How parcel and delivery scams work
Most parcel scams start with an SMS or email: “Your package could not be delivered — pay a redelivery fee.” The link leads to a fake tracking page that mimics DHL, Hermes, UPS, Royal Mail, or local postal services. The page asks for a small card payment that thieves use or resell.
Variants include fake customs-duty payments, address-confirmation phishing, and malware attachments disguised as shipping labels.
SMS and email warning signs
Carriers rarely demand card payments through random text links. Treat these patterns as suspicious until verified in the official app.
- Unexpected message when you are not expecting a delivery
- Sender number not matching the official carrier short code
- Urgent language: “final notice,” “package destroyed tomorrow”
- Link URL that is not the official carrier domain
- Tiny payment request (€1–5) designed to test stolen cards
- Spelling errors or mixed languages in the message
How to spot a fake tracking website
Fake pages copy carrier colors and logos. The hostname is usually the clearest clue.
- Domain registered days or weeks ago with courier keywords (dhl-fee-pay.com)
- URL unlike the official carrier site (dhl.de, hermesworld.com, ups.com)
- Payment form before showing any real tracking data
- Asks for full card details for a “customs” charge under €10
- No link to the carrier’s main corporate website in the footer
The safe way to check a delivery
Never use the link in the message. Open the carrier’s official app or type their URL manually.
- Use the shopping site’s order page for the tracking number, then open the carrier site yourself
- Install the official DHL, Hermes, or postal app and check notifications there
- If unsure, contact the shop you ordered from — not the number in the SMS
- Run an unfamiliar tracking domain through VerifyThisSite before entering payment data
If you already paid on a fake tracking page
Small charges are often tests before larger fraud. Act immediately.
- Contact your bank to block the card and dispute the charge
- Report the SMS sender to your mobile carrier (forward to 7726 in the US/UK)
- Do not reply to the message or click any follow-up links
- Monitor statements for additional unauthorized charges
Step-by-step checklist
- 1
Ignore the SMS link
Do not tap the URL in the message. Close the message and open the official carrier app instead.
- 2
Find your real tracking number
Check the retailer’s order confirmation email or account page for the legitimate tracking link.
- 3
Compare the domain
If you must open a link, read the hostname. It must match the carrier’s known official domain.
- 4
Run a trust check
Paste suspicious tracking URLs into VerifyThisSite before any payment.
- 5
Report the scam SMS
Forward to your carrier’s spam reporting number and delete the message.
Frequently asked questions
- I am expecting a package — could the SMS be real?
- Possibly, but carriers almost never collect fees via random SMS links. Open the official app or the retailer’s tracking page instead of the text link.
- Why do scammers ask for such small payments?
- Small “customs” or “redelivery” charges lower suspicion and verify that the card works before larger fraud attempts.
- Can a fake tracking site steal my password too?
- Yes. Some pages phish for account logins as well as card numbers. Treat unexpected delivery links like any other phishing attempt.