How does the “incomplete address” scam work? What happens if you divulge your payment information? How can you avoid it?
The scam
You receive a text message which looks like a USPS delivery notification. The message indicates that your delivery will not reach its destination due to a problem with your address. Oh no! You must take action now, or the package with your new laptop will remain undelivered!
The message asks you to click a link to confirm your address information.
The scammers even know the links don’t work.
Your SMS application knows this message comes from an unknown sender, and gets in your way by disabling links in the message. As a proficient technology user, feeble defenses like this do not pose a problem to you. You bypass this restriction by manually entering the link into your browser (note: do not actually do this!).
You land on a page that looks like this:
Supposedly the USPS website.
A nice and official-looking USPS website! You enter your address details, and click “Continue”:
The address entry page.
It then asks you to enter your payment details. You efficiently enter your payment details, and click “Continue” again:
The payment details page.
It shows you a fake progress bar. A warm and fuzzy feeling comes over you.
A fake “processing” indicator that actually does nothing.
You wait for a short amount of time before it tells you that you have an error in your payment details:
This card cannot be used error message.
Once again, you enter another credit card number for this so-called “free service”, but the page will not accept it. Oh no! Won’t somebody think of your poor laptop!
You feel relieved because you don’t see any charges on either credit card. I suppose we did not care about that laptop after all.
What went wrong
You know something went wrong, but you can’t quite put your finger on it. Let’s take a look at the clues we missed.
First of all, we didn’t take a moment to consider our actions. We just clicked the link and filled out our payment details.
We could have inspected the tracking number included in the notification first, and looked up the delivery status directly on the USPS website. If the courier could not actually deliver the package, the tracking information page would have told us so.
We manually visited a link in a text message from someone we didn’t recognize.
Don’t do this. In fact, don’t even bother looking at the URL they send you.
The URL of the page does not look right. It looks like this:
https://fdskqs.comThe domain name
fdskqs.comhas no association with USPS. Scammers will typically try to make the domain name have “USPS” in it somewhere, but they didn’t even bother this time.The title bar consists purely of non-english characters. At least, the first page does.
When have you ever used a different language selection on the USPS website?
What happens if you enter your payment details
Some scams ultimately redirect you to the legitimate website, so you think nothing of it. But this one doesn’t. It just keeps asking you to enter your payment details, and then “rejects” them.
The scammers just collect your payment details, then package them up and sell them to other people on the dark web. They do not verify the payment details you enter, so you can enter anything you want. You can enter a fake credit card number, or even a real one. It doesn’t matter to them.
After your credit card information filters through the various darknet marketplaces and gets sold, you’ll start to see charges flow through. Sometimes, this can take a handful of hours, but in some cases the charges won’t show up for at least a couple weeks.
I did not see any activity on my card until more than two weeks after I filled out the form. Below, I list most of the charges that appeared on my card (I may have purged some charges from my records, sorry!):
| What? | Merchant Descriptor | Date | Amount |
|---|---|---|---|
| Square | SQ *RUD3 BWOY SMOKE SH | June 2023 | $85.00 |
| Square | SQ *CARLOGIX AUTO TRAN | June 2023 | $517.50 |
| Doordash | QUALITY PIZZA RESTAURANT | June 2023 | $114.54 |
| Spin Scooter | Spin | June 2023 | $5.00 |
| Spin Scooter | Spin | June 2023 | $5.00 |
| Spin Scooter | Spin | June 2023 | $5.00 |
| Doordash | WILLIES TACO JOINT | June 2023 | $52.76 |
| PayByPhone | MPA PARKIN PAY BY PHON | June 2023 | $3.25 |
| Waymo | WAYMO | June 2023 | $18.89 |
| PayByPhone | MPA PARKIN PAY BY PHON | July 2023 | $3.25 |
| PayByPhone | MPA PARKIN PAY BY PHON | July 2023 | $3.25 |
| Doordash | DD *DOORDASH MRYOUCHIN | July 2023 | $58.95 |
| Doordash | DOORDASH*MR YOU CHINES | July 2023 | $58.95 |
| Doordash | DOORDASH*MR YOU CHINES | July 2023 | $58.95 |
| Total | $990.29 |
All in all, the scammers attempted to charge my card for close to $1,000. None of these charges went through, because:
I did not actually enter my real credit card.
I used a virtual card from Privacy.com. I highly recommend using Privacy to protect your purchases online.
Sign up (free!) today and get $5 in Privacy Credit to spend anywhere online!
How to avoid this scam
Just ignore the message. You can effectively avoid scams this way, and you can also use this method to avoid people in general.
“But how can I tell?” you ask. “The message looks so official!”
Using your brain, you can think about the message for five seconds and ask yourself the following critical questions:
Do you know the sender?
Ignore messages from phone numbers or email addresses you do not recognize.
Does it look unprofessional?
Ignore messages or websites that contain spelling or grammatical errors.
Does it urge you to act now?
Do not divulge your personal or financial information for urgent requests.
Does it instruct me to go somewhere else?
Attempt to resolve the problem directly on the courier's website.
Conclusion
Before you act, ask yourself the above questions. Always take a moment to critically think about any unsolicited requests for your personal or financial information.
Remember, if it looks suspicious, ignore it!
🤔⚠️💡💸