Scammers Already Know What's In Your Next Delivery

If you have ever received a text saying your package is delayed, your address is incomplete, or you need to pay a small fee before your delivery can be completed, you already know the scam. Now imagine the scammer actually knows your name, your address, and what you ordered.

That's the concern following a cyberattack against CEVA Logistics, a major global shipping and logistics company. The attack began this past summer and affected multiple European operations. Customers of several companies that use CEVA have potentially had delivery and order information exposed.

For now, the confirmed customer warnings are centered in Europe. Today Europe. Tomorrow…well it could be at your doorstep.

CEVA isn't some tiny regional delivery company. It is a global logistics operation that works behind the scenes for businesses moving products around the world. And that is what makes this story worth watching in the United States. It highlights something that should concern American shoppers: The next logistics company breach could, and likely will happen here. And when it does, criminals won't necessarily need your credit-card number. They may only need to know what is sitting on your front porch schedule.

2

Information potentially exposed in the CEVA incident includes names, physical addresses, phone numbers, email addresses, and purchase information.

• Notice what's missing from that list?
• Your credit-card number.
• Your password.
• Your banking information.
• Yet this information can still be incredibly useful to a scammer.
• Consider the difference between these two messages:
• "Your package could not be delivered. Click here."
• That's obviously suspicious.

Now consider:

"Hi Sam, your order for [actual product] is being held because the delivery address at [actual address] needs confirmation. Click here to reschedule."

That's much harder to dismiss, because the scammer isn't guessing anymore. They have information that makes the lie sound like the truth.

2

This is the part consumers should really pay attention to.

We are likely to see more phishing attempts built around packages, deliveries, shipping fees, and order problems as criminals exploit stolen logistics information.

A scammer might claim:

• Your package is being held.
• Your delivery address needs to be confirmed.
• An additional shipping fee is required.
• Customs charges must be paid.
• Your package is scheduled for delivery.
• Your delivery was missed.
• Your order has been canceled.
• You need to click a link to reschedule.

The message may contain your real name and it may contain your real address. It may reference something you actually purchased. But, it can still be completely fake. And that is the trap.

2

This is one of the most important lessons from the CEVA incident. People often assume that a scammer couldn't possibly know certain information unless the message was legitimate. That's no longer a safe assumption. Data stolen during one breach can be used to make another attack look much more believable. And criminals can combine information from different breaches to build increasingly detailed profiles of potential victims.

2

Here's the bigger issue. The United States is one of the world's biggest online shopping markets. Millions of Americans have packages arriving every day from retailers, manufacturers and third-party sellers. Those deliveries generate a tremendous amount of information making it an irresistible collection of information for criminals looking to create believable phishing scams.

2

• Don't wait for a breach notice to start treating delivery messages suspiciously.
• If you receive a message saying there's a problem with a package, take a breath and check independently.
• Open the retailer's app to check status.
• Visit the shipping company's website yourself.
• Look up the tracking number using a source you already trust.