tl;dr: Security researcher Troy Hunt received a FedEx SMS requesting duty/tax payment that had every hallmark of a phishing scam: typos, urgency, weird casing, a non-FedEx payment domain, and a URL where you could freely tamper with the tracking number, name, and amount via query parameters. After extensive verification through FedEx's actual support channels, it turned out to be legitimate. The takeaway: while we train users to spot phishing red flags, legitimate companies like FedEx are undermining that effort by sending messages indistinguishable from scams.