Thanks FedEx, This Is Why We Keep Getting Phished (2024)

I've been getting a batch of those "your parcel couldn't beryllium delivered" phishing attacks lately and if you're a quality pinch a phone, you astir apt person been too. Just arsenic a little reminder, they look for illustration this:

These get done each the method controls that beryllium astatine my telco and they onshore smack bang successful my SMS inbox. However, I don't autumn for the scams because I look for the informing signs: a consciousness of urgency, fearfulness of missing out, and unusual URLs that look thing for illustration immoderate parcel transportation work I cognize of. They person a beautiful unsmooth spell of convincing maine they're from Australia Post by putting "auspost" location aliases different wrong each link, but I'm a smart quality truthful I don't autumn for this (that's a joke, read why humans are bad astatine URLs).

However... I am expecting a parcel. It's good into the 2020's and station COVID truthful I'm always expecting a parcel, because that's conscionable really we bargain worldly these days. And so, erstwhile I received the pursuing SMS earlier this week I was expecting a parcel and I was expecting phishing attacks:

So... which is it? Parcel aliases phish? Let's spot what the group say:

Referring to the genitor tweet, is this connection legit and should I salary the work and taxes?

— Troy Hunt (@troyhunt) February 20, 2024

Whoa - that's an 87% "dodgy AF" ballot from complete 4,000 respondents truthful yeah, that's beautiful emphatic. Why specified an overwhelmingly suspicious crowd? Let's break that connection down into 7 "dodgy AF" signs:

1. Phishers commonly make typos successful their messaging and I cognize "FedEx" ever capitalises the "E". And what's pinch the "-Exp"? Dodgy AF!
2. Why does the shipment number look truthful short? And why is it identical to the requested costs below? Dodgy AF!
3. Ah, truthful it's urgent is it? Urgency is simply a halfway tenet of societal engineering arsenic it encourages group to enactment without decently reasoning it though. Dodgy AF!
4. Why are the "D" and the "T" capitalised? Dodgy AF!
5. This is simply a US-headquartered world transportation parcel service, why aren't they telling maine the currency? Or moreover utilizing a dollar sign? Dodgy AF!
6. Does this moreover request explaining? What's this "bpoint.com.au" service? It's decidedly not a FedEx domain nor an Aussie gov 1 if we're talking work and taxes. Dodgy AF!
7. So... you're going to springiness maine the interaction specifications for immoderate "query" (not "queries", truthful there's different grammatical reddish flag), the very believe we're now moving distant from for 1 elemental reason: because it's dodgy AF!

And so, I was pinch the 87% of different people. However... I was expecting a package. From FedEx. Coming from extracurricular Australia truthful it whitethorn pull work and taxes. And I really want to get this package because it's a caller 3D printer from Prusa, and they're awesome!

There's a sage portion of proposal that's ever applicable successful these cases and it's very simple: if successful doubt, spell the website successful mobility and verify the petition yourself. So, I went to the acquisition confirmation from Prusa, recovered the shipping specifications and followed the nexus to the FedEx website. Now it was simply a matter of uncovering the conception that talks astir tax, except...

Dodgy. A. F.

I went each done that page and couldn't find a azygous reference to duty, nor for thing taxation related. Try arsenic I might, I couldn't found the authenticity of the SMS by going straight to the (alleged) source. But what I could easy found is that if you travel that nexus successful the SMS, you tin alteration the search number, the customer sanction and the magnitude to perfectly thing you want!

This is each done by simply changing the URL parameters; I'm not modifying the browser DOM aliases intercepting postulation aliases doing thing fancy, it's virtually conscionable query drawstring parameter tampering reflected XSS style. This feels for illustration each phishing tract ever, not a costs work tally by Australia's largest bank. Seriously, BPOINT is provided by the Commonwealth Bank and aft the acquisition above, I'm astatine the constituent of reaching retired to them and making a disclosure. Except that this is really the strategy was evidently designed to activity and it's a wholly parallel rumor to phishy FedEx SMSs. Speaking of which, the very adjacent greeting I sewage different 1 from the aforesaid sender:

I don't cognize if this makes it amended aliases worse 🤦‍♂️ Let's conscionable jump into the highlights, some bully and bad:

1. My shipping number is now really successful the matter of the email - yay!
2. The words "duty" and "taxes" are now represented successful the correct lawsuit - yay!
3. The words "PAY NOW" are capitalised which seems... dodgy AF!
4. And my favourite spot of all: the "link" isn't really a nexus astatine each because it contains nary scheme, nary domain and nary path, conscionable the query drawstring parameters! Dodgy AF!

It's rather unbelievable what they've done pinch the nexus because it makes the SMS wholly unactionable. It's intolerable to click anyplace and salary the money. And while I'm here, why are each the query drawstring parameter names now capitalised? It's for illustration there's a wholly different (broken) process location generating these links. Or scammers conscionable aren't consistent...

Because "dodgy AF" is the prevailing theme, I needed to excavation deeper, truthful I searched for the 1800 number. One of the first results was for a Reverse Australia page for that number which upon reference the first 3 comments, perfectly summed up the sentiment truthful far:

And the much you publication some connected that tract and different apical links successful the hunt results, the much group are wholly confused astir the legitimacy of the messages. There's only 1 point to do - telephone FedEx. Not by the number successful the (still perchance phishy) SMS, but alternatively via the number connected their website. So, click the "Support" paper item, down to "Customer Support" and we extremity up here:

I'll prevention you the symptom of reference the consequence that ensued, suffice to opportunity that it only referred to email communications and boiled down to suggesting you publication the domain of the sender. But I did negociate to pin the strategy down connected a telephone number which arsenic you'll see, is wholly different to the 1 successful the SMS messages:

So, I telephone the number and travel the sound prompts, selecting options via the keypad to way maine done to the work and taxes section. But eventually, respective steps heavy into the process, the strategy stops responding to cardinal presses! "1" doesn't activity and neither does "2" truthful without a response, the aforesaid connection conscionable repeats. But it does connection an replacement and suggestions I telephone 132610. That's the number I called successful the first spot to get stuck successful this infinite loop!

I effort again, this clip pursuing a different bid of prompts that yet asks for a search number and past proceeds to show maine precisely what the website already does! But it besides provides the action to speak to a customer work usability and I'm really promptly put through. The usability explains that my shipment is weighted astatine US$799 which converts to AU$1,215.97 and it truthful taxable to immoderate inbound fees. "Great, but really overmuch and does it lucifer what's successful the phishy SMSs I've received?" He promises personification will telephone beryllium backmost shortly...

And then, retired of the bluish 3 days aft the first phishy SMS arrived, an email landed successful my inbox:

The dollar figure, the BPOINT reside and the messaging each lined up pinch the SMSs, but that's conscionable simply relationship and if personification had some my telephone number and email reside they could easy effort to phish some pinch the aforesaid details. But then, I looked astatine the attachment to the email and recovered this:

IT'S THE MISSING LINK!!!

My complete Prusa invoice was attached on pinch the bid number, value and shipping details. In different words, 87% of you were incorrect 😲

On a much superior note, Aussies unsocial are losing northbound of AU$3B annually to scams, and that's evidently only a driblet successful the water compared to the world standard of this problem. Our Australian Communications and Media Authority assemblage (ACMA) recently reported 336M blocked scam SMSs and method controls for illustration these are evidently great, but absent from their reporting was the number of scam messages they didn't block. There's an easy mentation for this omission: they simply don't cognize really galore are sent. But if I were to return a guess, they've simply blocked the extremity of the iceberg. This is why successful summation to method controls, we reply connected quality controls which intends helping group place the patterns of a scam: requests for money, a consciousness of urgency, grammar and casing that's a spot off, overseas looking URLs. You know, worldly for illustration this:

What makes this business truthful ridiculous is that while we're each watching for scammers attempting to imitate morganatic organisations, FedEx is retired location imitating scammers! Here we are successful the era of burgeoning AI-driven scams that are becoming progressively difficult for humans to identify, and FedEx is for illustration "here, clasp my beer" arsenic they one-up the scammers astatine their ain crippled and do a cleanable occupation of being wholly indistinguishable from them.

Ah well, arsenic I yet lament successful these situations, it's a bully clip to beryllium successful the manufacture 😊

Scam