Investigating Usps Quishing Scams: How Cybercriminals Exploit Everyday Shipping Habits
By Marcus Vance
The rapid escalation of postal service phishing prompted an updated FBI QR code warning alerting consumers that threat actors have combined traditional social engineering with automated infrastructure. The United States Postal Inspection Service (USPIS) points out that scammers rely on volume. By deploying thousands of text messages and door notices simultaneously, they inevitably hit consumers actively awaiting online retail orders.
During investigations covered by local news networks like Fox 59 and WREG, investigators recovered batches of fake delivery stickers distributed across major metropolitan areas. When analyzed in cybersecurity sandboxes, the embedded links initiated multi-step redirection chains. Rather than taking the victim directly to a static fraudulent form, the malicious link queries the visitor's device. Mobile devices are sent to an interactive web page cloned straight from the official postal site, complete with working navigational links to legitimate terms of service pages.
The capture mechanism happens behind the scenes. When a victim inputs payment data to pay a fictitious $0.45 redelivery fee, an automated script runs the card information in real time through illicit merchant gateways. The moment the transaction goes through, the cybercriminals have harvested both valid payment details and enough identity data to open secondary lines of credit.
Marcus Vance is a cybersecurity auditor and technology writer dedicated to educating the public about online safety, data privacy regulations, enterprise security, and emerging cyber threats.
