Thanks FedEx, this is why we keep getting phished (troyhunt.com)

Article summary

The article discusses a personal experience with a suspicious SMS message allegedly from FedEx, which exhibited characteristics of a phishing scam. The author investigates the legitimacy of the message and eventually confirms it was real, but criticizes FedEx for using a format that is easily mimicked by scammers. The incident highlights the challenges of distinguishing between legitimate and phishing messages. The author notes that Aussies alone are losing over AU$3B annually to scams, and that technical controls are not enough to prevent them.

Main themes

• phishing scams
• legitimate notifications
• company responsibility
• individual verification
• online shopping
• scam prevention
• regulation and standardization

What commenters say

• Some argue that companies should be held responsible for the consequences of their poorly designed notifications being ignored, as they can be easily mistaken for phishing scams.
• Others suggest that the onus is on the individual to verify the legitimacy of messages, rather than relying on the company to get it right.
• There is a proposal for a law that would place the financial and legal consequences of ignoring a suspicious message on the sender, if a reasonable person would doubt its legitimacy.
• It is argued that the prevalence of online shopping and frequent package deliveries has created an environment where scammers can easily take advantage of people's expectations.
• Some believe that companies like FedEx may be inadvertently contributing to the success of scammers by using similar tactics, such as urgent messages and unclear language.
• Others think that the problem lies in the lack of standardization and regulation in the industry, which allows scammers to exploit vulnerabilities.
• There is a concern that the emphasis on technical controls may not be enough to prevent scams, and that human controls, such as education and awareness, are also necessary.