In you're in a hurry to get online holiday shopping done and shipped, you may see what appears to be an email from UPS saying "package not delivered," and follow the prompt to click on a link to get the issue resolved. Don't just follow blindly. Chances are the email is a fake, intended to infect your computer with a virus.
The scam is "designed to prey on online shoppers who are worried about the timely delivery of their purchases," wrote Angela Knox of Cloudmark email security, on the company's blog Monday. "The emails look and feel like they are coming from legitimate shipping outlets such as UPS but in fact, the emails either have virus infected zip files attached to them or they direct recipients to infected sites through the clickable links embedded in the HTML content."
In the email shown above, there's one big clue in the message that it's a fake: "We were not able to delivery the post package" reads the mishmashed sentence in the message.
"We've seen a number of variants in this campaign (some with attachments, some with no attachments and bad links), all of them personalized to the recipient, and sent from an ever-changing list of fake UPS employees or the generic 'UPS Customer Services.'
With Cyber Monday the "official" start of the "online holiday shopping frenzy, online shoppers should remember to be vigilant about any email message that they receive," Knox wrote. "No matter how eager they are for their shiny new purchases to arrvive, they should take the time to check the original shipping confirmation that comes directly from the online vendor where the purchase was made. In addition, rather than clicking on embedded links in an email, they should go directly to the shipping site and plug in the tracking number."
UPS itself is quite aware of scammers using its corporate name to spread malware or take advantage of unsuspecting users who might be willing to hand over credit card or other information to cyber criminals. The company recognizes it as a "continuing global issue," and has a Web page devoted to fraud protection that's definitely worth checking out if you use the service.
The company "may send official notification messages," a UPS spokeperson has said, but there are — and this is important — "rarely attachments."
If you get such an email, you can forward it directly to UPS at: fraud@ups.com.
"You should not open attachments and should delete the email after forwarding," UPS advises. The company "continues to work with local and national authorities as well as participate in a cyberspace fraud task force. It's a continuing challenge."
Related stories:
- How to play it safe on Cyber Monday
- 5 tips for staying safe while shopping online
- The 25 worst passwords of 2011
- Fake UPS email has scareware attachment
Check out Technolog, Gadgetbox, Digital Life and In-Game on Facebook, and on Twitter, follow Suzanne Choney.