Short answer
“Your parcel is on hold — pay €1.99 to rebook delivery” is one of the most common scams in Europe. The link leads to a fake carrier page that collects your card details, and often a follow-up call or code that empties the account; on Android it may ask you to install an app. DHL, for example, says the only payments it requests by email or SMS are customs duties and taxes, confirmed with a one-time code sent to the recipient, and that its links only lead to its own sites. Don’t click: check the tracking number on the carrier’s own website or app. Report the text — 7726 in the UK, 33700 in France, INCIBE’s 017 helpline in Spain — and if you entered card details, call your bank first.
How the parcel text scam works
- The hook: a text or email says a parcel couldn’t be delivered, is held at customs or needs an address update. A small fee makes it feel harmless.
- The fake page: a copy of the carrier’s site asks for your name, address and card details, sometimes your online-banking login.
- The second act: a few days later someone calls as “your bank” about a suspicious payment and asks for a code or a transfer to a “safe account”. That call is part of the same scam.
- The app variant: on Android, the page may ask you to install a tracking app. It is malware that can read your texts, including bank codes.
How to tell a fake from a real delivery message
Carriers publish their own rules. DHL’s fraud page is a good model: official email comes only from DHL domains such as @dhl.com, never from Gmail or other free providers; its links only lead to its own websites; and the only payments it requests by email or SMS are customs duties and taxes, with a one-time code first sent to the recipient’s registered contact. Other warning signs:
- A shortened link or a web address that isn’t the carrier’s own domain.
- A generic sender such as “Delivery”, or an unexpected foreign number.
- Urgency: “today only”, “your parcel will be returned”.
- A parcel you weren’t expecting, or a carrier you didn’t use.
The safe check never involves the link: open the carrier’s app or type its website yourself and enter the tracking number from your order confirmation.
Where to report it in Europe
| Country | Report the message | If you lost money |
|---|---|---|
| United Kingdom | Forward the text to 7726 (free); the provider can block the sender | Report Fraud: reportfraud.police.uk or 0300 123 2040; in Scotland, Police Scotland on 101 |
| France | Forward the text to 33700 or use 33700.fr; reports go to operators daily | A complaint to the police or gendarmerie; help at cybermalveillance.gouv.fr |
| Germany | Forward phishing emails to phishing@verbraucherzentrale.nrw (Phishing-Radar) | The police, for example through the online police station (Onlinewache) |
| Spain | INCIBE’s 017 helpline: call 017, or WhatsApp 900 116 117, every day 8:00–23:00 | A report to the Policía Nacional or Guardia Civil |
| Italy | Polizia Postale’s online portal, commissariatodips.it | A complaint to the Polizia Postale |
| Netherlands | Fraudehelpdesk, fraudehelpdesk.nl | A report to the police |
| Austria | Watchlist Internet’s report form | A report to the police |
| Any country | The carrier named in the text: DHL takes reports at phishing@dhl.com | Your bank first, then the police |
For more countries, see where to report online fraud, country by country.
If you clicked or paid
- You entered card details: call your bank on the number on your card, block the card and ask to dispute any payment. Do it now, not after the next charge.
- You entered your online-banking login: call the bank, then change the password from a device you trust.
- You gave someone a code from a text: tell the bank immediately; that code may have approved a payment or a new device.
- You installed an app: switch on flight mode, uninstall it, back up your photos and consider a factory reset; change important passwords from another device.
- You only opened the page: close it. Without entering data or installing anything, the risk is low, but expect follow-up texts and calls.
Then report the message, as above. If the scammers reached your email or social accounts, see hacked account recovery.
Stop the next one
- Track parcels only in the carrier’s app or the shop’s order page.
- Turn on spam filtering for texts on your phone.
- Never pay a “redelivery” fee through a link in a message.
- Treat “your bank” calls after a parcel text as part of the scam: hang up and call the number on your card.
- Tell your family: older relatives and teenagers are frequent targets. Related: reporting phishing, QR code scams, never share a verification code.
Frequently asked questions
I only opened the link. Am I in danger?
Usually not, if you didn’t enter anything or install an app. Close the page and expect follow-up messages or calls, which are part of the same scam.
How did they get my number?
Scam texts are sent to huge lists, often from old data breaches or simply generated numbers. A text alone doesn’t mean your phone has been hacked.
Will my bank refund the money?
If a payment was taken without your authorisation, EU rules oblige the bank to refund it unless you acted fraudulently or with gross negligence. If you approved it yourself with a code, it is harder; see what to do after paying a scammer by transfer.
Does DHL ever ask for payment by text?
DHL says the only payments it requests by email or SMS are customs duties and taxes, with a one-time code first sent to the recipient’s registered contact. Check any such request in the official tracking.
Sources: NCSC (UK) — report a scam text message to 7726, 33700 — reporting spam texts and calls (France), INCIBE — 017 cybersecurity helpline (Spain), Verbraucherzentrale NRW — Phishing-Radar (Germany), DHL — fraud awareness