Delivery SMS scams are the most reported fraud type in the UK, Australia, Singapore, and across Europe. They exploit online shopping habits and the expectation of parcels to trick recipients into handing over card details through fake payment pages.
How delivery SMS scams work
The scam operates in a precise sequence designed to maximise conversion:
Step 1 — The message arrives
You receive an SMS appearing to come from DHL, FedEx, Royal Mail, SingPost, Australia Post, USPS, or another courier. The message claims there's a problem with a delivery — failed attempt, address confirmation needed, customs fee due, or redelivery required.
Step 2 — The urgency
The message creates time pressure. "Your parcel will be returned in 24 hours." "Confirm within 48 hours to avoid return fees." This is designed to make you act before thinking.
Step 3 — The click
You click the link in the message. It takes you to a convincing replica of the real courier's website — correct logos, fonts, colours, and layout. The fake site may even show a "tracking number" that matches what was in the message.
Step 4 — The payment page
After entering your "delivery details", you're directed to a payment page for the small fee. It looks like a legitimate checkout page with card fields. When you submit your card details, they go directly to the scammer.
Step 5 — The aftermath
Your card details are sold on the dark web or used immediately for larger purchases. You may receive a confirmation that seems real, or the page may just refresh. Days or weeks later, large unauthorised charges appear on your statement.
Real examples of delivery scam messages
DHL — failed delivery
"DHL: We attempted delivery of your parcel but were unable to complete it. Please reschedule and pay a £1.99 redelivery fee: [link]"
Royal Mail — customs charge
"Royal Mail: Your parcel is being held at our depot. A customs charge of £2.99 is due before we can deliver. Pay here: [link]"
SingPost — undeliverable parcel
"SingPost: Your parcel could not be delivered due to an incomplete address. Update your details and pay a S$2.50 handling fee to reschedule: [link]"
Australia Post — delivery failed
"AusPost: We were unable to deliver your parcel. Please confirm your address and pay a $3.20 redelivery fee within 48 hours: [link]"
FedEx — customs clearance
"FedEx: Your international shipment requires customs clearance. Please pay the $4.50 customs fee to release your package: [link]"
USPS — address issue
"USPS Alert: Your package has been returned to the depot due to an address error. Update your address to arrange redelivery: [link]"
Courier-specific warning signs
DHL — real DHL tracking links always go to dhl.com. Real DHL never charges customs fees via SMS links.
Royal Mail — real customs charges are handled by Royal Mail through official letters or the Parcel Collect service. Royal Mail's real domain is royalmail.com.
SingPost — real SingPost tracking goes through singpost.com. Real SingPost redelivery scheduling is done through their official app.
Australia Post — real AusPost notifications come through their app or auspost.com.au. Real redelivery is free and scheduled through the official site.
FedEx — real FedEx tracking links go to fedex.com. Real customs fees for international shipments are assessed by customs authorities, not the courier via SMS.
UPS — real UPS notifications come from ups.com. UPS My Choice app handles delivery management.
How the fake payment pages steal your data
When you land on a fake delivery payment page, everything looks legitimate. The URL might be dhl-delivery-fees.com or royalmail-customs.net — close enough that people don't check carefully on mobile screens.
The page collects:
- Your full name
- Delivery address (creates a sense of legitimacy)
- Card number
- Expiry date
- CVV / security code
Some more sophisticated versions then trigger a fake 3D Secure screen asking for your bank's one-time password — giving the scammer everything needed for authenticated transactions.
Others collect your details and immediately sell them or use them while you're still looking at a fake "thank you" confirmation page.
How to check a delivery notification legitimately
- Find your tracking number — it should be in your original order confirmation email from the retailer
- Open a new browser tab and type the courier's official website address directly
- Enter your tracking number on the official site
- Check the real status — if there's genuinely a problem, it will show here
If you have no tracking number and weren't expecting a delivery, the message is almost certainly a scam.
Red flags checklist
Before clicking any delivery SMS link, check for:
- No tracking number included in the message
- Link domain is not the courier's real domain
- Small fee payment required via the link
- "24 hours" or other urgency deadline
- Sender is a mobile number rather than an alphanumeric ID
- HTTP link rather than HTTPS
- The "courier" doesn't match any expected deliveries
If you've already paid
Time is critical:
- Call your bank immediately — explain you've been scammed and the charge needs to be disputed and your card blocked
- Request a new card with a new number — your current card details are compromised
- Monitor your statements daily for at least two weeks — fraudulent charges sometimes appear days after the initial capture
- Change passwords on any service that has your payment details saved
- File a police report — required for insurance claims and financial recovery processes
- Report to Scampede — your report warns others who receive the same message
- Report to the courier being impersonated — DHL, Royal Mail, SingPost, etc. all have fraud reporting pages and want to know when their brand is being used
Protecting yourself going forward
- Install your courier's official app and track all deliveries through it — never via SMS links
- Enable SMS filtering on your phone — both iOS and Android have built-in spam detection
- Never pay delivery fees via a link — real redelivery charges are handled through official courier websites and apps
- Save the official courier websites in your bookmarks so you always go directly to the right place
- Report suspicious texts — forward to 7726 (SPAM) which works with most carriers in the UK, US, and Australia