Thanks FedEx, This Is Why We Keep Getting Phished

The author received an SMS claiming to be from FedEx about unpaid duties on a parcel and identified seven red flags suggesting it was a phishing attempt, though it perfectly exploited his expectation of an actual incoming package. Upon investigating further, he discovered the link pointed to a legitimate Commonwealth Bank payment service (BPOINT) that had a critical security flaw—the URL parameters could be easily manipulated to change the tracking number, customer name, and payment amount, making it indistinguishable from a phishing site. The incident reveals how scammers exploit both common phishing tactics and poorly designed legitimate payment systems to conduct convincing fraud.