A Lot of People Are Falling for Those ‘Your Package Cannot Be Delivered’ Texts

We all know the “your package has been delayed” texts are bogus, right? Apparently not, according to Akamai, which finds that traffic to US Postal Service phishing sites get more traffic some weeks than the actual USPS website.

“The USPS is under attack from text scams, especially during holiday seasons of Christmas and Thanksgiving because of the nature of gift buying in these holidays,” Akamai says.

(Credit: Akamai)

Akamai compared traffic to the real USPS website against a host of the most popular fake USPS websites from a number of different domains.

“The total query counts of malicious domains vs. usps[.]com are almost the same, even when only counting domains including the explicit USPS acronym,” say Stijn Tilborghs and Connor Faulkner of Akamai. “Although the USPS won with 51% of the total queries for this 5-month period in this analysis, the way we filtered the data suggests that the malicious traffic significantly outweighs the legitimate traffic in the real world.”

(Credit: Akamai )

During the 2023 holiday season, when we’re all anxiously tracking our packages, traffic to the malicious websites outpaced the real USPS website by a fairly significant margin. Since USPS is considered a familiar brand, it’s “used to trigger a feeling of familiarity and legitimacy in the target victim,” Akamai says.

Some of these malicious sites are elaborate, with realistic-looking tracking pages and convincing sitemaps, BleepingComputer notes. One of them even has a real gift shop with USPS merchandise.

If you receive a text message or email about a delayed package, don’t click on any links. Go directly to the site where you purchased the item in question or usps.com for a tracking update.