Our local FedEx once asked me for my details so they could be able to declare my package to the customs and in the SMS message they said that &quot;The sender is paying all declaration fees.&quot; I sent them my info and got my package.Then about five months later, I got a bill from FedEx for import fees, tax and service charges. Had to fight with FedEx for some time about it but eventually they agreed to void the bill. At this point in time, I have no idea if I paid the taxes when I bought the stuff, if FedEx paid them out of pocket or if the sender paid them out of pocket.

In this case the consequence is that the Australian government agency collecting the import tax doesn&#x27;t get paid. Which means that they don&#x27;t release the package to FedEx, and that you don&#x27;t get your package.FedEx needs to do a better job with these notifications. At the very least they need to hire a copywriter.

True, to a degree.  But let&#x27;s imagine that (1) FedEx felt that profits were more desirable than legal expenses, and (2) FedEx had some power over the sending and contents of the notifications.  Might FedEx decide to start following well-regarded standards for writing and sending legit-looking electronic notifications?  And iterate from there, as an ongoing strategy?

I think the answer here is &quot;don&#x27;t do things that are borderline (un)reasonable&quot;

You can spend as much as lawyer money as you want on arguing whatever nonsense you want, reasonableness is a common standard so sure, people will have spent lots of money pointlessly arguing about it but that&#x27;s not a problem with reasonableness.

Any time the law sets things like &quot;reasonable&quot; it&#x27;s a quagmire.For every utterance of &quot;reasonable&quot; in law you can be sure over $1B of laywer fees have been (or will be) spent.

&gt; then all financial and legal consequences of ignoring it are on the sender.They are, since non compliance will either result in destruction of the package or sending it back (differs a bit per country and type of goods).It&#x27;s a bit sad there are no easy ways to prepay taxes and it&#x27;s hit or miss if you get checked. I&#x27;m glad the EU figured it out and have almost no weird surprises any more, except from the Uniteds (states and kingdom).

I almost got in some trouble because of that. A &quot;bank&quot; I wasn&#x27;t a customer of kept sending me messages about &quot;urgent, answer this form with your personal details or we will lock your account&quot;. Seemed quite scammy to me.Then I later got a physical letter in the mail about the same, and then I called the bank. Apparently I had some account there holding some pension stuff from a previous employer. Shrugs.

A bunch of extra authentication factors and a password sure sounds like phishing for sensitive PII to me.

The management will overreact by implementing 100-factor authentication, requiring 30 letter password with mandatory Unicode symbols

Suggest Law: If a company&#x27;s electronic notification to you is so phishy that a &quot;reasonable man&quot; would have obvious cause to doubt its legitimacy, then all financial and legal consequences of ignoring it are on the sender.Edit: &quot;sender&quot; here refers to the sender of the electronic notification.

&gt; But in a modern day and age, when aren’t you expecting a package?When you’re not constantly buying things online. Most people in the world aren’t expecting packages “nearly 100% of the time”.

&gt; But in a modern day and age, when aren’t you expecting a package?Some people still prefer to buy most things directly in physical stores. For me, would be easier to list the few times when I am expecting a package. And even then, I&#x27;m expecting the package, not some random message about it; it usually arrives without any notification at all (and the tracking on the site is usually delayed).

I would be curious if FedEx specifically has some sort of leak though, it&#x27;s super anecdotal but I seem to get more FedEx phishing attempts when I&#x27;m expecting a FedEx package.You&#x27;re right though that there are other mechanisms for this, it was around the holidays when this happened most recently. Plus humans tend to remember salient things and I probably more easily forget the ones that come when I&#x27;m expecting nothing.Anyway, if their systems were better it would be easier to avoid scams without stress. I&#x27;ve never had to rely on external info for Amazon and it&#x27;s true I&#x27;m often expecting something from them.

What are you buying constantly? Apart from food and hygiene items, I mostly shop online. I feel I do order too much already, but the parcels are one every 1-2 months. Any more than that and the apartment would start filling up, I imagine.

But in a modern day and age, when aren’t you expecting a package?Nearly 100% of the time, I am expecting a notification from Canada Post or Amazon (FedEx less frequently, but still).Even outside of that, you can often predict when people are expecting a package. Christmas. After various sales weeks.

Maybe its just the hunan brain bad at perception, but I feel like there&#x27;s some system compromised and info is leaked so scammers know when you are expecting a package because FedEx&#x2F;USPS spam text increases.

Well theoretically they force people to Google FedEx which IS a strong signal for google people are interested in the FedEx Brand. Doubt however that&#x27;s the reason.

I doubt FedEx’s customer engagement increased by sending a query string with no domain or protocol. Someone’s asleep at the wheel here.

Maybe FedEx sees better results and gets more payments from appearing scammy? Scammers seem to do alright.I know we tech people think this is type of messaging is ridiculous, but I’m constantly pulling less technical friends and family away from crap like this. Half a dozen have asked me about Elon Musk’s crypto trading breakthrough.

You assume it is a singular person.Could easily be one person writing the message. Another who demanded partial edits in a Jira ticket. But then the data types didn&#x27;t match up with what the writer requested and then the dev didn&#x27;t want to deal with it and just shipped it.Or it could be that the message is made with a bunch of disjointed and constructed if statements and only the final output is piped to the customer. I have seen some very terrible log messages like that as nobody is looking at the entire message, just the little bit in the conditional they are editing at that point.As an anecdote, I once worked on code that generated these very detailed error messages about why something went wrong. I discovered most never made it to the customer as someone later down the line reassigned a variable rather than +=. Piles of support tickets could have been avoided.

Someone, a single concrete specific individual, must actually sign off on it and&#x2F;or authorize it with the SMS service provider.

&quot;The words&quot; are probably nested templates so that at the level of input it&#x27;s hard to really understand what the completed end result looks like. Also,  there&#x27;s many well-intentioned people in tech doing stuff that&#x27;s just a tiny bit too complex for them to execute by themselves without a buddy or a reviewer. There are also whole teams and departments at big enterprises where someone might not be doing it alone, and they might also not be completely incompetent, making them the star engineer on the team, while everyone else wisely keeps their mouths shut since they surely don&#x27;t have anything to contribute to the process. All the really good people that worked there, were snatched up by some fancy, greenfield project, on another floor, or got a position on some elite &quot;refactoring team&quot;, surely not wasting their time on updating templates.

&gt; I know this comes down to institutional incompetency&quot;Incompetency&quot; is an interesting word.The old maxim about incompetence versus malice suggests a binary
choice.I prefer the more nuanced take that there is a spectrum of positions
between the two, and other dimensions that describe a cluster of
intents, both conscious and unconscious.Take the UK Post Office scandal where we see incompetence layered on
top of malice, layered on top on incompetence. In some organisations
obviously deliberately harmful positions are written into &quot;policy&quot;.
Often this comes under &quot;PR&quot; [fn:1]. More and more &quot;AI&quot; will be used to
disguise malintent and deflect scrutiny.In the final episode of the ITV dramatisation [0], Alan Bates (played
by Toby Jones) delivers an absolutely shocking, knock down line. When
talking about incompetence and evil he says: &quot;They&#x27;re the same thing&quot;
At some point there is no difference between incompetence and
evil. For a deeper psychological discussion of that listen here [1].[0] <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Mr_Bates_vs_The_Post_Office" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Mr_Bates_vs_The_Post_Office</a>[1] <a href="https:&#x2F;&#x2F;cybershow.uk&#x2F;episodes.php?id=23" rel="nofollow">https:&#x2F;&#x2F;cybershow.uk&#x2F;episodes.php?id=23</a> (from 39:20)[fn:1] Edward Bernays seminal definition of public relations outlines
a creed of deception, manipulation and disinformation which is
antithetical to security [2].[2] <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Public_Relations_(book)" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Public_Relations_(book)</a>

Yep. It&#x27;s a bit like the theory that scammers mention they&#x27;re from Nigeria because they&#x27;re ingeniously weeding out all the people who&#x27;ve heard of the scam before, and not because they need an excuse for people to send money to Nigeria (and with their culture and education level the ALLCAPS and religious references look very official and honest indeed), and if the cost of that is that 99.99% of their emails don&#x27;t get delivered due to automatic filters protecting even the most gullible of recipients, well that&#x27;s probably not something they&#x27;ve given much thought to.

Some say scammers are very smart, and that they deliberately use every trick in the book to tap into our psychological weaknesses and make us act irrationally. But I have the feeling that, 90% of the time, scammers are just told to write an &quot;official-sounding&quot; message – which is the same thing that the hypothetical human who wrote this template was trying to do: that&#x27;s why the result is so similar. No doubt the use of the word &quot;urgent&quot;, or capitalizing the words &quot;Duty&quot; and &quot;Taxes&quot;, come from this attempt at making the message sound more formal and official, from someone who is definitely not a skilled writer.

I know this comes down to institutional incompetency, but at some point there was a singular human person putting the template content the SMS message in question was generated from into some computer system somewhere and I genuinely wonder what was going on in their head that made them string the words together in this way. You&#x27;d have to give it a true, earnest shot to make it worse.

I feel like DHL is the “YOLO” of delivery companies. My stuff always arrives, somehow, despite the entire process seeming archaic.

The FedEx one is meh and does afaik, but some (looking at you dhl) are almost useless as they provide little information (tracking info is hidden sometimes), sometimes do not allow you to add the parcel as it has a tracking code from a foreighn service which you cannot use and you have to figure out the local one, are full of &quot;news&quot; also known as ads and do not allow you to select the dropoff location closest to you (go ups!). Sorry, &#x2F;rant.

And buy a very expensive tracking device with frequent security issues?I am lucky to live in a country in which a large religious population eschews the smartphone, so saying &quot;I don&#x27;t have one&quot; is acceptable and common here. But I have colleagues who tell me that they are expected to have a smartphone from everything to banks to government services to simple small restaurants.

You mean everyone should install a piece of software from a company that appears to be ignorant about security?

Installing an app for every courier firm you might receive a parcel from seems a bit much.

Not that I’m endorsing the use of smart phones, but FedEx does have a mobile application. Why not just use that for notifications regarding deliveries?

Yet another reason why I will try to never use FedEx. UPS is so much better.Banks do similar dumb things. I once vented to a a Wells Fargo security manager about a similar issue. They had no defense at all.

Since the link to this podcast is in your profile, you&#x27;re affiliated with it, right?

Excellent example em-bee, thanks!  I&#x27;m writing up a blog post on this
subject, so more examples welcome plz.

My UK bank semi-regularly cold-calls me and ask me to authenticate by providing personal information. When I decline they readily tell me instead to call some number available on the bank website. So they not only are incompetent, they actually know it.

Even worse, is where attempts to query that security is actively punished.like this case: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=37250024">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=37250024</a>

Your security is increasing at risk from organisations and
corporations whose own grasp of security is appalling. Because instead
of dealing with it they externalise risks and consequences onto the
public and customers.Even worse, is where attempts to query that security is actively
punished.This is typical now. Listen here (at 42:20) with an example regarding
the UK NHS whose incompetence plays directly into the hands of
cybercriminals.[0] <a href="https:&#x2F;&#x2F;cybershow.uk&#x2F;episodes.php?id=24" rel="nofollow">https:&#x2F;&#x2F;cybershow.uk&#x2F;episodes.php?id=24</a> (time:42:20)

Ahh yes, the FedEx GST payment system is wonderful!You can find that number in the sms on an official FedEx page somewhere or other - I ended up using that as enough evidence to trust and call.I get the feeling this system as a whole doesn&#x27;t see much use - from a FedEx perspective, the vast majority of people paying duty will be via some specialised importer, not b2c direct.

Clearly the safer option is sending the terms via CD<a href="https:&#x2F;&#x2F;t3n.de&#x2F;news&#x2F;sparkasse-digital-strategie-cds-per-post-verschickt-1453537&#x2F;" rel="nofollow">https:&#x2F;&#x2F;t3n.de&#x2F;news&#x2F;sparkasse-digital-strategie-cds-per-post...</a>Since no-one has a CD drive in their computer anymore, the security risk is negligible

There&#x27;s a reason why infosec is hard and why there&#x27;s a hiring shortage.

I will simply refuse to believe this is real. As a psychological defense mechanism.What the hell.

I&#x27;ve never heard of this &quot;EU law&quot;. Which one are you talking about? I live in the EU and my bank pretty much only contacts me through email.

There&#x27;s an EU law demanding such documents to be delivered on a &quot;durable medium&quot;. Some banks and financial institutions may have a strange approach to those, even though email attachments seem to be enough for others.

My bank offers that and I use it to store backups of important files.

Some German banks created paid storage service with multiple plans available. They are required to deliver documents to their customers but managements have massive brainfuck about the requirement and the most absurd solutions and ideas are being sold to them.

i love this comment:ich arbeite als (externe) CyberCyberCyber Nase in einer Organisation irgendwo in der Sparkassengruppe. Ich kann dir versichern, dass niemand, der auch nur im entferntesten was mit InfoSec in der Bank zu tun hat, von dieser Marketing Idee erfahren hat.&quot;I work as an (external) CyberCyberCyber nose in an organization somewhere in the Sparkassen-group. I can assure you that no one who is involved even the slightest with infosec at the bank, has heard anything about this marketing idea.&quot;

Hey at least it&#x27;s 100% safe from a hacker who has broken SSL&#x2F;TLS altering the terms and conditions on the wire.

If you give me your mailing address, I&#x27;ll arrange it that the bank will mail you one, too.Just be sure to use the included NOTVIRUS.EXE viewer for best experience.

Man, this is just a marketing gimmick. I am always short in USB sticks. So, could have gotten another one.. How about a little bit more of humor?

German IT is weird, German bank IT doubly so.

(translation provided by ChatGPT)&gt; Terms and Conditions, Price and Service List, Conditions.&gt; Dear customer,&gt; our price and service list, our terms and conditions, as well as further conditions which will come into effect on May 1, 2024, can be found on the USB stick.&gt; With kind regards,&gt; The Sparkasse Bremen AG

I found a Reddit post today about a German bank mailing USB sticks containing their new general terms and conditions: <a href="https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;de&#x2F;comments&#x2F;1ax7ky3&#x2F;milde_interessant_die_sparkasse_schickt_mir_einen&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;de&#x2F;comments&#x2F;1ax7ky3&#x2F;milde_interessa...</a>You can&#x27;t make this up.

&gt; What makes this situation so ridiculous is that while we&#x27;re all watching for scammers attempting to imitate legitimate organisations, FedEx is out there imitating scammers!Hah!

What concerns me is that this mentality of erecting infuriating
barriers will eventually lead to direct in-person stalking of staff.If anyone has honest anecdotes around this I&#x27;d love to hear from you
(maybe privately is best if its detailed accounts)

Wow. Just wow. Troy Hunt does an incredible job of calling out this utterly piss-poor performance from FedEx. Shame it needs somebody with a platform like this to draw attention to it. They should find a way to make them somehow more liable for fraudulent losses.It&#x27;s gotten to the point now where it sometimes actually is impossible to speak to a human being in customer service - the thick layers of chat bots, deliberately gated &#x27;contact us&#x27; pages and &quot;why not use our app&quot; nags.. ..if you&#x27;re savvy enough to know already that only a human can resolve your particular query, getting hold of one can become a time consuming and sometimes traumatic experience. (only slightly tongue-in-cheek, I do actually believe this affects mental health)

In a case I read (can&#x27;t remember where), reservation data was somehow leaking (either from booking or from hotels), and scammers were sending messages purporting to be the hotel saying the room was cancelled or mischarged or something like that.

<a href="https:&#x2F;&#x2F;amp.theguardian.com&#x2F;money&#x2F;2023&#x2F;oct&#x2F;23&#x2F;bookingcom-customers-targeted-by-scam-confirmation-emails" rel="nofollow">https:&#x2F;&#x2F;amp.theguardian.com&#x2F;money&#x2F;2023&#x2F;oct&#x2F;23&#x2F;bookingcom-cus...</a>

The Booking.com scams look better than the actual &quot;Self check and pre payments solutions&quot; links send via the Booking hotels.1 time I was right it is a scam, 2 times it was wrong.Booking.com should make a proper report payment circumvent button and kick out all hotels who do it.

FedEx seems to be the worst option domestically too. Maybe it depends on your location but they&#x27;re the only service that somehow fails to deliver signature required packages to my mail room. I&#x27;ve also tried to have them contact me directly while I wait at home and I&#x27;ve tried to waive the signature requirement online, but they still just say &quot;delivery attempted&quot; for 3 consecutive days and then hold stuff at their warehouse. Happened to me twice recently. I now try to avoid buying anything expensive that uses FedEx to ship.A funny thing I discovered in this process is that &quot;delivery instructions&quot; are shared for all packages to a given address regardless of the associated name, and never flushed unless you go in and do it manually on their website. I found the name and contact information for the prior tenant of my unit on the FedEx site with no other info besides 1 tracking number to the address (it also let me change the delivery instructions with said info). Potentially they were still calling that person when they tried to deliver initially, though I have other reasons to doubt they actually came to the door that day.

One out of ~10 international shipments of records I had in the last year one was from FedEx and they sat on it in their out for delivery warehouse in a nearby town for two months with the usual pass the buck&#x2F;pillar to post treatment. The extra fees plus customs they put on added up to 40% of the value of the items as well. DHL and UPS arrive within a week and are normally no higher than 25%

My best theory is that FedEx outsourced the process of sending these SMS notifications to some external contractor.Of course, the scammers already have the scam systems in place, so they can win the bid on price :DI know this sounds ridiculous, but I doubt anything will make better sense than this :P

I wanted to, but I could not find it. It turn out I could not see the &quot;report phishing&quot; button because of an Outlook glitch. Thanks Microsoft.

FWIW, I did exactly that a few times where I was 90% certain the e-mail is legit, but it still looked like a phishing attempt. The IT department needs to learn to do better, this is inexcusable, especially in a corporation with otherwise restrictive policies that waste ridiculous amounts of money and effort (think: Windows Defender real-time &quot;protection&quot; on developer machines, with no way to exclude your repos).

This is even worse in companies that have security offices actively sending out phishing emails worded as internal emails from your company that shame you if you click any of the links in them.email is well and truly dead.

It’s a good idea.I am usually a bit pessimistic about it though. If their SOP doesn’t account for “looks like phishing but is from internal sender” then chances are that nobody connects the dots and informs that sender.The intelligence of a small and motivated IT team seems difficult to scale.

Did you click on the &quot;Report Phishing attempt&quot; button installed by your IT center in your mail client?Sorry for the probable sarcasm. In a company that size, if the IT center does not provide a means to report phishing attempts then there are more serious problems than a dodgy email campaign.

&gt; The same guys also force us to change our passwords every 6 months and block the last twentyIt&#x27;s good we have 26 letters, that comfortably leaves you a margin of 6 combinations :-)

&gt; I think IT incompetence should lead to audit fails or even better delisting from exchanges.Fear of policy is why you get things like &quot;force us to change our passwords every 6 months and block the last twenty&quot;. Getting a central arbiter of IT competence is a hard problem.

Is blocking the last 20 passwords a bad thing? I agree the other stuff is bad, but to me, that part doesn&#x27;t seem bad.

I forget who puts that stuff out NIST&#x2F;STIG(?) but IIRC in the recent few years they determined that rotating passwords like that was basically security theater and wasn&#x27;t worth the damage to the staffs productivity

&gt; The same guys also force us to change our passwords every 6 monthsWhile I know this may be fruitless, it might be worthwhile to point out to them that the official guidance from NIST and similar organizations is now not to do this.The IT department where I work required yearly password changes up until I brought this change to their attention, at which point they changed to simply recommending a password change if you have reason to believe it might have been compromised.

The lack of use of a non-corp domain, the typos and the use of shortened links does sound like a form of incompetence, probably at the management layer.However, the password rotation requirement was until relatively recently something that many IT auditors would actually recommend, even though it leads directly to bad user password choices. In fact I wouldn&#x27;t be at surprised to learn that was still the case in a lot of places.

&gt; have to type 10-20 per daySame problem here. My solution: Get a mouse with internal memory for macros, such as Natec Genesis GX78 (old, no longer available, but this is an example). Program your new password on one of the unused mouse buttons or in a different profile. Use the mouse to type the password.

I had a similar experience at an old company that used M365. YMMV but with Bitwarden I generate passphrases like Pregnant-Guppy-Skateboard9 and it made it tons easier for me to type 20x a day than &amp;7UoTod#$7OOD

My work password now has an &quot;18&quot; embedded somewhere in the middle of it thanks to my autoincrement approach to handling that kind of obnoxious policy.Then I became CTO and retired the policy to align to modern NIST recommendations, so that &quot;18&quot; is in there forever :)

I&#x27;ve noticed that Microsoft themselves aren&#x27;t helping this right now. M365 seems to default to using random-tenant-guid.onmicrosoft.com for a lot of these transactional emails like password changes even though the official account.microsoft.com is fully multi-tenant aware and most Microsoft guidance tells you to always go directly to account.microsoft.com. These transactional email mistakes seem like another case of Microsoft accidentally exposing problems in their org chart to external customers. I imagine it has something to do with the wild rewrites from old Azure AD to new &quot;exciting brand&quot; Entra ID and other such shenanigans combined with Microsoft&#x27;s willingness to bend over backwards to bad IT administrators and letting them set bad defaults (such as &quot;just us the .onmicrosoft.com GUID instead of a real domain&quot;), because companies love to pay them good money for the &quot;control&quot; to do stupid things in Group Policies and corporate configuration.Combined with the fact that the largest single source of spam I&#x27;m seeing right now is also coming from random tenant GUIDs .onmicrosoft.com (is Azure really missing that much SMTP security for random M365 tenants?) and this sort of corporate anti-training users to follow bad transactional email links, it certainly feels like we are in a perfect storm of M365 phishing.

The Walt Disney Company did exactly this when I was there, and everyone dreaded it. Did nothing but waste time.

&gt; Guess the average strength of an employee password!It is interesting how sometimes creating &quot;more secure&quot; measures results on less security. Our IT department decided that using 2fa for vpn is not enough, we should also extra 2fa for connecting to the webmail even through intranet or vpn. Guess who stopped using the vpn.Meanwhile, one can set up and use our email through any email client app on desktop or mobile without any 2fa at any step. Go figure.

Our IT did the exact same thing with expiring m365 passwords. They weren’t using the corp domain, typos all over and the URL was obscured using a bizarre link shortener.The same guys also force us to change our passwords every 6 months and block the last twenty. Passwords we have to enter in systems that can’t pull directly from password managers and thus have to type 10-20 per day. Guess the average strength of an employee password!I think IT incompetence should lead to audit fails or even better delisting from exchanges.

Our government uses equivalent of www.mydatabox.cz (real one is mojedatovaschranka.cz).Literally a domain that looks like from teaching material for phishing, no databox.gov.cz or something like that.The domain is for an official legal documentation communication with government and has same legal weight as letter that was person delivered and recipient was checked against ID.

I’m supposed to pay my semi-annual property taxes (on the order of ~thousands of USD) on a site that ends in .org instead of .gov, and nobody apparently sees anything weird or wrong with it.

Yeah I got a text from one of these a couple years ago. Something like. “You have an overdue doctor bill of $183.56, please kindly pay immediately at this link: <a href="http:&#x2F;&#x2F;my-doctorpay.net&#x2F;defintelylegit123" rel="nofollow">http:&#x2F;&#x2F;my-doctorpay.net&#x2F;defintelylegit123</a>. Thx!” Didn’t even include the name of the doctor or office, but after calling the only doctors office I had used recently it was apparently legit. I let them know whatever company handles their billing is completely incompetent.

Worse every doctor&#x2F;lab sends their own separate bill with their own separate account numbers and URLs.  You could probably make a ton of money just a bill to every address in your city, so long as the amount is around $50 many will not question it anymore as they get so many of those things.

Lets not forget all the typosquatting looking domains Microsoft uses. It almost seems like they bought them up to protect users, forgot why they did that and said &quot;hey we have all these domains, lets use those?&quot;

To be fair, US healthcare billing companies aren&#x27;t very far removed from scammers in the first place.  Except most scammers are more ethical.

Healthcare companies in the US send the most scammy looking links for payment processing you’ve ever seen - things like my-healthcare-billing.netIt’s insane.

Regarding the external domain thing, I can say that dealing with domains in a big company gets about as bureaucratic and terrible as just about everything else; I experienced this myself - at a youngish company when I needed a new sub-domain off the big official domain, it was just talk to $dude on the DNS team and he’ll help you out. And he did. A few years later once things had “grown up” a bit, I needed to update a record and I asked the same guy. He told me I needed to fill out a 25 question form and they’d review it. I about half copy and pasted it from another team member’s project and they accepted it.Obviously it doesn’t excuse the practice, but I can see why people use alternative domains to get things done. The above anecdote was also purely within the company; I’m sure that if you add in a partner&#x2F;managed service, it only amplifies the complexity.

I love how those emails have extra metadata in the headers like &quot;X-Phishing-Test: True&quot;

If I saw one of those in a 100k employee company I&#x27;d first just assume it&#x27;s a phish-test email and that anyone who clicks on any URL in it is going to get put in the list for remedial training.There are, of course, a whole plethora of services that a CTO-type person can hire to phish test your employees. Some of them even have several hundred real domain names with live MX on them that you can add into your office365&#x2F;gsuite mail flow permit-list controls, as an admin, to ensure that the phish test arrives correctly in peoples&#x27; inboxes.

I report those as phishing in order to get the feedback to the IT team who sent them from their colleagues in infosec. (I often have had IT and infosec reporting to me, which makes this even more effective of a feedback mechanism. :) )

Yeah, was working for a (then) 15k employee company and got an email &quot;You have expenses due&quot;. Blank content, PDF attachment. I hadn&#x27;t initiated any payments (but it later turned out the bank had just charged the annual tax on my corporate card account)Ignored it.Later got my manager asking as the expense team had been chasing down managers of people with overdue reports.

My company does that too, it&#x27;s really annoying. They also sometimes send out mass emails for things like surveys but link to some third party service. I&#x27;ve even seen them put, in the email, things like &quot;the link goes to a trusted third party and is perfectly safe&quot;. Why should I trust that if I&#x27;m already suspicious of the emails legitimately?

Our last round of security training was roundly mocked by our software division, especially around the subject of one of the rules emphasized over and over being to &quot;never click URLs in emails&quot; and the sign-in process for the website alongside the distribution of lessons was done exclusively through magic links... in emails.Our CEO is actually a developer himself on our core product (and a bit of a paranoid fella on the cybersecurity front to boot) and he was absolutely furious about this vendor being chosen...

M365 has an option to rewrite URLs in incoming emails.  It&#x27;s horrible, at least for people that can actually read URLs.  Every link turns into a 300 character mess that I have no idea if its valid or not.  The only way to tell is to click it.  Maddening!

My company&#x27;s security training tells me to carefully verify any URLs in received emails, but then they have some security software that rewrites all the URLs in incoming emails - presumably as a way of screening them themselves.This might be a reasonable trade-off for centralising monitoring, but it significantly hampers the ability to judge the legitimacy of emails myself. At least update your training!

I flip tables when people make offhand requests like this. Infra teams are not keyboard monkeys with admin creds.

When I worked at Sun Microsystems, they had a clever launcher shell script dealie for things like StarOffice documents that did usage tracking, portability fixes (usually setting obscure environment vars), and of course downloading and opening the actual document. Then they started sending those shell scripts as email attachments. One day they sent out an email telling people to not open executable email attachments: the full memo was a SO document wrapped in one of these scripts.To their credit, after the inevitable replies to that email they never used that wrapper again (they moved the launchers to the centralized NFS install where they always should have been)

On our company (hosting &amp; PaaS), I was contacted on our internal messenger by a person I&#x27;ve never seen before, asking me to &quot;please&quot; run some commands as root and send back the results. After the initial shock (and due infosec diligence) I found out it was just &quot;the new guy&quot;, needing to collect info about our systems for equipment inventory purposes. Since they didn&#x27;t have access to our networked management tool yet, and didn&#x27;t know the finer points about how running `curl ... | sh` randomly is not a good idea, they thought it would be ok to get that information piecemeal directly from people.It happens.

&gt; Well, they said they often call from numbers they haven’t listed online.Worth noting - do not trust the incoming callerid number. This is trivial to fake.

Banks do this as well. I made a purchase, and within minutes got a very scammy looking e-mail from them - low quality gifs, asking me to click on links to a random non-bank website(something like purchase-verification-users.net&#x2F;235532&#x2F;confirm.html, and the site wasn’t coming up on any searches). At the same time I get a call from a random number asking me to go over some purchases - I looked up the number, and it’s none of the ones listed for my bank.So I hang up and call my bank directly. I spend 10 minutes going through the phone maze to talk to someone. Finally I get to them, and they confirm that is a number that they use to contact people. How come when you list numbers on your website you don’t list this one? Well, they said they often call from numbers they haven’t listed online. How about that e-mail, do you send those? Well, we sometimes contact people by e-mail, if it says it’s from us in the from: line you can click on it. Did you guys send that one? I don’t have that information; don’t click on it if the from: line isn’t us, but if it is, go ahead.

Similar unforced error: I got emails from healthcare.gov for required actions on the site&#x27;s marketplace. But the links used the lnks.gd shortener, hiding what domain you were actually going to end up at! They&#x27;re encouraging people to blindly click on links with no idea where it takes them!What&#x27;s worse, you can&#x27;t even go to the lnks.gd root to check where a shortened link is going. And the &quot;shortened&quot; link was actually longer, with all the payload crap they rolled in. They could have just used the normal url plus small internal identifier of which email it was if they needed to track it, and it would have been shorter.There was no reason to use a shortener, let alone such a shady one!

The company I work for has a service that sends phishing test emails to everyone that you are supposed to report. I take great joy in reporting every legitimate email that is at all sketchy just for the inevitable email back from the security team informing me that they reviewed my report and it was indeed a legitimate email.

A few months ago I got an email from the IT center of the company I work for that was dodgier than any phishing email I have ever received:- Coming from a domain that looks nothing like the official domain of the company, rather some generic @itservice.com or something.
- Subject: &quot;URGENT: your account is expiring soon&quot;.
- Multiple links provided in the email body, all illegible and multiple lines long, none of them from a domain that I can immediately link to the company.
- No alternative way of resolving the issue is provided other than clicking on one of those links (no &quot;go to your account settings&quot;, &quot;contact your line manager&quot; or so).And still, it turns out it was real.~100k employees company btw

Okay, but this isn&#x27;t a bulk email. It&#x27;s a very specific situation personal to the receiver and will never be sent to anyone else. (Obviously the template will be used for multiple emails, but that&#x27;s not what defines a bulk email, even though bulk emails can also be defined using a template.)

So use a different domain for corporate email. The only reason not to is if you are prioritizing the identifiability of your corporate email over the identifiability of your actual customer-facing operations.

It is.If they use their main domain, their normal corporate email will get blocked by anti-spam filters.So everyone uses a different, unrelated domain for bulk mails.

Corporates are shockingly incompetent at this sort of stuff.Seriously just use your main domain for URLs. For me at least that clears up 99% of this.I dont want to memorise a list of valid mystery domains for each shipper. Is that really too much to ask?

The national insurance providers are often pretty slow or shady when it comes to claims, but I&#x27;ve never had a bad experience with Allstate or State Farm when it comes to their cybersecurity and domain experience. Allstate&#x27;s frontends (web and app) sometimes feel more clunky but their APIs feel good enough and sites seem to follow good design practices.

Happened to me with my mortgage. Got this very weirdly phrased letter about how my homeowner insurance info needed to be updated&#x2F;confirmed and that I had to go to &lt;random website&gt; to clear it out.I called my insurance broker and yes indeed it was legit. I also tried to explain to them how this letter was a few steps removed from a Nigerian prince scam based on all the red flags, but i don&#x27;t think it made a big difference.

When I bought a car once, I received an email a few months later saying I hadn&#x27;t proven I had obtained insurance on it, and the bank wanted me to visit a domain that wasn&#x27;t theirs to provide proof.The email I got looked like a badly-scanned letterhead and was very, very fishy.After I received a few of them, I finally contacted the bank and it was legit.I tried telling the office person (not just a clerk at the counter, someone with their own desk) about the situation and they couldn&#x27;t understand why it was bad.I soon paid off that loan and got away from that bank.

Phishing and workflows like this are handled by the same profile of employees. Low paid, outsourced, hating their job, doing the least possible. That&#x27;s why they&#x27;re indistinguishable. Reliable workflows, record profits, high salaries and bonuses for executives - pick two.

Found it here.<a href="https:&#x2F;&#x2F;i.blackhat.com&#x2F;us-18&#x2F;Wed-August-8&#x2F;us-18-Shostack-Threat-Modeling-in-2018.pdf" rel="nofollow">https:&#x2F;&#x2F;i.blackhat.com&#x2F;us-18&#x2F;Wed-August-8&#x2F;us-18-Shostack-Thr...</a>He used the term &quot;scamicry&quot;: legit communications that mimic scams. For example when a company calls you directly and asks for your security details, but offer you no way to verify who they are first.

Anyone found this? Can you remember the episode?

In a Blackhat talk several years ago Adam Shostak had a clever term for companies interacting with you in ways that were indistinguishable from scammers.But I can&#x27;t remember what the memorable term was.

I have received SMS mostly a day after I ordered something of Amazon. I&#x27;m not often ordering something, so sometimes I go weeks without scam SMS.

Does not answer your question, but related:In Finland you can declare DHL&#x2F;UPS&#x2F;Fedex packages yourself with customs and pay directly to them, with no fees to carrier (it took a Finnish Competition and Consumer Authority decision in 2017 to get rid of the fees, though). But this is a bit different as it is not a hidden option but standard procedure (though you still get the option of paying the carrier to declare, instead).Declaring inbound packages to Customs by yourself was already the standard here for postal parcels even before Customs internet services, so this was not a completely new way of working.

I&#x27;m in Portugal. If you put enough pressure, they release for you to process, it is the law.

I&#x27;ve often felt frustrated by the processing fees. Can you elaborate on handling this yourself? Which EU country are you based in?

The processing fee is as high as $35 when the taxes are as low as $10, and then you get charged tax on the fee too!CBSA should require affirmative opt-in to use the shipper as the broker, and allow you to file the paperwork yourself on their site.

Same in Canada, though, if I understand correctly, you have to visit a customs checkpoint in person to make a declaration: <a href="https:&#x2F;&#x2F;goingawesomeplaces.com&#x2F;how-to-avoid-paying-ups-brokerage-fees-in-canada-self-clearance-instructions&#x2F;" rel="nofollow">https:&#x2F;&#x2F;goingawesomeplaces.com&#x2F;how-to-avoid-paying-ups-broke...</a>

This. They have been paid to ship an international package. Billing the recipient for delivery is just dishonest. I assume they do it, to make their price for the shipper look artificially low.For this reason, whenever possible, I choose delivery through the post office.

DHL, FedEx, and UPS are experts in overcharging to process a form and not caring about customers. Duty and VAT are usually low compared to this processing fee, and shipping has already been paid. Here is the catch in the EU, this simple duty form can be processed by the receiver, an agent (some related to the carrier), or an attorney-in-fact of the receiver. The big three carriers (and many others) threaten you if you refuse to use them.At the end of the day, they don&#x27;t care if we get phished or scammed; it is all of customs confusion. Next time process your customs form, you will realise how much money you will save, and the form only has less than 8 fields, the Union Customs Code is easy to read.

Obviously just call the totally normal support number shown 1 800 111 112  &#x2F;s

I&#x27;ve had this, but the first thing I heard was that my customs charge was sent to collections. Cue lots of scary messaging about debt collection, none of which said anything other than this was for a FedEx parcel of some kind

This is common practice for some businesses.If you ever drive on a toll road in Texas (there are a lot of them and more every year) there are no toll booths that allow you to pay then and there but you&#x27;ll get a bill in the mail 6-12 months later informing you that this is your fifth and final warning and you owe $4 for the toll and $80 in late fees. I guarantee you the people behind this have friends or family in the Texas legislature supporting them.

This fits nicely with my experience of FedEx. They sent me a bill 7 months after I had received the package. A few days later I get a reminder that doesn&#x27;t include the necessary information for payment, which seems rather lazy and stupid since an unpaid bill might well have been lost. It refers me to www.fedex.com where I&#x27;m told to create an account. I do that only to find it doesn&#x27;t know anything about my bill. By chance I do find the original bill shortly afterwards. Turns out this bill sent 7 months late had very small text saying &quot;to be paid immediately&quot;, the first time I see that on a bill (it&#x27;s usually 30 days in my country). Of course they sent me a second reminder 10 days after I paid.

Why didn&#x27;t he email the address provided in the SMS, which will obviously go nowhere else other than to FedEx?

Reminds me of the mess that the LTA are in the UK regarding getting Wimbledon tickets.Over the years they&#x27;ve changed domains several times, had a breach, reset passwords multiple times, and now do part of their login via a random third party site (but to make it worse they push you to sign you up to a second form of account which logs in separately!)

Well, the marketing person who came up with message can pat themselves in the back because you bet the engagement on that one was thru the roof.

The biggest banks and brands in India as well as the government organizations do this type of poorly thought communications all day.The other day an email from the oldest and biggest bank of India landed in my inboxTruncated Subject line on mobile said &quot;Cash Withdrawls made ...&quot;My heart skipped a beat because I did no such thing with my account.Turns out it is a marketing mailer with subject &quot;Cash Withdrawls made Easy!&quot;Facepalm.

They get a significant markup for providing this &quot;service&quot; to the receiver, so it is not in their interest to help the sender. More charitably the actual duties to be paid might not be known until the package reaches the border at destination.

&gt; crazy that FedEx doesn’t have the info attached to the trackingIt is crazy how much the &quot;paying duties at the border&quot; situation feels like an afterthought for all currier companies. It is almost as if it was not really their design they just tackled it on later.I wanted to send a present to my brother in an other country using DHL Express. It was impossible to convince them that I would like to pay duties. Not a thing. Can&#x27;t be done.

So far every time I’ve gotten dodgy AF texts or emails I’ve been able to verify at the real site… crazy that FedEx doesn’t have the info attached to the tracking.

BS. Many countries have successfully implemented SMS sender registration&#x2F;verification schemes. See for example here for a list: <a href="https:&#x2F;&#x2F;support.sms.to&#x2F;support&#x2F;solutions&#x2F;articles&#x2F;43000562659-international-sms-sender-id-regulations-and-requirements-list-of-countries-" rel="nofollow">https:&#x2F;&#x2F;support.sms.to&#x2F;support&#x2F;solutions&#x2F;articles&#x2F;4300056265...</a>The details differ per country, but either all non-registered senderids will be blocked, or registered senderids will be allowed only from authorized sources. The degree of mandatoriness varies also, in some places its mandatory for telcos to comply, in other places it is some voluntary cooperative scheme.But despite such details, the problem is clearly not completely intractable.

This will never work as long as calls and SMS messages are routed over the existing telecom networks. The infrastructure is simply too insecure to enable this kind of scheme.If calls are routed over internet then it becomes more viable but obviously there is still a large coordination problem and misalignment of incentives.

Relevant as article was about Australia: <a href="https:&#x2F;&#x2F;www.acma.gov.au&#x2F;articles&#x2F;2024-02&#x2F;five-telcos-breached-allowing-sms-scams" rel="nofollow">https:&#x2F;&#x2F;www.acma.gov.au&#x2F;articles&#x2F;2024-02&#x2F;five-telcos-breache...</a>

There really needs to be some kind of cryptographic authentication system for text messages and caller ID that gives the recipient absolute certainty about the identity of the sender. Registering a name in this system should require real-world proof of identity including a business address and the contact information of real people. There should be serious financial penalties for identity fraud. It should be an open standard that can be implemented in open source software. And all the big phone manufacturers should be legally compelled to use it.

I might misremember the last time I had to pay duties, then. Still, 10$ is much more reasonable than UPS&#x27;s 70$ plus taxes!

&gt; And they don&#x27;t add any fees, you just pay the duties and taxes.Are you sure about this? Canada Post&#x27;s webpage (<a href="https:&#x2F;&#x2F;www.canadapost-postescanada.ca&#x2F;cpc&#x2F;en&#x2F;support&#x2F;articles&#x2F;customs-requirements&#x2F;customs-duty-taxes-and-exemptions.page" rel="nofollow">https:&#x2F;&#x2F;www.canadapost-postescanada.ca&#x2F;cpc&#x2F;en&#x2F;support&#x2F;articl...</a>) says:&gt;&gt; We apply a handling fee of CAN$9.95 per dutiable or taxable mail item.

Canada Post actually does something good here: you can pay from the tracking page. And they don&#x27;t add any fees, you just pay the duties and taxes.

Here dutch customs doesn&#x27;t even send you links for this stuff over SMS due to all the spam.They tell you to look up the package tracking number on the PostNL (the national universal delivery company) where you can pay for it. All you get over SMS is a heads-up to check and the ID to enter (you need to combine it with your zipcode).

My company uses an outside vendor for security training that requires us to login using company credentials.The outside security vendors also run phishing security campaigns that they send out from their own domain, and that have &quot;phishing&quot; URLs that point to the same domain we do the training on.I got reported as being phished for following a link that goes to the SAME domain as our required security training. Our security compliance team got my point when I reported every required training reminder as coming from a known phishing domain.

At my company, they announced that in the upcoming month there would be an internal phishing sensibility campaign.
Then, in the same month, they started sending out incredibly dodgy looking emails to &quot;security training&quot; provided by an external website.
Of all emails, those looked the most like phishing but they are not. I decided that I refuse to do this training completely because to me it seems crazy how that was coordinated. I would never lose my job over this but it is amusing that I get an &quot;Urgent: security training still outstanding&quot; about once a week which just goes straight into the trash.

Text message from my mobile carrier:Be careful! Never click on links received in messages from strangers. Learn more at www.....

The other thing I try to understand but just can&#x27;t is how Telco providers can be so incompetent in effectively stopping scam texts.First of, texts are not encrypted and they can see ALL communication.On the other hand the US forces me, using Twilio for SMS automation, to sign up &quot;campaigns&quot; with &quot;Sample messages&quot; if maybe all I want to do is building a personal assistant with text commands. My messages will get hit with fees for non compliance, or end up silently blocked without any visibility.Then there are these scammers sending the same or very similar messages to millions of people, pretending to be the same 50 companies (national banks, shipping companies, cell phone carriers) - how about these $bigcorp register their &quot;campaigns&quot; to combat scams and they&#x27;ll leave me alone (one number sending texts to always the same one or handful of numbers).... Oh wait I figured it out! Telco don&#x27;t care, they enjoy inflated traffic numbers in their network and charge for it - why would they stop it

I definitely would have called on that one and tried to avoid the whole link altogether.

I received once a mail from my bank at the time stating that they have a message for me, but for security reasons I have to read it on their systems. And they provide the following link: <a href="https:&#x2F;&#x2F;cbk.pwlnk.io&#x2F;~hc" rel="nofollow">https:&#x2F;&#x2F;cbk.pwlnk.io&#x2F;~hc</a>The bank&#x27;s name is CaixaBank. I was wrong and the message was legit. My first thought was it was a scam :)

I frequently buy things from Tokopedia, one of the largest e-commerce in Indonesia.At one point, I ordered something, and the next day, someone contacted me through WhatsApp, claiming to be from the courier (with the company logo as a profile picture). They said my package was rerouted, and I had to click a link to fill out some form. Typical scam message, with typo and urgency. I can track the status of my order in the app, and it says it&#x27;s in transit somewhere. So, their explanation matches.You might think, &quot;Well, that&#x27;s obviously a scam. They would not contact you through personal WhatsApp!&quot; But sometimes couriers DO contact you to ask for your precise location or notify you, &quot;Hey, I left your package with your neighbor. Here&#x27;s the photo.&quot;I&#x27;m just wondering how the scammer got this info that Mr X is expecting Product Y from Shop Z. I almost fell for it (I was in the middle of something and got distracted), and I can only imagine the unlucky victims.It happened 2-3 times during that period and then gone. Did someone find out and fix it? How did they find out? Because I&#x27;m guessing there are lots of hands involved in the delivery pipeline.

One time working at a bigger company I received an email that was a very, very obvious, poorly made phishing attempt - in fact, so poorly done that I wondered if I could break the login form somehow. So I submitted bogus data to see what happened -Turns out it was part of some kind of &quot;test&quot; of the company to raise awareness for phishing, and I failed the test since I submitted the form.

Reminds me of the &quot;householdresponse.com&quot; domain quite a few people in the UK have been exposed to at one time or another...<a href="https:&#x2F;&#x2F;www.bleepingcomputer.com&#x2F;news&#x2F;security&#x2F;uk-gov-keeps-repeating-its-voter-registration-website-is-not-a-scam&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.bleepingcomputer.com&#x2F;news&#x2F;security&#x2F;uk-gov-keeps-...</a>

In illustration of the prevalence of the phish, I got a dodgy SMS from a sketchy email address that &quot;The USPS package has arrived at the warehouse and cannot be delivered due to incomplete address information.&quot; while I was reading the article on my phone.

The number of &quot;Please click this Microsoft Sway link for an important update&quot; emails that I get these days ... sigh. So far they&#x27;ve all been legit (although rarely important), but if I ever go over to the dark side, that&#x27;s what my first phishing campaign will look like.

This is a real problem with so much stuff outsourced to external cloud providers.  Used to be, if it was from the company intranet, no problem.  Now every survey, every training thing, every new flavour of the month is from external mystery domains and then it wants your corporate credentials to log in.  At my company they keep us sharp by running &quot;fake phishing&quot; campaigns to kind of gamify recognizing phishing emails. But this shouldn&#x27;t be necessary for legitimate corporate stuff.

<a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Cash_on_delivery" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Cash_on_delivery</a>There are also import duties in some places like the US that can be a surprise if you don&#x27;t know where the seller is or how they&#x27;re shipping: <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Customs_duties_in_the_United_States" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Customs_duties_in_the_United_S...</a>I forget the name, but the USPS has a special service shippers at companies like Aliexpress often use to avoid stuff like this when shipping to the US.

The EU and UK have systems to allow the tax to be paid when purchasing, for large companies that support it like Ali Express. These are fairly new.Countries also have their own limits below which they don&#x27;t bother with the taxes. There was so much abuse of this in the EU+UK the limit is now zero.The only time it should be surprising is when the foreign website isn&#x27;t paying the taxes, and it also isn&#x27;t clear it&#x27;s a foreign site. Generally on cheap crap from China.

Absolutely. That&#x27;s very often how customs works. As a general rule, the sender is responsible for postage, while the recipient is responsible for customs, and the package only gets released to them once they pay it.But many times there are no customs fees, so there&#x27;s no issue -- it depends entirely on the pair of sending and receiving country and the category and amount of merchandise. That may have been your experience.Generally speaking, customs can&#x27;t be charged upfront with your order. Perhaps there are exceptions with certain delivery services in certain countries which have managed to modernize some of it, but I haven&#x27;t come across that yet.

Is it common for people to have to pay previously unknown charges to get their packages delivered? I don’t frequently make international orders, but have a few times, and have never seen this. Everything has always been charged up front.

At this point I use 
sms only for 2 factor authentication 
WhatsApp for connecting with friends and family 
Email for rest of the stuff.

I got an sms from &quot;Nikki Haley&quot; the other week asking me to join some political rally. This has SUCH potential for abuse.A) spreading misinformation. Not hard to confuse people that their polling location is closed but the inconvenient one across town is still openB) fake fundraising. Blast out an sms from &quot;citizens for action&quot; who need money to support ${popular cause&#x2F;candidate}

I just got a letter from the insurance agent that I thought was going to say &quot;THIS IS NOT A BILL&quot; but it was a cancellation notice for my homeowner&#x27;s policy. The letter was designed to be as difficult to read as possible, about 97% of the space was form letter elements that weren&#x27;t relevant, in the middle of page 2 there was an area covered with large black underlines that had the reason for the cancellation typed lightly in it.It is probably time to look for a new insurance provider but I was thinking of calling back the insurance agent and telling her I was planning to run for state senate on a platform of reforming the insurance laws and legislating that you can get 20 years in prison for sending a letter that says &quot;THIS IS NOT A BILL&quot; and that insurance paperwork has to be written in English excerpting any words that are shared with Latin or French. (Which I&#x27;m sure the French would approve of)

St Louis county just did some of this for their property declaration system. It used to set right there in the website: An ugly set of forms, but perfectly functional. Apparently they ordered a rewrite to yet another contractor, and now you get a link to.. stlouismosmartfile.tylerhost.net. Following the link, from the county&#x27;s own website, warns of a third party link! The link prompts the user to register... and the validation email, unsurprisingly, is sent to spam, and then flagged as risky by gmail! Enough red flags, you&#x27;d think it&#x27;s an old soviet military parade, but no... when you call the county, they say that yes, this isn&#x27;t them getting hacked (again), but the way things are supposed to be.This is something everyone that owns any property and is a resident of the county must fill out: About half a million accounts will be created in two weeks. Making sure that all of this comes from the county&#x27;s domain? Too difficult for them. And all for a website on the other side that doesn&#x27;t look much better than the old one.

UPS is better in my experience with them always requiring a code sent to me via USPS to verify access to UPS My Choice, except for when I signed up with a new construction address - It also seems to only show me packages with my last name on it, packages with just a company name did not show up.

I can’t believe it’s 2024 and we are still seeing bugs with handling “special” characters. Unicode has been here for how long? Robust string handling is supported in every language. There is no such thing as a special character. My name should be able to contain Chinese characters. My password should be able to contain emojis. What is this Stone Age shit still running on companies’ backends?

UPS is up there, too. I still get text messages about an old address on an account I can&#x27;t log into for...reasons. (Special characters sound plausible! And of course the password reset flow doesn&#x27;t work.)Wonder if they share a vendor.

I wonder if that&#x27;s why I can&#x27;t change my password with petco - every time I shop there they tell me I have rewards but I can&#x27;t load them because the site errors out when I try to reset my password.I used to be able to load the rewards to my account without logging in at all, just clicked the link in my email, but I guess they fixed that and then I realized I didn&#x27;t know my password.

I once moved into a duplex and Spectrum&#x27;s precursor told me I already had service. After 8 hours on the phone I talked to someone in customer service who told me &quot;I know the problem you have, I know how to fix it. I can 100% fix it. You are welcome to stay on the phone, but it will take more than 6 hours for me to create an account for you&quot;. So in the end it took days to open a new account.When I moved they someone opened a second account in my name and kept billing me for the original account.

I&#x27;d put Spectrum up against them. A few years back, an incoming neighbor typoed their address in a new account setup request to my address and Spectrum very helpfully inferred that the previous resident would want their account terminated and they turned off my service. Apparently, you can DOS any person on the planet you want from the entire Internet by simply knowing their address.

Maybe, but UPS is close to it. They for example are sending out emails that request users to log into their account to &quot;avoid losing their profile&quot;. If this is not ripe for phishing then I don&#x27;t know what will be.

&quot;50% success rate delivering packages&quot; is a totally different level of risk from &quot;automated system gives your garage access code to anyone who claims to live there&quot;i mean in the first case what&#x27;s at risk is the five-dollar trinket you bought off amazon

At one of my addresses FedEx will happily sell anyone overnight shipping and then just keep the parcel at the depot for a week until they have a driver who can actually make the trip. I have had like 6 very urgent packages delayed like this. Once my wife ordered something perishable and they pulled this then told her she had to drive into town and pick it up at the airport.I&#x27;ve also been nearly run off the road by FedEx drivers on the highway before. One guy was so angry that I was only going 10 over that he tailgated me within a foot and then punish passed me.They&#x27;re also the only service that still corrects my other address to the wrong address. I tried for a whole month to get ahold of anyone there who even knows what address correction is and then just stopped using them for anything important.They doubled down on &quot;digital&quot; during the pandemic and fired a bunch of CSRs and stuff. It doesn&#x27;t look like it&#x27;s working out very well for them.

No. They’re 100% useless in my experience, and literally never manage to deliver to me - everything ends up returned to sender. No other courier has this problem.As for the SMSs - in Portugal, and I’d guess Australia too, they contract all of their local operations out to some random group of muppets who can’t organise their way out of a paper bag - the SMSs they send me come from a mobile number, are handwritten (they seem to literally have someone whose job it is to write messages, on a phone, and send them), as are the emails. When it comes to delivery, i’m inevitably the last delivery of the day as I live way out in the boonies, and they just go “it’s 5pm I’m going home”, and it goes back to the depot. They drive it back and forth for a week before declaring the parcel undeliverable.These days, if I see someone has shipped something with FedEx, despite my instructions not to, I immediately request a refund, as I know it won’t arrive.The whole thing beggars belief.

Yeah, in my experience FedEx drivers absolutely LOVE saying they “attempted delivery of my package, but nobody was home,” so I have to go get it from the depot. But I 100% was home, working from home all day, and they 100% never came.

Can I ask where you live? I&#x27;m 40 and have never had anything get lost in the mail, ever. Is it a big city thing or something?

They certainly can be quite impressive, I recently had something delivered from China I bought through Alibaba to South Africa, shipping cost less than 5USD and it arrived in about 13 days, 1 day less than the maximum estimate.In my case I got an email about customs and tax payment which was needed, but the link was clearly to fedex.com.

I&#x27;m in the same camp. The single time they actually delivered it to me without saying I wasn&#x27;t home they had actually delivered it one street over.I spent 72 hours waiting (3x24 periods they told me to wait and call back tomorrow while they &quot;investigated&quot;) for a $1300 package. Initially they said it must have been stolen and its my loss, to which I said &quot;no I was home and near the front door all day, you didn&#x27;t deliver it&quot;. Pretty absurd they can&#x27;t just look where he was when it was &quot;delivered&quot; and deal with it. Or maybe they can and they just don&#x27;t bother.Eventually the person actually called me using my number on the box and said it was delivered there.Still no recourse from FedEx, whom I have not informed I got the package in the end.

I get a kick out of the mismatch between delivery estimates and tracking information.They&#x27;re telling both that my package will be delivered this afternoon, and that it&#x27;s in a distribution center 3000 miles away.

in my country fedex isn&#x27;t popular, but I had one international package delivered by them and I was very positively surprised because they paid duties for me to speed up process and invoiced me that costs.

That’s a bit better than my experience with DHL :) they’ve delivered packages to random people multiple times across the UK, France, Switzerland and South Africa. Important documents they’ve handed over to strangers, like my passport, for example…

They definitely are not impressive. I always avoid them if I am given a choice, because for the last 20 years they have always been sub-par. UPS isn&#x27;t perfect, but they consistently do better than FedEx. Sadly these days it&#x27;s pretty uncommon for vendors to give you the choice of who they use to ship the package, so I can&#x27;t always avoid them.

Is it impressive though? They have about a 50% success rate delivering things to me across multiple addresses and I know other people who have had similar long term issues.

One part workers, 3 parts horrible management setting impossible metrics and bad incentives.

My favorite was when they put my well-marked mail-order medicine right at the exit of the roof gutter pipe, instead of the front door. Sometimes it feels like the workers want to purposely cause chaos.

After 50 years of software crud, eventually a civilisation ending bug occurs and it can&#x27;t be fixed (like how Telstra couldn&#x27;t fix their phone system because the phone system was down). That&#x27;s why we are all alone in the universe. Enjoy life while civilisation still works!

This comment just unlocked a new fear of mine.I specifically got a custom domain and email address for any non-personal&#x2F;&quot;professional&quot; comms, which is essentially just me@&lt;custom-domain-featuring-my-name&gt;.com.At least with non-ASCII characters in passwords, while I think it is stupid to not handle those properly, I can at least see some sort of an excuse there, no matter how weak it is. All it takes to mess this up is not thinking about handling those scenarios, so I can definitely see &quot;this issue was created due to us not thinking about this possibility or not willing to deal with handling it.&quot;But what&#x27;s even the reason to not allow sub-3-character local portions of emails? How does one even mess those up, aside from intentionally setting some triggers for less than 3 characters in local portions of email addresses?

Re password reset workflow issues:  I had an account at a bank where password reset always failed.  I had to go through a VERY convoluted process with customer website support to get it fixed.  It turned out that the problem was that my registered email address was just two characters (my initials) to the left of the &quot;@&quot;, e.g., ab@mydomain.com.  They allowed me to enter and use it throughout the system without any error flagging whatsoever, but it completely broke the password system.  They claim to have raised it as a bug, but never fixed in 3 years+ (moving away from them now).

It&#x27;s fine.At least they don&#x27;t automatically lowercase and truncate your password behind the scenes like AMEX. Lol.

I assume you know that you can open a claim? They&#x27;ll either find your package really fast, or will have to pay its full value. Often the vendor has to initiate the claim. If the vendor doesn&#x27;t want to open a claim, refund. If the vendor doesn&#x27;t want to refund, chargeback.

I ordered a computer from Southern California, they shipped it to Texas, Florida, Maine, and then back to Northern California. My last two orders were just stolen from someone at FedEx. They got the shipment, but it never left the facility after that. Customer service is an offshore apology machine that can&#x27;t help with anything. I used to prefer fedex, but the standard of service is so subpar I go out of my way to avoid them.

Heh, that&#x27;s the same company that sends physical mail to me every time I make a trade because they believe that email sent to my personal domain is &quot;undeliverable&quot; and automatically opt me out of e-statements no matter how many times I opt-back in. They have to be losing money on me by paying for so much postage at this point.(And no, nothing is wrong with my email, it&#x27;s hosted by a professional email host with the proper MX records and literally only Schwab claims to have this problem with me).

Bonus points are given when they handle truncating your password differently in the initial validation vs authentication and it fails silently!

PayPal used to do the same thing, but even worse they weren&#x27;t consistent about it. The page to create your password truncated it, but the login page did not. I found out the hard way when I couldn&#x27;t log in because of that stupid behavior.Thankfully they fixed it at some point, but it&#x27;s absolutely mind blowing to me that anyone thought it was acceptable in the first place.

Hey they don&#x27;t anymore so, progress!I remember comparing notes with fellow employees at a previous job, and depending on when you&#x27;d started working, the system had different password rules for you (users who&#x27;d been created earlier had a smaller set of allowed characters, etc.). Pretty sure it worked out to some Oracle nonsense.

Years ago I found a glaring security hole in schwab where when imputing a security question answer, if you got it wrong you could just hit the back button and try again.to their credit, they took me seriously and I believe they fixed it reasonably promptly.

You&#x27;re reminding me of the time I realized that Schwab (a massive American bank&#x2F;broker) truncated all passwords to 8 characters.

I&#x27;ve had FedEx hand packages to other couriers who promptly lost them never to be seen again. When I contact them they said this counts as delivering the package.I no longer use FedEx for any shipment that I need to have arrive.

They ask for an ID whenever you use an account number. I have to FedEx stuff to my home address for work. The guy at the counter is always perplexed when I tell him the destination address is the same one as the one on my ID.

Much worse than that. I wanted to get some free shipping supplies from FedEx, so I had to sign up for a shipping account. Account could not be created due to password issues on the website, forgot how I got around it but maybe had to use the mobile app which used a different flow.After getting the account, immediately I get shipping bills for international shipping in the thousands of dollars, both sender and recipient have nothing to do with me. Credit card on file was auto-charged. Removed credit card, started getting thick FedEx bills in physical mail.It turns out FedEx allows billing to be charged to any account as long as you have their nine-digit account number, so of course scammers do this all the time just generating random numbers. FedEx didn&#x27;t give a shit, denied my reporting of fraud, allowed more scam shipping even after I reported. Finally I had to initiate chargeback via the credit card issuer and only then did they close the account. But I still get marketing emails that I can no longer turn off. Absolutely not a company anyone should use.

The mailbox? On your property? that you paid for an installed (or bought off the previous owner), is government&#x2F;usps property and they&#x27;ll steal a parcel that someone else has delivered to it?That&#x27;s insane lmao

I bought an OP-1 from teenage engineering years ago and fedex delivered it inside of the mailbox. USPS removed the fedex package from the mailbox and impounded it at our local USPS post office without ever notifying me. After 1-2 months of waiting&#x2F;assuming the package had been stolen, I call the USPS office and asked if they somehow had the package in their custody&#x2F;possession and, lo-and-behold, they did (in the &quot;undeliverable mail room&quot;) and started lecturing me about how it was illegal for fedex to deliver a package into the mailbox, which is usps&#x2F;government property etc. etc.I called Fedex to try to rectify this and, as far as I remember, they either never answered the phone or told me they had no way of contacting the delivery driver (??).I&#x27;ve always avoided fedex (and UPS, for that matter, since they destroyed two antique lamps that I ordered through ebay) since then.

FedEx may have the worst and least secure digital platform for a major company. Some examples I’ve noticed:1. I moved into a 10-unit apartment building and wanted to set up FedEx Delivery Manager. I just put in my new address, no verification whatsoever, and I was immediately given access to the previous tenant’s delivery instructions which included the buildings private garage code. Any thief could have done the same.2. When I moved out of that building I wanted to add my new address to delivery manager … but I couldn’t. The site errored every time. The reason? Some forums revealed the correct hypothesis that if you have special characters in your password then some parts of the site are permanently broken for you. Including the change password flow. So I had to have my wife make a new account with a worse password.Truly amateur stuff for an otherwise very impressive company.

Thanks FedEx, this is why we keep getting phished