Parcel on hold: fake Australia Post texts and other delivery scams

Parcel on hold: fake Australia Post texts and other delivery scams

"AusPost: your parcel could not be delivered due to unpaid postage. Pay the $1.99 fee here." Plus a link. This text, sent in the name of Australia Post, StarTrack, DHL, Aramex or CouriersPlease depending on the wave, is one of the most persistent smishing campaigns around. It works because almost everyone shops online and almost everyone has a parcel on the way at some point: the message lands on fertile ground.

The amount is deliberately tiny. The goal was never to collect those two dollars: it's to get you to enter your full card details on a fake website imitating the delivery company, and sometimes also the one-time code you receive afterwards, so they can make bigger charges.

Why it works even when you're not expecting a parcel

Scammers don't know whether you're expecting an order. They don't need to:

• Volume. They send the same text to thousands of numbers. With so much online shopping, a high share of recipients really do have something on the way, or had one recently, so the message fits.
• A tiny amount. A dollar or two doesn't set off alarm bells. Nobody "checks" a $1.99 payment the way they'd check a $300 one.
• Urgency and zero friction. "Pay now and get it tomorrow" pushes you to sort it out on the spot, on your phone, without stopping to check the sender or the web address.
• Rotating disguises. When one brand burns out (people start warning that "that Australia Post text is fake"), the campaign switches to another courier. The skeleton is always the same as fake unpaid toll or fine texts: a known organisation + something pending + urgency + a payment link.

How to spot the fake text

None of these signs alone is conclusive, but together they're a pretty reliable diagnosis:

• It asks you to pay a fee through a link. Australia Post says it will never call, text or email you to request payment, or to ask for personal or financial information such as passwords or card details. Genuine customs charges come through traceable channels, with documentation for the shipment.
• The link isn't the official domain. Addresses with extra hyphens or words ("auspost-redelivery", "startrack-parcel", "dhl-delivery-au") or odd endings. On a phone screen, in a hurry, they slip through; look calmly and they stand out.
• There's no real tracking number. The fake text talks about "your parcel" in general terms because it doesn't know which one it is. A genuine notice includes the tracking number, and it matches the one the shop gave you.
• A sender that keeps changing. Sometimes a random 04 mobile number, sometimes a name imitating the company. A familiar sender name proves nothing on its own: treat it with the same suspicion as the rest of the message.
• Sloppy writing. Clumsy phrasing, odd capitals, over-the-top urgency ("final notice before your parcel is returned"). Real companies write better than that.

How to check a real delivery

The method is always the same and works for any company:

1. Don't tap the link in the text. Close it.
2. Open the official channel yourself: the app of the shop you bought from, your order confirmation email, or the courier's official app or website, typing the address in yourself.
3. Enter your tracking number there. If there's a genuine issue (customs, an incomplete address, a missed delivery), it'll show up in the official tracking. If nothing shows up, the text was fake.

This sequence (close the message, go to the official channel yourself) is the same one we recommend for checking a call or text from your bank, or a message from the ATO or myGov; you'll find both in our guides. It's the habit that cuts off the most scams at the root.

What to do if you've already entered your card

• Call your bank now, explain what happened and ask them to block the card and issue a new one. That stops the problem in its tracks.
• If you also entered a one-time code you received by text, tell the bank that too: a transaction may already have been authorised.
• Watch your transactions over the following weeks and turn on alerts in your banking app. Fraudulent charges don't always appear straight away.
• Report it to Scamwatch, the national scam-reporting service, and, if you lost money, to police through ReportCyber, which you'll find via the AFP's cybercrime page. Send texts or emails impersonating Australia Post to [email protected]. IDCARE (1800 595 160) offers free support if your details were compromised.
• Report the sender's number in the spam numbers directory. If you're with Telstra, Android users can forward the text to 7226 and then delete it, and iPhone users can use "Report Junk", as Telstra's scams page explains. Other carriers have their own options, so check with yours.

Quick questions

What if I am expecting a parcel and the text matches? A match proves nothing: with so many orders in transit, getting it right by chance is easy. Always check through the official channel with your tracking number. It takes a minute and removes any doubt.

Do couriers send genuine texts? Yes, some send delivery notices or missed-delivery alerts. The difference is that a genuine notice doesn't ask you to pay through a link: it points you to the official app or website, quotes your tracking number and doesn't rush you with threats of an immediate return.

Does the same thing happen on WhatsApp, email or social media? Yes, the same bait circulates on WhatsApp, email and even on fake QR code stickers, which we cover in our guides. Australia Post also warns that it will never ask you to click a social media message to organise a courier for a marketplace sale. The channel changes; the defence doesn't: never pay from a link you've been sent, always check through the official channel yourself.

If you've received one of these messages, report it in NoCall's spam numbers directory: these campaigns reuse numbers for days, and your report is the warning the next person will see before typing in their card details.