Fake email notices deliver malware, misery

Before you click on anything, make sure the email address is from the real company. For example, FedEx.com is the real thing; FedEx-intl.com is not.

As Christmas approaches, experts suggest an extra dollop of caution before clicking on email package delivery notices.

Fake notifications are proliferating, bringing not holiday cheer but holiday ransomware.

The holiday phishing season began just before Thanksgiving and will likely extend until after Christmas, said Caleb Barlow, vice president for IBM Security.

“This is a $445 billion business. These are campaigns, run by the criminal equivalent of marketers,” he said.

Security company FireEye sees a significant increase in fake package email alerts beginning in November, an almost 100% increase from the average of September to October.

Common subject lines the company has been tracking include: We could not deliver your parcel, #00556030 Please Confirm Your DHL Shipment Problems with item delivery, n.000834069 Delivery Receipt | Confirm Awb no:XXX830169 Your order is ready to be delivered Courier was unable to deliver the parcel, ID00990381 Please download attachment to view detail and confirmation of your address

The fake messages tend to come in two main types.

Some contain malware that invades your computer and either allows it to be used by a botnet or attempts to find and extract personal information about you that could be sold, or login information for your financial accounts.

The most damaging can contain ransomware. This is software that allows criminals to remotely lock up your computer. They then send a message demanding payment in untraceable digital currency such as Bitcoin.

To protect yourself, look carefully at any emailed package delivery notice. Do they include your full name, customer number and actual information from the company? Is the email address it came from actually the company or some odd variant?

For example, an email purporting to be from FedEx that came to this reporter on Wednesday was actually from FedEx-intl.com, a non-existent address.

If there’s any doubt, don’t click, experts say.