'FedEx Parcel' Email Scam
The 'FedEx Parcel' email scam is a phishing attack that collects login credentials by tricking users into navigating to a copycat FedEx login domain. Since it uses real FedEx asserts to imitate official messages, users shouldn't rely on appearances for avoiding this tactic. Update browser-monitoring security services for auto-detecting corrupted domains, and avoid clicking on links whose trustworthiness you can't verify before loading the content.
A Package Away from Collected Accounts
In 2021, almost half of all phishing tactics use the simple theme of requesting an account login for any of innumerable reasons, which tricks readers into giving away their personal information for nothing effectively. As a clear case of this rigged shell game in action, one might look at the 'FedEx Parcel' email scam. This phishing lure is almost visually-identical to authentic graphics design elements from the FedEx corporation, making its appeal to the 'fish' all too transparent.
The 'FedEx Parcel' email scam consists of two halves: an e-mail message and a Web domain. As far as malware experts can determine, the e-mail messages use random distribution and don't target any specific user demographic. However, a 2018 case of this tactic employed hijacked accounts from a university. Any future incidents will likely use similarly-collected addresses.
The e-mail's design includes FedEx graphical elements for improving its visual authenticity while claiming the recipient's package delivery is experiencing a temporary delay. An embedded link supposedly takes the Web surfer to the second half of the tactic: a 'FedEx' website for logging in and confirming the address.
Naturally, the website is fraudulent. Users entering their names or passwords will have the credentials collected by the threat actors and repurposed for other crimes – just like the logins of the previously-mentioned university accounts.
Pushing Tactics Back to Their Senders
For most users, deleting the 'FedEx Parcel' email scam, unread, is sufficient for protection. However, receiving these e-mails implies that the recipient's e-mail is in criminal possession in the first place. Users should avoid using 'guessable' addresses and not give their e-mails to websites or other entities with questionable security (such as storing credentials in unprotected plaintext).
The 'FedEx Parcel' email scam also offers lessons in interpreting e-mail information to the benefit of the reader. Monitoring the sender's address for an unusual domain is one way of spotting a tactic. Of course, no legitimate FedEx messages will use private university accounts. However, this factor, by itself, isn't always reliable; some threat actors may create 'spoof' addresses that closely resemble real or misleading ones.
Malware experts also recommend against following e-mail links to websites. When navigating to a website, the safest method is entering the address into the browser's URL bar. Users also may find the websites through trustworthy search engines, with appropriate precautions for avoiding advertising links. Unsurprisingly, the official FedEx domain is fedex.com.
The 'FedEx Parcel' email scam's craftsmanship is worth praising from a threat actor's standpoint. With criminals collecting assets for the most believable tactics ever, Web surfers have to stay on their toes – and not click something just because it looks real.
