Sometime before last Christmas my wife got a text message with something about a package being on the way, and needing to confirm her address. She clicked the l

Sometime before last Christmas my wife got a text message with something about a package being on the way, and needing to confirm her address. She clicked the link, and was taken to an exact clone of usps.com. It went through several innocuous questions first, and when it asked for her address did the whole ZIP-code extension lookup and confirmation. She only got suspicious when it asked her for something more sensitive (credit card? I don't remember). The URL, of course, was most definitely not usps.com. It was by far the most sophisticated phishing attempt I've ever seen. I pride myself on my suspicion, and there's at least an even chance I'd have got as far as she did before saying "hang on a second". Nothing about the sms looked out of place, there weren't any typos, the website was perfect, and the workflow carefully calculated to allay suspicion. I honestly admired the craft and attention to detail. If that's one of the ones they're talking about, I'm not surprised.