She had gotten a text notification about a delayed package, clicked the link, and paid a fee. Then she realized that it was not, in fact, the United States Postal Service asking for her credit-card ...