No, a free iPhone 12 is not waiting for you — avoid this scam

No, a costless iPhone 12 is not waiting for you lot — avert this scam

(Prototype credit: EverythingApplePro)

NOTE: We've been hearing rumors that these "package is waiting for yous" text messages are somehow connected to human trafficking. They are non. They're just a regular old phishing scam.

In the most contempo affiliate in the annals of SMS phishing scams, aka "smishing," we have the saga of the fake Apple iPhone 12 giveaway.

Sophos' Paul Ducklin, an data-security luminary in his own correct, wrote most this smishing effort recently on his employer's Naked Security blog. Information technology seems someone on the Sophos team got a text message stating that a packet for them — actually, someone with a different proper noun — was waiting for them to pick it up.

New iPhone 12 release date, price, specs and leaks
The best password managers to keep your online accounts prophylactic
Plus: Want protection for cheap? See if a free iPhone VPN has you covered

Step 1 of an SMS-text-driven phishing scam. — (Prototype credit: Future)

Ducklin walks the reader through the scam, from the first click on the link in the SMS message, to a website where a phony chatbot says that you accept been selected to get a free Apple tree iPhone 12, to the survey you have to take, and finally to the point where you can "claim" the iPhone reward.

But of grade, you'll have to provide an email address, password and credit-menu number outset. And, of course, the iPhone 12 doesn't yet officially exist. It likely won't be announced by Apple until mid-October.

Step 2 of an SMS-based phishing scam. — (Image credit: Time to come)

Sound familiar? We've been getting these texts as well, along with a whole lot of others touting fake Viagra and CBD oil. In fact, the screenshots on this page are non from Sophos, but from your contributor's ain phone. (Our particular scammer couldn't seem to decide whether we were supposed to get an iPhone 11, xi Pro or Xs.)

The lure of a new iPhone isn't that alluring to me, as I'm an Android fan, simply going through the steps of this scam is a fun little exercise. Ultimately, this is only a phishing scam that wants to harvest your username, password and credit-card information.

Step 6 of an SMS-based phishing scam. — (Prototype credit: Future)

You may wonder for which online service the username and password the username are supposed to exist for. The respond is that it doesn't really matter.

Then many people (aye, we've all done it) reuse passwords for so many unlike websites that almost any username-countersign combination is bound to be useful to crooks. To avoid becoming the latest victim, exist sure to use one of the best countersign managers.

Step 8 of an SMS-text-driven phishing scam. — (Image credit: Futurity)

These miscreants feed the phished credentials into automated "credential stuffing" algorithms that hammer websites similar Facebook, Google or PayPal with thousands of credentials an hour. They're spring to get into more than a few times.

So how do you protect yourself from such (frankly obvious) scams? Starting time, remember that if it sounds too good to be true, so by dadgum, it is.

Step 9 of an SMS-text-driven phishing scam. — (Image credit: Hereafter)

Second, never requite away whatever passwords or credit card numbers to any website that yous are brought to by a text message or instant message. Would you requite the same information to a random stranger who stopped you in the street?

You tin't really stop these scam texts, unfortunately. The numbers they're texted from aren't real, and blocking the numbers will do no skillful. All you can practise is not answer to them and hope the scammers motion on to greener pastures.

Step 10 of an SMS-text-driven phishing scam. — (Epitome credit: Hereafter)

Paul Wagenseil is a senior editor at Tom's Guide focused on security and privacy. He has also been a dishwasher, fry cook, long-haul driver, code monkey and video editor. He's been rooting around in the data-security space for more 15 years at FoxNews.com, SecurityNewsDaily, TechNewsDaily and Tom's Guide, has presented talks at the ShmooCon, DerbyCon and BSides Las Vegas hacker conferences, shown up in random TV news spots and fifty-fifty moderated a panel discussion at the CEDIA home-engineering science briefing. You can follow his rants on Twitter at @snd_wagenseil.