Delivery SMS Scams — Fake DHL, FedEx, Royal Mail, and Australia Post Messages
Fake parcel delivery text messages are one of the most common scam types globally. Learn how to identify fake DHL, FedEx, Royal Mail, SingPost and Australia Post SMS messages before clicking any link.
Your parcel couldn't be delivered. There's a small customs fee outstanding. Your delivery is on hold — click here to reschedule. These messages arrive constantly on phones around the world, and they're almost always scams.
Fake delivery SMS messages (also called "smishing" — SMS phishing) have become one of the most effective scam vectors precisely because everyone expects delivery notifications, especially after online shopping. The scam succeeds because it feels normal.
How delivery SMS scams work
The message typically follows one of three scripts:
The customs fee — "Your parcel is being held at customs. A payment of £2.99 / $4.95 is required to release it. Click here to pay." The fee is small enough to seem plausible and not worth losing a parcel over.
The redelivery fee — "We attempted delivery but nobody was home. A £1.45 fee is required to rebook your delivery slot."
The tracking update — "Your package is ready for delivery. Confirm your address to arrange delivery." The link leads to a form requesting your address, date of birth, and often payment details.
After you click the link, you land on a convincing fake website mimicking DHL, FedEx, Royal Mail, SingPost, Australia Post, or another carrier. You enter your card details to pay the small fee. The scammer then has your full card number, expiry date, and security code — worth far more than whatever nominal fee was claimed.
Some variants also install malware on your phone when you click the link, or ask you to download a tracking app that is actually spyware.
How to tell if a delivery message is fake
You're not expecting a delivery — This is the clearest sign. If you haven't ordered anything, you can't have a parcel waiting.
Vague about what the parcel is — Real delivery notifications include the sender's name, a tracking number, or order reference. Fake messages are deliberately vague.
The link doesn't go to the official domain — Real DHL texts link to dhl.com. Real FedEx texts link to fedex.com. Real Royal Mail texts link to royalmail.com. Fake messages use domains like dhl-tracking.info, fedex-delivery.net, or random strings of characters. Check the URL carefully before clicking anything.
The sender is a random mobile number — Legitimate couriers send from recognisable sender IDs (like "DHL" or "FedEx") not random mobile numbers. Though note that sender IDs can also be spoofed.
They ask for payment by link — Real couriers don't send payment links via SMS. Any customs duties or redelivery fees are always arranged through the courier's official website or app, using your tracking number.
Urgent language — "Your parcel will be returned in 24 hours if no action is taken." Artificial urgency is a scam hallmark.
FAQ
Real delivery notifications come from the sender's known number or official app. Never click links in SMS. Go directly to the courier's official website and enter your tracking number there.
If you only clicked and didn't enter any information, you may be safe. If you entered card details or personal information, contact your bank immediately and change any passwords used.
Occasionally there are legitimate customs or redelivery fees, but these are always payable through the courier's official website — never through a link in an SMS.
Yes. In the UK, forward it to 7726 (spells SPAM). In Australia, report to the ACCC via scamwatch.gov.au. In Singapore, report to SPF.