THREAT LIBRARY
SMSTarget: ANYONE EXPECTING A PARCEL (EVERYONE)
“Your parcel could not be delivered”
A fake DHL/DPD text asks for a tiny customs or redelivery fee — and takes your whole card.
How it looks
Text message · from +44 7911 284551
DHL: Your parcel DE4820771903 is on hold due to an unpaid customs fee. Confirm your details and pay €0.99 within 24h or the parcel will be returned to sender: dhl-parcel-redelivery.com/track
RECONSTRUCTION — NAMES, NUMBERS AND DOMAINS ARE INVENTED. THE PATTERN IS REAL.
Where the hook hides
The fee is the trick. Nobody hesitates over one euro — but to pay it, you enter your full card number, expiry, and CVV into a page the attacker controls. They're not after €0.99. They're after the card.
It works because it's statistically true: at any given moment, most people are expecting some parcel. The message doesn't have to guess right about you — it has to guess right about enough people.
Red flags — the three-second check
- 01DHL, DPD, Hermes, Royal Mail — no carrier asks for fees through a payment link in a text.
- 02The sender is a random mobile number, not the carrier's official short code or app.
- 03The domain isn't dhl.com — it's a lookalike stuffed with extra words (parcel, redelivery, track).
- 04Urgency on a deadline: “within 24h or it will be returned” exists to stop you from thinking.
- 05A €0.99 fee that requires your full card details. The size of the ask never matches the data requested.
Already hooked? Do this now
- 01If you entered card details: call your bank now, block the card, and watch statements for small “test” charges.
- 02Forward the text to 7726 (SPAM) — the reporting number works with most UK and EU carriers.
- 03Report it to your national fraud portal — Action Fraud in the UK, your police's cybercrime unit elsewhere in Europe.
- 04Track parcels only through the carrier's own app or by typing the official site yourself.
Check your reflexes
Reading about it is not the same as catching it live. See whether this one would get past you.