USPS Impersonated in Credit Card Phishing Scam

December 23, 2020

With holiday delivery deadlines quickly approaching and online orders continuing to pour in, courier services are facing increasing pressure from anxious consumers. This rise in shipping demand has made Amazon, USPS, UPS, and FedEx targets of increasing impersonation attacks aimed at their unsuspecting customers. In this attack, attackers impersonate a USPS package tracking page to steal credit card credentials.

Summary of Attack Target

Platform: Office 365
Bypassed Email Security: IronPoint
Victims: Employees
Payload: Malicious Link
Technique: Impersonation

Overview of the Credit Card Phishing Attack

This attack mimics a delivery notification email from the U.S. Postal Service, notifying the recipient that their package cannot be delivered until their payment is confirmed. Although the email appears to originate from “USPS” and features the official USPS logo, the true sender is support@xmtservices.com.

The email prompts the recipient to confirm their package by clicking on a link, which leads the recipient to a fake USPS tracking site that claims that additional shipping fees must be paid to ensure package delivery. This page asks for payment details to fulfill this charge, setting a trap for the recipient to release sensitive credit card information to the scammers.

In an ironic twist, the email includes a banner that reads "***This email is from an external source. Only open links and attachments from a Trusted Sender.***," showcasing how far attackers will go to trick unsuspecting victims.

USPS phishing scam email
The fake email purporting to be from USPS

The malicious link hidden under the “Confirm My Package” hypertext redirects to https://www[.]kingstark[.]net/PackageBill/cvea1, a phishing site posing as a tracking page for USPS packages. The landing page contains a fake tracking number for the recipient's supposed package, and prompts them to enter their credit card information. If submitted, these payment credentials are sent directly to the attackers in a successful payment fraud scheme.

USPS phishing payment site
The fraudulent USPS payment portal

Should recipients fall for this attack, scammers can use their credit card information to make unauthorized transactions.

Why the Credit Card Phishing Attack is Effective

This attack creates legitimacy through the use of USPS logos in both the email and landing page. The landing page, in addition to a section for payment details, includes a fake tracking number, links that lead to actual USPS webpages, and even a checkbox for the recipient to indicate that they have accepted the USPS Privacy Policy. These details contribute to the authenticity of this scam, thus increasing the likelihood that a recipient will overlook the suspicious link and fall into the trap.

In addition, the email includes a sense of urgency and states that payment confirmation must be made within three days, or else it will expire and their package will not be delivered. Timed strategically before the holidays, the point is to motivate the recipient to act quickly so they receive their important packages in time. It also aligns to a time when consumers are expecting an increase in packages and are receiving delivery notification emails.

Abnormal Security detecting USPS phishing scam
Abnormal Security detecting the USPS phishing scam


Abnormal stopped this email due to the unusual sender, suspicious link, and the fact that the email failed authentication—a clear indicator that the email is malicious. In addition, the fact that this email includes a financial request but USPS typically does not send financial requests indicates that this email may be fraudulent.

Shipping companies worldwide have reported an increase in email impersonation scams characterized by these fake delivery notifications. According to data from Check Point Software Technologies, November saw a 440% increase globally in shipping phishing emails compared to October. We expect this trend to continue to spike even more in December and throughout the duration of the holiday season.

Want to protect your employees from holiday-related phishing scams? Request a demo now to see how.

Image

Prevent the Attacks That Matter Most

Get the Latest Email Security Insights

Subscribe to our newsletter to receive updates on the latest attacks and new trends in the email threat landscape.

Demo 2x 1

See the Abnormal Solution to the Email Security Problem

Protect your organization from the attacks that matter most with Abnormal Integrated Cloud Email Security.

Related Posts

B 05 13 22 Spring Product Release
This quarter, the team at Abnormal launched new features to improve lateral attack detection, role-based access control (RBAC), and explainable AI. Take a deep dive into all of the latest product enhancements.
Read More
B 05 11 22 Champion Finalist
Abnormal has been selected as a Security Customer Champion finalist in the Microsoft Security Excellence Awards! Here’s a look at why.
Read More
Blog series c cover
When we raised our Series B funding 18 months ago, I promised our customers greater value, more capabilities, and better customer support. We’ve delivered on each of those promises and as we receive an even larger investment, I’m excited about how we can continue to further deliver on each of them.
Read More
B 05 09 22 Partner Community
It’s an honor to be named one of CRN’s 2022 Women of the Channel. Here’s why I appreciate the award and what I love about being a Channel Account Manager at Abnormal.
Read More
B 05 05 22 Fast Facts
Watch this short video to learn current trends and key issues in cloud email security, including how to protect your organization against modern threats.
Read More
B 05 03 22
Like all threats in the cyber threat landscape, ransomware will continue to evolve over time. This post builds on our prior research and looks at the changes we observed in the ransomware threat landscape in the first quarter of 2022.
Read More
B 04 28 22 8 Key Differences
At Abnormal, we pride ourselves on our excellent machine learning engineering team. Here are some patterns we use to distinguish between effective and ineffective ML engineers.
Read More
B 04 26 22 Webinar Re Replacing Your SEG
Learn how Microsoft 365 and Abnormal work together to provide comprehensive defense-in-depth protection in part two of our webinar recap.
Read More
Blog mitigate threats cover
Learn about the most common socially-engineered attacks and why these tactics are still so successful—despite a growing awareness from employees.
Read More
B Podcast Engineering8
In episode 8 of Abnormal Engineering Stories, Kevin interviews Saminda Wijegunawardena, an engineering leader who is no stranger to fast-growing enterprise startups.
Read More
B 04 04 22 Webinar Recap Krebs
High-impact emails are on the rise and secure email gateways (SEGs) don’t have the functionality to mitigate them. Learn how your SEG is letting you down.
Read More
B 04 19 22 Facebook Phishing
While phishing emails have long been a popular way to steal Facebook login credentials, we’ve recently seen an increase in more sophisticated phishing attacks.
Read More