Smishing

A “smishing” attempt from a scammer purporting to be USPS Tracking. (Courtesy photo)

“We have issues with your shipping address,” a text from USPS Tracking read.

“First, we need to confirm your address is eligible for Informed Delivery.”

Informed Delivery is legit — it’s a free service from the U.S. Postal Service that allows you to preview images of incoming mail — but the text was not: it was designed to con the receiver (in this case, my husband) into divulging his name, street address, email and phone number.

A few days later, another suspicious text arrived.

“From: U.S. Postal,” it read.

“Msg: Your package is on hold for an invalid recipient address. Fill in the correct address info by the link.”

Unsolicited text messages instructing you to call a number — or click a link — are known as “smishing,” which is “a silly word for a serious fraud risk,” according to Consumer Reports. Smishing, a mashup of SMS, the text-messaging format, and phishing, is on the rise. “More than 87 billion spam texts were sent to U.S. phone users in 2021,” the story noted, a 58 percent increase from the previous year.

Smishers impersonate not only the USPS, but also Amazon, PayPal, FedEx, Venmo — a friend recently received a text from ersatz Venmo saying his account had been compromised, and advising him to change his password at the link “immediately” — “and even Netflix,” said Mark Fetterman, senior program specialist at AARP’s Elderwatch, which partners with the Colorado Attorney General’s Office to protect consumers of all ages. Smishing scams “are even more common than email scams these days,” Fetterman said. They are also more common than phone scams.

“All ages are communicating via text,” he explained. “Ironically, it’s the most trusted format of communication, and it’s an easy format for scammers” to flourish in. “They’re using the low-hanging fruit — the companies and services that bind us all — in order to get you to respond, by clicking on a link or calling a number.”

It’s helpful to realize, Fetterman added, that you have done nothing careless which caused you to receive these texts.

“Gone are the days when there were big phone banks of people, dialing you specifically. We may think someone is targeting us, but in reality, computers are sending out these messages to thousands of numbers at a time. They’re pairing numbers, and numbers, and numbers, with area codes. The bottom line is, everyone’s getting these texts. That’s important to know.”

“One of the most difficult parts of dealing with this involves understanding how businesses you work with might try to reach you,” Fetterman went on. USPS, for example, “will not send…text messages or emails without a customer first requesting the service with a tracking number, and it will NOT contain a link,” the US Postal Inspection Service states on its website. “So, if you did not initiate the tracking request for a specific package directly from USPS and it contains a link: don’t click the link!”

That’s good advice no matter who may be trying to contact you via text, Fetterman said.

“Scammers take advantage of what we’re doing to keep ourselves safe,” he said. “You should be very skeptical of a text claiming to be your bank, unless you’ve specifically opted in to receive text messages from them. Check your account online” — which is what my friend did after receiving that suspicious text from Venmo, which is linked to his bank account — “rather than clicking a link, or calling the phone number in these messages. Most of the time, these texts are just fishing for your information, and trying to get you to give it to them. The best thing to do is to ignore them and delete them. Don’t click on them or respond to them in any way.”

To learn more about various forms of fraud, or report a scam, visit stopfraudcolorado.gov.