"Package on hold": the fake Correos SMS and other parcel scams
You get an SMS from Correos, DHL or UPS: your parcel is on hold and you must pay 1 or 2 euros in fees to release it. It's smishing. Here's how to spot the fake message and how to check a real shipment.
NoCall
Clear guides with steps for acting on suspicious calls and messages.
"Correos: your parcel could not be delivered due to missing postage. Settle the payment (€1.68) here." Plus a link. This SMS, sent in the name of Correos, DHL, UPS, FedEx or Seur depending on the wave, is one of the most persistent smishing campaigns in Spain. It works because almost everyone shops online and almost everyone has a parcel on the way at some point: the message lands on fertile ground.
The amount is deliberately tiny. The goal was never to collect those two euros: it's to get you to enter your full card details on a fake website imitating the delivery company, and sometimes also the confirmation code you receive afterwards, to make larger charges.
Why it works even when you're not expecting a parcel
The scammers don't know whether you're expecting an order. They don't need to:
- Volume. They send the same SMS to thousands of numbers. With e-commerce today, a high percentage of recipients genuinely have something on the way or had one recently, so the message fits.
- A negligible amount. One or two euros doesn't set off alarms. Nobody "verifies" a €1.68 payment the way they'd verify a €300 one.
- Urgency and zero friction. "Pay now and get it tomorrow" pushes you to sort it out on the spot, from your phone, without stopping to check the sender or the domain.
- Rotating disguise. When one brand burns out (people start warning that "that Correos SMS is fake"), the campaign switches to another carrier. The skeleton is always the same as the fake DGT fine SMS: known entity + pending matter + urgency + payment link.
How to spot the fake SMS
None of these signs alone is definitive, but together they're a fairly reliable diagnosis:
- It asks you to pay fees via a link. Delivery companies don't handle customs or postage payments through a link in an unexpected SMS. Real customs charges are communicated through traceable channels with shipment documentation.
- The link isn't the official domain. Domains with extra hyphens ("correos-envios", "dhl-paquete", "seur-seguimiento") or odd extensions. On a phone screen, in a hurry, they slip through; look calmly and they stand out.
- It mentions no real tracking number. The fake SMS talks about "your parcel" in generic terms because it doesn't know which one it is. A legitimate notice includes the tracking number, and that number matches the one the shop gave you.
- Variable sender. Sometimes just any mobile number, sometimes a name imitating the company. An SMS sender can be spoofed: it proves nothing.
- Stylistic slips. Clumsy translations, odd capitalisation, exaggerated urgency ("final notice before the parcel is returned"). Real companies write better than this.
How to check a real shipment
The method is always the same, and it works for any company:
- Don't tap the link in the SMS. Close it.
- Open the official channel yourself: the app of the shop where you bought, the order confirmation email, or the carrier's official website by typing the address yourself.
- Enter your tracking number there. If there's a real issue (customs, incomplete address, delivery attempt), it will show up in the official tracking. If nothing shows up, the SMS was fake.
This sequence (close the message, go to the official channel yourself) is the same one we recommend for verifying a call or SMS from your bank and for verifying a notice from the tax office or social security. It's the habit that cuts off the most fraud at the root.
What to do if you already entered your card
- Call your bank now, explain what happened and ask them to block the card and issue a new one. That's the measure that stops the problem cold.
- If you also entered a confirmation code you received by SMS, tell the bank that too: there may be an already-authorised transaction.
- Watch your charges over the coming weeks and turn on transaction notifications in your bank's app. Fraudulent charges don't always arrive straight away.
- Report it to the police with screenshots of the SMS and the link. The INCIBE helpline 017 is free if you need guidance.
- Report the sender number in the spam numbers directory.
Quick questions
What if I am expecting a parcel and the SMS matches? The coincidence verifies nothing: with so many orders in circulation, hitting the mark by chance is easy. Always check through the official channel with your tracking number. It takes a minute and removes all doubt.
Do delivery companies send real SMS messages? Yes, some send delivery notices or failed-attempt alerts. The difference is that a real notice doesn't ask you to pay via a link: it points you to their official app or website, mentions your tracking number, and doesn't rush you with threats of immediate return.
Does the same happen on WhatsApp or email? Yes, the same bait circulates on WhatsApp, email and even via QR codes on fake stickers. The channel changes; the defence doesn't: never pay from a link you receive, always check through the official channel yourself.
If you've received one of these messages, report it in NoCall's spam numbers directory: these campaigns reuse numbers for days, and your report is the warning the next person will see before entering their card details.
Sources and review
Reviewed:
Numbering, carrier tools, and reporting procedures can change. Verify sensitive steps with the linked primary authority.
Article details
Editorial content reviewed by NoCall with practical context for spotting suspicious calls and messages.
Received a suspicious call?
Look up the number in NoCall before sharing data, calling back, or clicking any link.
Search a phone number or a company name (Iberdrola, Movistar and Vodafone...) to check if it has been reported as spam.