Thanks, FedEx: This Is Why We Keep Getting Phished

Remember the old joke about "click this link to win an iPhone"? It's not funny anymore — especially when giants like FedEx are adding fuel to the phishing fire.

Recently, Troy Hunt (yes, the Have I Been Pwned guy) shared how FedEx messed up security again. The company sends emails with links leading to pages that ask for personal data — just like typical phishers. Except these are official FedEx notifications. Absurd?

The gist: a FedEx customer got a delivery notification, clicked the link, entered their details — and only then realized the page looked suspicious. But no, it was the real FedEx site. The company simply uses a practice any security professional would call an "antipattern."

What went wrong?

• The link leads to an external service (not fedex.com) that collects data.
• The email lacks clear legitimacy markers (e.g., no digital signature).
• The data entry page design matches typical phishing templates.

For developers and startup founders, this is a great reminder: don't copy phisher behavior in your legitimate processes. If your service asks users to enter a password or card details, ensure:

• The domain matches the main one.
• HTTPS and a valid certificate are present.
• Emails are signed with DKIM/SPF.
• Users can verify the sender.

METABYTE studio's comment: It seems even logistics giants sometimes confuse their own software with a phishing simulator. When building your products, remember: user trust is fragile, and one crooked link can shatter it. We help projects design secure UX patterns that don't make users wonder, "Is this you or the hackers?"