A complaint by one of the most prominent figures in cybersecurity, Troy Hunt, recently resurfaced on the Hacker News homepage, generating hundreds of points and dozens of comments: official notifications from FedEx look more like phishing than actual scams.
Troy Hunt is the creator of Have I Been Pwned, the widely used site that helps people check if their accounts have been compromised in data breaches. In February 2024, he documented a real personal experience titled “Thanks FedEx, this is why we keep getting phished.” Two years later, the post being upvoted to the front page of Hacker News proves that the underlying problem has not changed at all.
Here is what happened.
Troy was waiting for a 3D printer shipped from the US, costing $799 USD (around $1,215 AUD), which meant he might owe import duties to Australian Customs. He then received an SMS:
“FedEx alert: Your package 216.21 requires urgent payment of duty and taxes of 216.21 to arrange delivery. Pay today at [link]”
Image: Official duty payment SMS sent by FedEx. Source: troyhunt.com
Notice the numbers: the package ID was listed as 216.21, and the amount due was also 216.21. Having an identical package reference number and tax amount is a massive red flag by itself. Furthermore, the link pointed to bpoint.com.au, a domain name that sounded suspiciously like a payment scam site.
Troy shared a screenshot of the text on X (formerly Twitter) and polled over 4,000 users. A staggering 87% voted it as “suspicious as hell.” He highlighted 7 distinct red flags: incorrect brand capitalization, an unnaturally short package number, an overly urgent tone, missing currency symbols, a non-FedEx URL domain, and grammatical errors.
Image: Phishing SMS sent by scammers claiming address error. Source: troyhunt.com
Comparing it to actual scam texts—“Your package is held due to address error, please correct urgently”—the phrasing, tone, and link structure were practically identical.
The twist? The official notification was completely legitimate.
Troy checked the official FedEx website, but found zero information or guidance regarding duty payments. When he called customer service, the automated voice system looped back and recommended the exact phone number he was already dialing. Three days later, an email landed in his inbox: the body stated “Your package is held for duty/taxes,” matching the amount, and pointing once again to bpoint.com.au.
Image: Body of the official FedEx email, using phrasing nearly identical to scam texts. Source: troyhunt.com
The email included a PDF attachment containing the complete invoice for the 3D printer, with the exact order number, price, and logistics details. Scammers could not possibly have accessed that invoice. The 87% of users were wrong—that “suspicious as hell” text had been sent directly by FedEx itself.
Why do official communications end up looking like scams?
First, look at the technical architecture. The sender field in email and SMS was never authenticated by design. A message displaying “FedEx” as the sender does not guarantee it came from FedEx—a flaw present since email was invented. The industry later introduced SPF and DKIM as safeguards, allowing domain owners to declare authorized servers so recipients can verify authenticity.
While SPF and DKIM solve backend verification, they share a fatal usability flaw: the better they work, the more invisible they are to end users. When an average person opens an email, they see the display name, subject line, and body formatting. SPF and DKIM validation details are buried in message headers that users never inspect. Security awareness training tells users to “check the sender address,” yet the display sender is technically the easiest part to spoof. Telling users to rely on visual inspection of senders was never an effective defense.
Second, consider organizational silos. Hacker News commenters pointed out a likely internal scenario: FedEx corporate headquarters likely restricts international subsidiaries from using the core fedex.com domain for localized tax processing. Tax collection was outsourced to a local Australian payment gateway, BPoint (operated by Commonwealth Bank). As a result, the payment link landed on an unfamiliar domain completely detached from the FedEx brand, mimicking every phishing site design pattern.
In large corporations, departments operate in isolation. Marketing focuses on conversion rates, Operations focuses on collecting funds, and Security focuses on trust. HN users labeled this “Shadow IT”: a business unit builds a makeshift notification system to meet a deadline, and by the time anyone considers proper company domain integration, the budget has already been spent.
Even marketing teams face structural incentives: urgency sells. Phrasing like “Urgent,” “Final Notice,” and “Act Now” yields the highest open rates. Marketing departments have used these tactics for decades and won’t abandon them just to look less like scammers. Thus, security teams’ hard work is routinely undone by marketing campaigns.
Why is anti-phishing education becoming impossible?
Scammers copy official communications, while official channels copy scam tactics. These two forces crush the concept of “official trust” from both sides. Anti-phishing training is fundamentally about teaching people to spot counterfeit money. But if banks start printing official currency that looks fake, the training completely falls apart.
The HN discussion was filled with similar examples: users receiving Allstate insurance texts linking to domains like allstate.yem.bo; companies running anti-phishing exercises where legitimate training emails were ignored by the entire company because they matched every red flag taught in class; users unable to tell if facebookmail.com is legitimate; and IRS phone systems using synthetic AI voices identical to robocall scammers.
Troy’s article cited Australian regulatory data: Australians lose over $3 billion AUD to scams annually. Communications regulators blocked 336 million scam SMS messages, but that represents just a fraction of the total volume sent.
What is the ultimate irony here?
In the age of generative AI, where AI-crafted phishing emails are increasingly difficult to detect, FedEx managed to perfectly emulate scammers. As Troy Hunt put it, FedEx essentially told scammers, “out of the way, watch this,” and scored full marks in being completely indistinguishable from phishing.
Community discussions demonstrate that this is not unique to FedEx. Microsoft, PayPal, the IRS, and insurance providers all run official channels that serve as free blueprints for scammers. Two years later, FedEx SMS alerts still look the same, and users continue posting fresh “customs duty notification” screenshots on Hacker News.
Anti-phishing education remains essential, but it fights a losing battle against companies sacrificing trust for short-term conversion. Until official communications actually look official, security training will lack a baseline foundation. Until then, if you receive a suspicious text about an undelivered package, the safest rule remains: never click the link—go directly to the official website yourself.
Reference links:
- Troy Hunt: Thanks FedEx, This Is Why We Keep Getting Phished
- HN Discussion (item?id=49175192)
