iPhone owners beware: a new and surprisingly plausible phishing scam is making the rounds, and could easily catch out the unwary.
The message, which has been seen by AppleInsider reporters, claims to be from the delivery company UPS. It says a package is ready to be delivered, and encourages the recipient to click on a link to set this up. Of course, the link goes to a fake website where personal data can be harvested.
“We attempted to deliver your UPS package on [date],” the message reads, “but were unable to contact you and the delivery could not be completed. Your package needs to be signed for in person, so please reschedule the delivery by doing the following.” And then you get the link.
iOS’s security measures, created for precisely these kinds of situations, mean links in messages from unknown senders aren’t clickable. But scammers quickly adapted to this, and now use two methods to get round it: they instruct you to either copy and paste the URL into a browser (usually citing nebulous “security reasons”) or reply to the message with “Y” (to “activate the link”) and then reopen it. Replying to a message tells iOS that the other person is a known sender, and links will therefore become clickable.
This particular scam is particularly dangerous for a number of reasons. First, it’s unusually well crafted. I can’t spot any typos or grammatical oddities, the fake URL is less obvious than such things tend to be, and the idea of a “we couldn’t deliver your parcel” message is entirely plausible. Second, it has a potentially very wide target audience, because at any one time lots and lots of people are waiting for packages and many of them won’t know which delivery company has charge of it. (Even those who aren’t waiting for a package may think a housemate or family member ordered something.)
Finally, the scam has the advantage of urgency, because people really care about their packages and will be alarmed by the message’s claim that failing to reschedule the delivery will result in it being sent back to the sender. With Prime Day coming up next week, it’s particularly timely as well, assuming that most people will be waiting for something to arrive in the mail.
If you see the message, report it to Apple and delete it. And whatever you do, don’t reply, and don’t copy the URL. For more advice on this topic, read Your iPhone isn’t as secure as you think (but it can be).
