Fake Parcel Delivery Texts: The AusPost SMS Scam Explained

AusPost: Your parcel is being held at the depot due to an unpaid $2.99 fee. Update your details here to release delivery. The text arrives while you are half-watching TV, and you did order something last week. The link shows an Australia Post page, the logo looks right, and it is only a few dollars. This is the most-seen scam SMS in Australia — a fake parcel-delivery notice built to harvest card details, personal information, or both. Here is exactly how it works and how to handle every delivery text safely.

The script, step by step

Fake-delivery scams follow a tight formula refined over millions of messages:

1. The lure. A text claims a parcel needs action: a redelivery fee, a customs charge, a failed delivery attempt, or an address confirmation. The sender name may say AusPost, StarTrack, Toll, CouriersPlease, DHL, or FedEx.
2. The link. A shortened or odd-looking URL promises tracking details or a payment page. Scammers can even make the sender name match a real courier, so the fake text can land in the same message thread as genuine delivery updates.
3. The fake page. The link opens a convincing copy of the courier's site asking for personal details first — name, address, phone — and then a small payment, which requires full card numbers.
4. The harvest. The small fee is irrelevant; the goal is your card details for larger fraud, your personal details for identity theft, or malware if the page tricks you into installing an app.

Some versions skip payment entirely and just collect personal details, which are then used to craft bank-impersonation calls. The parcel text is often only the opening move.

Why the messages are so convincing

Several things make delivery texts the perfect scam vehicle:

• Everyone shops online. With millions of parcels moving through Australia Post, StarTrack, Toll, and CouriersPlease every week, a random delivery text has a good chance of landing while someone is genuinely waiting on something.
• Spoofed sender names. Scammers can set the sender display to a real brand name, defeating the glance test that most people rely on.
• Tiny amounts. A fee of a few dollars feels too small to be a scam — but the fee is bait, not the prize.
• Rushed context. The texts arrive with urgency baked in — delivery will be returned, action required today — pushing you to tap before thinking.

Real couriers know about this problem. Australia Post maintains a public scams page describing exactly which messages it does and does not send, and other major couriers publish similar guidance. When in doubt, those official scam-awareness pages are the reference to check.

How real couriers actually contact you

Knowing genuine practice makes fakes obvious:

• Australia Post sends tracking updates and collection notices, but it does not demand redelivery-fee payments through links in unsolicited texts. Its official tracking lives in the AusPost app and website.
• StarTrack, Toll, CouriersPlease, DHL, and FedEx generally notify through their own tracking systems, driver calls, or delivery cards — not payment demands by SMS link.
• No legitimate courier asks you to pay customs or redelivery fees through a link texted out of the blue, asks for card details to look up a parcel, or asks you to install an app from a text link.

The rule that covers every courier: if a delivery message asks for payment or personal details, ignore the link and check the parcel through the courier's official app or website by entering the tracking number yourself.

What to do with a suspicious delivery text

A simple routine handles every case:

1. Do not tap the link. Not to look, not to check — the page may harvest data or attempt a malicious download on contact.
2. Do not reply, not even STOP. Any reply confirms your number is active and can bring more scam texts.
3. Check independently. Open the courier's official app or type its web address yourself, and enter the tracking number from your order confirmation email — not from the text.
4. Forward the text to 0429 999 888, the ACMA's spam-reporting service, then delete it.
5. Report to Scamwatch at scamwatch.gov.au if the message tried to steal money or details.

If you are not expecting any parcel at all, the message is almost certainly a scam — delete and report it without a second thought.

If you already tapped the link or paid

Act fast — the scammers will use harvested details quickly:

1. Call your bank immediately on the number on the back of your card. Ask about cancelling the card, disputing the charge, and watching for follow-up fraud.
2. Change passwords for any accounts sharing credentials you entered, starting with email and banking, and switch on two-factor authentication.
3. If you installed anything, treat your phone as compromised: uninstall the app, run a security scan, and consider a factory reset after backing up photos and data.
4. Report to Scamwatch and to ReportCyber at report.cyber.gov.au, and call IDCARE on 1800 595 160 if identity documents or personal details were shared.
5. Warn your household. The same campaign is texting thousands of numbers — a quick heads-up protects the people around you.

Fake parcel texts succeed because they arrive at the perfect moment of distraction. Build the counter-habit now: delivery text arrives, ignore the link, check the official app. Ten seconds of discipline is all it takes to turn Australia's most common scam SMS into just another deleted message.