Home Advice & How-ToSafety Modern Survival Skills: How To Check If a Tracking Number Is Real
Home Advice & How-ToSafety Modern Survival Skills: How To Check If a Tracking Number Is Real
Safety

Modern Survival Skills: How To Check If a Tracking Number Is Real

by Fred Decker
by Fred Decker 1890 views
FacebookTwitterLinkedinEmailCopy to clipboard

One flaw that’s deeply ingrained in human nature is the desire to get something for nothing.  It’s why we flock to “buy one, get one” sale offers, or buy lottery tickets that might (but usually don’t) give us a lifetime’s earnings in a heartbeat. 

Unfortunately, it’s also why scammers expend so much energy on finding ways to fleece the rest of us instead of engaging in honest work.  One frequent scam — especially now that the pandemic has made online purchasing so common — is the fake USPS tracking number or a fake tracking number from some other courier service.  They’re used in multiple ways, and all of them are bad news. 

Fake Tracking-Number Scams

There are many ways scammers can leverage a fake tracking number, but they fall into two broad categories.  The first affects anyone who buys or sells online (and most of us buy things online, especially since the pandemic).  In this case, you purchase from a given vendor, and in due course, you receive a tracking number. 

Spokeo logo

Who's Calling Me?

Search any phone number to learn more about the owner!

Time passes, and the item doesn’t arrive, so you check the tracking number, and — to your surprise — it shows that the item was, in fact, delivered.  It turns out that the scammer used the number of a legitimate delivery in your geographic area.  Because tracking shows the item as being delivered, scammers know that challenging the purchase through a payment service like Paypal or a shopping platform like eBay can be difficult (but not impossible).  The tracking number may come from the USPS, UPS or another carrier; how scammers access the numbers is unclear, but that’s a problem for the carriers to address. 

The second form of a tracking-number scam is a straightforward phishing attack.  You’ll receive an email or bogus text, usually claiming to be a tracking alert or a missed-delivery alert from UPS, FedEx, the USPS or some other carrier.  There’ll be a clickable link, or a phone number, so you can reach out to see where your parcel is or correct the problem with your delivery.  If you click a link, malware may be loaded to your phone, or if you call the number, a helpful “agent” will take your personal information. Either way, identity theft and fraud are likely to ensue. 

How To Check If a Tracking Number Is Real

Sometimes the number a scammer sends you is simply fabricated.  The tracking-number formats used by the USPS and other major carriers are well known, so they’re easily spoofed.  Sometimes they’re perfectly legitimate tracking numbers but “fake” in the sense that the scammer has misappropriated them.  Either way, checking the number isn’t especially difficult. 

Only the laziest and clumsiest of scammers would use a fake USPS tracking number that isn’t in the right format, but by all means, screen for that.  If you search “USPS tracking number format,” or the equivalent for any other carrier, you’ll see a numeric or alphanumeric format.  If your purported number doesn’t match the format, it’s bogus (although bear in mind some carriers use multiple formats depending on the type of package or class of service). 

The other way is simply to go to the carrier’s package-tracking website and type in the number.  Don’t do this by clicking the link!  Instead, use your browser (or app, if applicable) to get there.  If the number is bogus, you’ll get an error or no results.  If the number is legitimate, look at the tracking information.  If it’s not for a purchase you’ve made, or if the dates are wrong, it’s bogus.  If you’ve gotten a phishing text, that’s all you need to know.  If you were given this tracking number after making a purchase but didn’t receive a delivery, you’ve probably also been scammed. 

Other Signs of Fake Tracking Numbers

Often you won’t need to search the tracking number to know that it’s probably fraudulent.  In the case of the USPS, for example, you’ll only get a text about your delivery if you’ve specifically signed up to receive them for that specific package.  If you didn’t do that, it’s bogus, every time.  Also — and this is a big one — legitimate texts from the USPS won’t contain a link, ever.  

The same logic holds true for other carriers.  If you receive an unsolicited, unexpected message, it’s probably bogus.  If you want to see what real-world phishing attacks look like, UPS has an extensive list of examples on its website.  There are usually a number of tell-tale clues to betray a phishing message: logos that don’t look quite right, spelling or punctuation errors, or language that demands you act immediately.  

Links in the message will often be concealed under a button or clickable text, but if you hover your mouse over it, the underlying link will pop up (on a mobile device, a long press does the same thing).  A link going to a noncarrier website is a big red flag, as is a shortened link that obscures the destination site.  Unfortunately, even legitimate URLs can be spoofed using non-Roman characters that look right to human eyes but are actually grabbed from other languages (a so-called punycode attack).  Your browser protects you against this to some degree, but sophisticated attackers can still use this technique successfully. 

Dealing With Suspicious “Tracking Number” Messages

When it comes to unsolicited messages, there’s a simple rule everyone should follow: If it contains a link, it’s probably a phishing attack.  Period.  To stay out of trouble, never, ever click the link in a message.  If you’re legitimately expecting packages, that’s fine: Go to the carrier’s website, as described earlier, and check the tracking number manually (or call customer service at the number listed on the company’s website if you’ve received one of those “there’s a problem with your delivery” messages). 

That’s especially important with text messages because while most of us are understandably jaded about emails, we still tend to open texts.  By some accounts, we open up to 98% of texts and usually respond within minutes.  For scammers (as with legitimate marketers), that means putting their message in front of more eyeballs and increasing the chance of success. 

If there’s any doubt in your mind, you can use Spokeo’s people search tools to help verify your situation: 

  • Searching the email address or phone number of the seller you’re in contact with should bring back verifiable information about a real person or company.  If not, that’s a red flag.
  • If you’ve received a text or email purporting to come from USPS or another carrier, searching the email or phone number should show it originating with that company.  If it doesn’t, that’s a red flag. 
  • If Spokeo’s Phone Reputation Score shows a high likelihood of the number being fraudulent, that’s an obvious red flag.  If the number shows as legitimate, but the Reputation Score shows several recent complaints, that may indicate that a real number is being “spoofed” by scammers and should be treated with caution. 

What To Do About a Fake Tracking-Number Scam

If you’ve been victimized by a seller using the fake tracking-number ploy, grab screenshots to document the entire history of your transaction, and reach out to the carrier for more information on the real delivery that corresponds to your tracking number. 

If the shipping or delivery date doesn’t correspond to your order, or if the carrier can verify in writing that the delivery did not come to your address, you’ll have a stronger case for restitution.  This may require persistence on your part since the carrier is obligated to protect the privacy of the customer receiving the real delivery.

If you’ve received a phishing message, you should report it to the company it claims to come from.  In the case of the USPS, you’d email the US Postal Inspection Service; you can reach out to UPS and FedEx through their respective websites.  If you’ve fallen victim to a scammer through one of these schemes, you should also report the incident to the FBI’s Internet Crime Complaint Center (IC3) and the FTC’s Report Fraud website.  The latter is especially helpful because it will walk you through creating a personalized recovery plan to undo any damage. 

At the end of the day, these scams are relatively easy to thwart.  If you’re making a purchase, use Spokeo to verify the sender before you pay.  If you’ve received what may be a phishing message, don’t click the link.  Those two simple rules can save you a world of grief. 

Sources