Is this for real? I would’ve automatically deleted and reported it as spam lol.

You and the “87%” of people who responded to his Tweet or whatever.

Yeah, of course. Surprised there are “13%” of people of his Tweet that would not or whatever.

That 13% is the reason these scams are so popular.

Yep. Accidentally imported some parts for my car (thought they were in the states, but no, China), got a random message about duty fees. I initially thought it was a scam, but got another, so I followed the link on a safe device (laptop running Linux). It gave a valid address from the shipping company with details that verified my order, so I had to pay or it wouldn’t be delivered. Very annoying, should have been told earlier that I needed to pay duties/tariffs so I could plan accordingly.

Wait this user story doesn’t say why it’s not a scam - you followed a link instead of calling the company and asking wtf is going on.

It’s not a scam, it’s a link from FedEx (or in my case UPS) to pay tariff and duty charges. Believe you me, I triple checked the whole thing and made sure it was legit before I even considered paying for it. If you are shipping an item directly from outside the US, a lot of times those charges are left for you to deal with (resellers on eBay or Amazon for stuff from China would pay for those in advance, which is why it’s not always normal). It’s a bigger thing than it used to be, because it used to be that if the value of an item was less than $800 (I believe, it’s been a min), there wouldn’t be duties on it unless it was a big item or some other unusual circumstances. However, Trump screwed that up with the tariff changes, so extra charges are collected by the shipping company directly. The problem is that I wasn’t warned ahead of time (I thought it was coming from the Philippines so the charges wouldn’t be a thing), and that seems to be increasingly the norm for ordering directly from the manufacturer, given soo many are in China or countries we have decided it is a “good” idea to impose tariffs on (which the customer has to pay).

Yeah. Recently I was expecting a message from a bank, finally I got a call… from a chatbot claiming it has an important message for me, but first I have to give it my private info to verify myself and there’s no way to validate the call is legit first.

When I complained to the bank they just told me I shouldn’t worry, they made the call so it’s perfectly safe and there’s nothing to worry about…

I would change banks over that and list that as the reason why.

My banking app has a “is <bank> calling?” button, which is pretty neat. The button is highlighted whenever I open the banking app whilst on a phone call, presumably as a subtle anti-scammer warning.

e: spelling

Damn cool. Which bank, if you don’t mind me asking?

I think this is very common for UK Banks

Alas I’m just a poor slob in the former colony called the United States, presently run by an idiot wannabe dictator.

This is honestly a really good idea.

My bank has the inverse as well. If i open the app while on a call there’s a huge banner across the top stating they are not calling me.

The Swedish banks has a shared identification app, and it gives a big alert every time a login is prompted asking if you called out or got called, and doesn’t let some actions complete if you say you got called

Always call back. A legitimate bank will say that its no problem to call them back. Never give any personal details over the phone unless you made the call yourself.

And don’t trust the number they give you. Look it up yourself.

Our Dr office does that as well. We have a call about your upcoming appointment, can you provide details to confirm it’s you. They don’t give appointment time, what office it is, patient name nothing. Even if you trust it legit if you or your partner or kid both have upcoming appointments you have no idea which it’s for.

We just hang up and call to figure out which it was.

You keep getting phished by links with bpoint.com.au as the domain claiming to be FedEx?

Read the article. All the communications were legit, but they looked more suspicious than actual phishing because FedEx is just that inept. Also, bpoint.com.au is a legit domain used by these services.

Just to clarify, basically every single part of this comment is wrong.

Yeah, I read the article. I get that it’s legit, but at that point the process is so defunct, I wouldn’t even work with a text at all. Just call FedEx directly with your tracking.

Shame on FedEx though. Obviously an atypical case, with an out-of-country delivery, etc. I try to avoid that as much as possible; it’s always a problem in my experience.

Yeah, I read the article.

HOW DARE YOU THIS IS THE INTERNET WE DO NOT DO THAT HERE

:)

Just call FedEx directly with your tracking.

But you saw how useless that was in this case - any company like Google or whatever that does not feel a need to have public-facing customer support. heh

atypical case,

Compared to many companies you might do business with, but certianly not all - as I alluded to just now with companies like Google or FedEx… heh.

I think that’s the worst part about a lot of these new companies - they make it so hard to get support, so when there’s a problem, you’re just… screwed.

Yeah 100%

Like they want nothing to do with you. You’d think the CEO would not want such a terrible user experience as seen in that article, but…

…something, something, enshittification.

Strewth. I think the problem is int he case of FedEx, random home delivery people are not the source of their profit, so customer service is a “waste of money”. Similarly, with Google, we’re also not the profit for them, so similarly no reason to waste the money.

The irony is how difficult like Doordash/Uber etc are, even when we ARE the source of money. heh

There’s a sage piece of advice that’s always relevant in these cases and it’s very simple: if in doubt, go the website in question and verify the request yourself.

Now the spamer has confirmation that this email address is active, can be shared in their network.

Edit: email address

Never thought about it that way, I usually open sketchy stuff in tor

If you remove the tracking parts of the URL.

Remember kids, everything after the ? In a URL is unnecessary tracking! Trim your URLs before sharing!

Depends entirely on the site. Amazon? Sure.

Many other sites will put query information in this part of the URL, so all you’re doing is removing the information you put in the previous page and probably invalidating your search results

Not necessarily, or even usually.

You go to the known legit website, not the one in the link.

You don’t use the link. You go to the website by your normal means. In this case, he opened a browser and went to the FedEx site on his own. That way you know you are on the real site.

hurr durr sus message here and there but surprise he is expecting a package. that sus af email is exactly that kind of email i would expect in that situation, including broken links and everything. not worth a read

Pro tip: Scammers want your money, their links will work ;)

Whoosh.

Its a legit communication from Fedex. Bpoint.com.au is a legitimate website to pay dues. The point of this entire article is that the legitimate communication from FedEx looks sketchy as fuck even when you are expecting it and FedEx says its real. It is a call to action for FedEx to improve their communication

Pro tip: You’re gonna get scammed if you ever receive a scam message that appears to be related to something you happen to be expecting. I’m sure you’ll feel all superior to the rest of us until that happens, but it will happen to you.

And meanwhile, you’re so fucking smart it galls me to have to point this out to you, but what about your grandmother getting an SMS like that? Not everyone is as brilliant as you.

And the point is that it would be relatively easy for companies to avoid looking so “sus”.

So instead of feeling smug that you think you can keep yourself safe, perhaps thinking of others might be a good place to start.

You’re just as bad as the fascists who have zero empathy for anything until it affects them personally.

I usually post the article in the comments so it is easier to read, but Troy hunt ‘s website is already so easy to read its a joy!

One cool thing that just went live in the last month or so is SMS Sender ID. You need to file a shitton of paperwork before being given the keys to send an SMS to an Australian with a name instead of a phone number.

www.acma.gov.au/sms-sender-id-register

I personally had to write the code to make this work for a rather large financial institution that uses AWS for bulk SMS. It was a lot of hoops to jump through. If you get one detail wrong, your SMS just has a phone number instead of a name.

At this point, it should be impossble to deceptively get “Fedex” into an SMS header.

With how much effort is being put into phishing awareness and training, some people/companies still put zero effort into their communication.

Duting a lengthy process that involved an attorney, I got an email from a firstnamelastname(at)yahoo(dot)com, with no introduction, no mention of my name, a misspelled address, telling me about an appointment at another address that was… screenshotted from a website and pasted as image. Looks sketchy AF by any measure. Nope, that was a real email from a paralegal.

Filed a helpdesk ticket at work. Get a Teams message from “<FirstName> <LastName> (external)”, asking me my company machine ID in bad English. Responded with “you are helpdesk, do you not know this?”. After a few repeated requests for the ID and not answering any of my questions, I just stopped responding.

The head of my IT department once asked me to send him an AWS root password over email because there was an issue with billing on the account.

Another manager told users to just bypass the certificate errors on a new web service.

Multiple times I’ve had people tell me over teams to do all kinds of weird things to work around security errors.

It’s a weird thing where people in IT think the security rules are for everyone else and not for them. And it’s just laziness. I wind up doing all of the work to set everything up so the user is going to subdomain.[my company’s domain] and the cert is valid and if it’s an internal service, use kerberos to validate the user so they don’t even enter a password.

The goal should always be that the user sees zero red flags when using a service. But a lot of people are too lazy to implement what’s needed so eliminate all of those red flags and instead just send out a message to tell people to ignore them.

Yeah, there were two IT techs at one company who routinely asked for user passwords, in part because some of the software we used require setup in the user account. I’d say no, but I was on a few reply all emails where others provided their password to everyone on the email.

I forwarded those emails after the IT manager after the company email server got blacklisted by a client for our emails being used as an attack vector to phish.

Capital One does something similar and it’s so fucking annoying. They send text messages that read "Your transaction for some company was DECLINED! Take action now: someweirddomain.com/sketchy/uri"

I used URL Checker to figure out where it ultimately landed and it does go to Capital One.

I’ve even complained about this and they said, “Well, you should know these texts only come from us.”

I hate all the sketchy domains. You have a domain I trust; use that one.

The solution is: if it looks scammy, get on a different device altogether and use your normal login to the institution to access the issue through the normal channels instead of their “convenient link” through the sketchy service which may well be skimming your data even if they are under contract to your bank.

Unfortunately, a lot of the institutions’ own interfaces suck so badly it’s sorely tempting to use the quick link.

But as this article points out - that’s not always helpful when the company makes it difficult to contact them - or in this case, the Duty and Taxes [sic] aren’t a part of the FedEx process but a part of the government, so to FedEx it’s a third-party issue and so when they pulled up the shipment, no mention was made of it (that’s my theory why that happened).

Your advice is good - I’m just saying it won’t always work. heh. But it is the thing you must do unless you recognize the message source/content and even then, better to just log in separately. heh

Then they send the same email saying “phishing scams look like this!” And it’s their exact text…

The scammers messages look less dodgy than the real one, if you dont count the obviously suspicious links. Though it doesnt help that the real one also has link that looks suspicious and also like it was made by scammer who isnt very good at what they do.

So many legitimate messages look like phishing schemes nowadays: those class-action ones are probably the worst offenders for me because it would take no effort for someone to create a scam based on that. Banks are another big one. These companies are making it really easy for the scammers to take advantage of people.

Interestingly enough, I’ve found LLMs are pretty good (for now at least) in helping determine if something is legit or not. I’m using them as a glorified search engine in such a case, but having them not only opine as to whether or not it’s legit but link me to some sort of news or other official site about the thing helps.

edit: lulz, the anti-AI sentiment is so high that people downvote even the places where it’s actually useful. Whatever, bros, make yourself happy. I hate AI in general, but I don’t let that blind me to the few places it’s actually useful. lol

So, your suggestion is to feed private, potentially sensitive information to an LLM and then trust its judgment?

I’m sure that a bank / delivery company / doctor’s office that uses such terrible practices is actually on the ball when it comes to making sure all the links they send only work once and time out after a while, right? So, when a guy in Nigeria is working at his job where he reviews LLM sessions to ensure they’re sycophantic enough, there’s no issue. He can’t click on it or sell the data to criminals or anything, can he?

private, potentially sensitive information

I’m really not sure that I’m giving them anything they don’t already have, but i was speaking of incoming potential spam. Like notifications about class action lawsuits. Generally speaking, if a spammer knows something about me, that means it’s already out there. And if they know enough about me, it’s probably an email I can identify as not spam because they know things that spammers wouldn’t know… so I don’t think I’m really pasting in any truly sensitive information in the first place, but I’ve tried to address the point anyway.

If it’s not spam, you’re telling the chatbot that you were one of the people whose penile implant malfunctioned and are part of the class action lawsuit about that. That means you’re telling the Nigerian chatbot quality control expert about that.

This is definitely not the reason I do it, but it’s an added advantage of always getting packages delivered to my AusPost parcel locker. They always arrive in a very consistent format and don’t require clicking any links.

I’m in Canada, I purchased something from the US shipped with DHL.

They did not send a text. They sent a WhatsApp‽

Plus, they made me pay import fee on the value of the listed items instead of on the price I payed (there was a 40% discount).

they made me pay import fee on the value of the listed items instead of on the price I payed (there was a 40% discount).

All this discount / special deal complexity needs to stop. Now the tax-men are scamming us declaring everything to be taxable at the retail rates when nobody pays the retail rates.

One price, for everybody, all the time. One tax rate, for everything, all the time.

One price, for everybody, all the time. One tax rate, for everything, all the time.

One Price to rule them all, One Currency to find them,
One Tax Rate to bring them all, and in the shipping bind them
In the Land of Canada where the Mooses lie.

Couldn’t be much worse than what we have today in the real world…

LOL, I know it’s not what you mean at all, but your answer gives me the vibes of “so fuck it, let’s all vote for Sauron”. Even though I know that’s not what you mean at all.

I guess the ONLY good news is that fascism genreally is stupid. (Which is sad considering how stupid they are and yet still manage to do so much damage. I guess democracy and the general public are that much stupider.)

fascism genreally is stupid

Strange thing about sociology / political games: stupid works.

In the runup to world war II both the UK and USA were studying Fascism as a potential way of “getting more” from their populations to compete better in the coming conflicts…

stupid works.

One of the most frustrating things about life and humanity. lol. One of MANY things, but… definitely one of the things.

I don’t know if this ties in well or not, but many times over the years I have talked with otherwise reasonable people who had already, or were about to, make really stupid decisions, and I called them out as such: “this is a really stupid thing to do” - to which they all responded “are you calling me stupid?” - I never succumbed to the temptation of “well, if the shoe fits…” - truth, and what I said, was: “about this particular decision, yes.” They always had some particular goal in mind which overrode all other considerations in their mind, and they couldn’t step back and see how their goal wasn’t 100% all important overruling all other considerations.

That’s the type of patience I’m still trying to learn, so it’s good to get a reminder (and a new wrinkle on a good way to respond). <3

DHL is the shitpost equivalent of a shipping company

What’s Lasership then?

Why do so many people seem to think that paid is spelled as payed?

Because English is my second language and the grammar is all over the place.

What a ride that was

The mentality around online security now is to push the responsibility onto someone else instead of investing any real effort into it. So you need to be aware of phishing scams, but the company isn’t going to make any kind of effort towards it. That’s on you, not on us!

Microsoft is really terrible about this. They have at least 20 different domains and many of them ask you to enter your credentials into them. Usually you’re redirected to something like login.microsoft-online.com or something like that and enter in your credentials into that. Always seems like a phishing thing… why wouldn’t it just be login.microsoft.com? I’m guessing within Microsoft, it’s probably was a pain in the ass to get whatever department in MS that controls the microsoft.com domain to set up a subdomain. So instead ever department registers a domain that they can control. The end result is you’re dumping your credentials into random looking domains, then downloading and installing software from other random domains.

They just don’t really care as long as there’s no legal liability. You’re data gets compromised because you didn’t notice that you put your credentials into online.microsoft-login.com instead of login.microsoft-online.com, that’s your mistake and no one can sue microsoft for it. As long their negligence doesn’t meet the legal definition of negligence, they’re not going to put an any kind of effort.

Anti-phishing training could be so much better… “don’t put your credentials into anything other that *.microsoft.com”. But since these companies won’t make any effort, anti-phishing training amounts to “Just be careful or whatever LOL!”

You’re data

Bad grammar is the hallmark of a scam. THIS COMMENT IN A SCAM, PEOPLE!!! DO NOT READ!!!

;-)

I think you’re spot-on regarding those domains. People trying to make things work and fighting (and losing) against internal pressures, making the situation ten times worse.

For years, anti-phishing training sucked most places - I suspect it still does most places - but my previous employer actually got a better one in the last couple of years before I left. Most phishing training just says “Don’t click links from sources you don’t trust” and doesn’t teach you what to look for.

To me, understanding how URLs work is essential. Being able to identify the actual domain is critical, but also at least being able to identify when the parameters start is also critical. But that fails when companies register weird domains or use third-party shorteners and things like that.

The linked article is a fantastic example of the worst legit comms I’ve seen. Absolutely looks scammy all the way through.

And what is even better, is that microsoft-online.com isn’t owned my microsoft. It is a potential phishing site. The correct one is microsoftonline.com

Hey fellow interneter, can I join you at screaming at the clouds?

I’m guessing within Microsoft, it’s probably was a pain in the ass to get whatever department in MS that controls the microsoft.com domain to set up a subdomain.

I’ve had to deal with shit like this personally so I guarantee that was at least one reason. The departments that control the domain treat it like some sort of power trip and make it hard to do the smart thing.

Microsoft is just a web of legacy software mixed with modern shit. Its a web of stuff that one human just cannot comprehend. Sp yeah

Plus probably a ton of AI slop by now.

A competent government would set up best practice rules, and tools to improve systems. They could even provide some sort of system for consumers to report these issues. Then they could assign companies a cyber security score. Basically, a wall of shame for this stuff, ideally with the option for fines for non-compliance.

Unfortunately, “competent government” seems to be an oxymoron in most places.

Edit: to be clear, I provided examples of half-hearted implementations of what I’m talking about from a couple sources, but I’m making no claims about the competency of those governments.

Oh, they’re competent. It’s just that they’re competent at protecting monied interests, not the people.

Microsoft has enough things to be ashamed of, do you think one govt score and a fine of 100M would change any of that?

I don’t get why all these big companies just cannot be serious about anything they do. They’re always disorganized.

It’s because they’re big companies. The bigger they get, the less they can focus on any one thing. More people means more risk of someone being unqualified, and less oversight through more layers of middle management, most of whom are also unqualified.

Your local business employs fifteen people. One owner, two managers, and 12 staff. Everyone knows everyone and if they’re truly bad at their job they can’t deflect and skate (unless the owner allows it).

you clearly have very different local buisness than where I am, because about half of the ones around here are half run by drug addicts.

Only the owner’s son is allowed to, and his cousin, and his wife’s friend. But everybody knows that and just fix their mistakes. They’re such a sport, is this wholesome? /S

been going through this where I work for the past couple years now. after a few dozen people and with a focus on growth but not the underlying support structures to allow for that, it’s been a fucking disaster. it’s been very difficult for me to accept that it is impossible for me to meet my previous standards because of the ridiculous workload, scheduling, and piss poor communication and interdepartmental processes.

scale that x1000+ and yep it’s clear why it’s a disaster at huge companies

Because everyone is just a person

??? The guy you’re replaying to is talking about big corporations and this post is about FedEx… you think one one person made and is responsible for this “notification system”?

The answer is: because they dont care, unless it impact their profits.

As i said, they are people.

Yeah, they say don’t worry about imposter syndrome because many people feel that way. They don’t say that most people aren’t imposters out of their league, just that most people feel that way.

There’s a healthcare organization where I live that basically dominates everything, and every time they contact me it’s through a new phone number and new format of call/text and they’re super disorganized as well

It really is the golden age of stalkers and scam artists. You wouldn’t believe how much I know about the previous owner of my phone number. Their name, where they work, where their kids go to school, their pediatrician, their coworkers names and numbers (still included in text conversations). I started responding to the work texts when I realised they were STILL giving out the number (autofill I guess)

This needs to be made for real

This one confuses me. I never receive text messages about my packages. I get around 5 deliveries a week on average and maybe a dozen on a heavy week, and I have never had a reason to get my phone involved. The package is either delivered successfully, or I can see from the seller there was an issue, and I deal with them. A few times the delivery service has left a note and I’ve called them. Why are folks even bothering to allow text messages for deliveries?

It’s mostly so you can grab it as soon as it’s delivered if you have a porch pirate problem.

This is why I deliberately keep most text histories as it adds another layer of legitimacy for any infrequent but repeat purchases. When I just bought something or have a doctor’s bill and a text comes through on a history from the last time I had to pay someone, it makes all this much simpler. Legit companies stick to the same number and scammers usually don’t.