked to the message.
- Don’t click on links in a suspicious text; they could install malware on your device or take you to a site that does the same.
- Don’t reply, even if the message says you can “text STOP” to avoid more messages. A response tells the scammer or spammer that your number is active and can be sold to bad actors.
- Never follow a text’s instructions to push a designated key to opt out of future messages.
“Hundreds of millions of packages are shipped each holiday season, and bad actors see that as a prime opportunity to scam you out of your hard-earned money,” said Nessel. “It is critically important for people to recognize a scam like this and avoid giving out their personal information. Clicking on fraudulent links can lead to identity theft, the installation of malware on your device, or it could lead to your contact information being sold to other bad actors who are also looking to take advantage of unsuspecting victims.”
