Abnormal Security discloses how USPS was impersonated in credit card phishing scam

With holiday delivery deadlines quickly approaching and online orders continuing to pour in, courier services are facing increasing pressure from anxious consumers. This rise in shipping demand has made Amazon, USPS, UPS, and FedEx targets of increasing impersonation attacks aimed at their unsuspecting customers.

In this attack, attackers impersonate a USPS package tracking page to steal credit card credentials.

Credit card phishing attack

This attack mimics a delivery notification email from the U.S. Postal Service, notifying the recipient that their package cannot be delivered until their payment is confirmed. Although the email appears to originate from “USPS” and features the official USPS logo, the true sender differs.

The email prompts the recipient to confirm their package by clicking on a link, which leads to a fake USPS tracking site

The email prompts the recipient to confirm their package by clicking on a link, which leads the recipient to a fake USPS tracking site that claims that additional shipping fees must be paid to ensure package delivery. This page asks for payment details to fulfill this charge, setting a trap for the recipient to release sensitive credit card information to the scammers.

Attempts to scam victims

In an ironic twist, the email includes a banner that reads "***This email is from an external source. Only open links and attachments from a Trusted Sender.***," showcasing how far attackers will go to trick unsuspecting victims.

The malicious link is hidden under the “Confirm My Package” hypertext redirects to a phishing site posing as a tracking page for USPS packages. The landing page contains a fake tracking number for the recipient's supposed package and prompts them to enter their credit card information.

If submitted, these payment credentials are sent directly to the attackers in a successful payment fraud scheme. Should recipients fall for this attack; scammers can use their credit card information to make unauthorised transactions.

Why the credit card phishing attack is effective

This attack creates legitimacy through the use of USPS logos in both the email and landing pages. The landing page, in addition to a section for payment details, includes a fake tracking number, links that lead to actual USPS webpages, and even a checkbox for the recipient to indicate that they have accepted the USPS Privacy Policy.

Timed strategically before the holidays, the point is to motivate the recipient to act quickly so they receive their packages in time

These details contribute to the authenticity of this scam, thus increasing the likelihood that a recipient will overlook the suspicious link and fall into the trap. In addition, the email includes a sense of urgency and states that payment confirmation must be made within three days, or else it will expire and their package will not be delivered.

Timed strategically before the holidays, the point is to motivate the recipient to act quickly so they receive their important packages in time. It also aligns with a time when consumers are expecting an increase in packages and are receiving delivery notification emails.

Increasing email impersonation scams

Abnormal stopped this email due to the unusual sender, suspicious link, and the fact that the email failed authentication—a clear indicator that the email is malicious. In addition, the fact that this email includes a financial request but USPS typically does not send financial requests indicates that this email may be fraudulent.

Shipping companies worldwide have reported an increase in email impersonation scams characterised by these fake delivery notifications. According to data from Check Point Software Technologies, November saw a 440% increase globally in shipping phishing emails compared to October. Abnormal expect this trend to continue to spike even more in December and throughout the holiday season.