As Holidays Near, Don't Fall for Fake Package Tracking Emails

Online scammers love to take advantage of seasonal events and happenings in the news to entice unsuspecting victims. With the holidays upon us, many people are expecting the delivery of packages, which is why scammers sent us this email recently:


Upon first glance, it may appear legitimate, but take a closer look, and you'll notice some grammatical and word-usage errors. For example, FedEx is not the post office, so it's unlikely the company would issue a "postal receipt." And, unless you live on a Pony Express stop, you've probably never used the word "postrider" to describe the person who delivers your packages.

This is one variant of a cyber-attack known as phishing. Such scams work by tricking the recipients of emails into divulging sensitive information by masquerading as a trusted entity, such as a bank, credit card issuer, or online retailer. In the particular scam being perpetrated by the above image, clicking on the "GET POSTAL RECEIPT" button most likely takes you to a rogue website that installs malware on your computer without your knowledge. Such malware might include a virus, spyware (software that tracks what websites you view), or a key logger that captures all your keystrokes (including passwords).

Another similar scam we often see involves a fraudulent email claiming to be from the Better Business Bureau, Federal Trade Commission, or government entity with a subject line such as, "A complaint has been filed against your business." Similarly, an email like the fake FedEx one above may arrive with a malicious attachment that installs malware when opened.

Protecting yourself against such scams requires a multi-pronged approach. One of the best tools is a strong email filtering service, which not only weeds out phishing emails, but also eliminates spam and other junk before it reaches your inbox.

The second defense is your continued vigilance. If you receive an email that you're not expecting, don't click on any links or attachments in the email. Instead, go to the company's actual website (type the URL into your browser or find it via Google) to see if the email is legitimate.