Parcel held at customs: the fake fee payment by text or phone call

"Your shipment is being held at customs. To release it, pay €2.99 in fees within 48 hours." Sometimes it arrives by text, sometimes by WhatsApp or email, and more and more often as a phone call: a recorded voice asking you to press 1 to speak to "the customs department", or a person introducing themselves as an agent from a courier company. The amount is small on purpose. What they're after isn't those three euros but your full card details, the code your bank sends you to confirm the payment or, in the more elaborate versions, ever larger transfers.

This guide focuses on the customs hook and on phone calls. If what you received is the generic "parcel could not be delivered" notice from Correos (Spain's postal service) or another company, you'll find more detail in the fake Correos text and other parcel scams.

How does the customs fee scam work?

The script repeats with few variations:

1. The notice. You receive a message or a call in the name of the postal service, an international courier or "Customs". They tell you a parcel in your name is being held and that VAT, duties or "customs handling fees" are still unpaid.
2. The rush. There's a deadline: 24 or 48 hours, or the parcel "will be returned to the sender" or "destroyed".
3. The payment. They send you to a website that copies the company's look, or on the call they ask you to read out your card. Sometimes they ask for Bizum (the instant mobile payment system used by Spanish banks), a bank transfer or gift cards.
4. The real theft. With your card details they make purchases or add the card to a mobile wallet. That's why, right afterwards, you usually get a text from your bank with a code: that code authorises a transaction that is not €2.99.

There's a longer variant, linked to romance scams and fake prizes: someone you met online "sends you a gift" and, shortly after, a fake delivery company contacts you saying the parcel is at customs and you need to pay hundreds or thousands of euros in fees, insurance or "certificates". That parcel doesn't exist.

Why is it so believable?

Because customs charges really do exist. Since July 2021, every purchase arriving in the European Union from outside it pays VAT, whatever its value, and some couriers also charge a fee for handling customs clearance. Many people have at some point paid a few euros to receive an order from outside the EU, so the fake message sounds familiar. Outside the EU, the rules differ, but import taxes and handling fees exist almost everywhere, which is why the scam travels so well.

On top of that, the scammer doesn't need to know whether you're expecting anything: they send the same message to thousands of numbers and, with so much online shopping, they always hit someone.

How do I tell a real customs charge from a fake one?

Look out for these signs:

• Did you buy from outside the EU? An order shipped from Spain or another EU country doesn't go through customs. If your purchase was from a European shop, the notice is fake. Outside the EU, the same logic applies to purchases from within your own country or customs union.
• Was VAT already included? Many large international shopping platforms charge VAT when you pay for the order. Check your receipt: if you already paid it, there shouldn't be any further import charges.
• Does your tracking number appear? A real notice mentions your shipment's tracking number, the same one the shop gave you. The fake one just talks about "your parcel".
• Are they asking you to pay via a link, over the phone, by Bizum or with gift cards? Neither the courier nor Customs will ask you to read out your card on an unexpected call or pay with gift cards.
• Is the link the official domain? Domains with extra words ("customs-delivery", "post-fees", "release-parcel") or odd endings are a clear sign.
• Does the call start with a recording? A robot asking you to press a key to speak to customs is a typical pattern of these campaigns.
• Does the amount not add up? Real fees depend on the value of what you bought. A generic figure with no relation to your order is suspicious.

The sender or the number shown on screen proves nothing: numbers and sender names can be spoofed.

What do I do right now?

1. Don't tap the link and don't pay anything. If it's a call, hang up. Don't argue and don't give any details "to check".
2. Look up the order yourself. Open the app or the email from the shop where you bought it and copy the tracking number.
3. Check it through the official channel. Type in the courier's web address yourself or use its official app, and enter the tracking number. If there really are fees outstanding, they'll show up there, and you can pay them through that same channel.
4. Take a screenshot of the message or note down the number that called you, the time and what they told you.
5. Block and report the number. Report it in the spam number directory so others can recognise it. NoCall also warns you when a number has already been flagged as suspicious by other users.

What if I've already paid or given my card details?

Act fast. The order matters:

1. Call your bank on the official number on the back of your card or in its app, not one that came in the message. Ask them to block the card and issue a new one.
2. If you gave a confirmation code, tell the bank: a transaction was probably authorised or your card was added to a mobile wallet, and that needs to be revoked.
3. Check your transactions over the next few days and turn on notifications in your bank's app. Fraudulent charges don't always appear straight away.
4. If you paid by Bizum or bank transfer, ask your bank to try to stop or recover the payment as soon as possible.
5. Report it to the police. In Spain, to the Policía Nacional (091) or the Guardia Civil (062), with screenshots, numbers and receipts; elsewhere, to your national or local police. The bank will ask for the police report to dispute the charges.
6. Get guidance. In Spain, call INCIBE's 017, the free and confidential cybersecurity helpline, and read the guides from the OSI (Spain's Internet User Security Office); elsewhere, contact your national cybersecurity agency or fraud helpline.

If you feel in danger or are being threatened, call 112, the emergency number in Spain and across the EU. For more on getting your money back, read how to recover money lost to a phone scam.

Frequently asked questions

I'm expecting a parcel from outside the EU. How do I know whether the fees are real? Check the shipment on the courier's official website or app with your tracking number, typing in the address yourself. If there are real fees, they'll appear there with the amount and the payment method. Never pay from the link or the call you received.

They called me and I gave them my name and address, but not my card. Is that a problem? There's no direct risk to your money, but that information helps make the next attempt more convincing. Be wary of any later contact that uses it, and never give bank details over the phone.

Someone I met online sent me a gift and now customs is asking me for money. Is that normal? No. It's a well-known variant of the romance scam. No customs authority asks for transfers to personal accounts or "certificates" to release a gift. Cut off contact, don't send money and report it.

Can I complain if the bank won't refund me? Yes. First file a written complaint with your bank, attaching the police report. If you don't get a satisfactory answer, in Spain you can go to the Banco de España's complaints service; elsewhere, to your country's financial ombudsman or banking regulator.

In short

A parcel held at customs that has to be released with a small, urgent payment is one of the most common lures. The defence is simple: never pay from the message or the call, look up the order yourself and check it through the official channel. If you've already given your card, call the bank and report it. And if you've received one of these messages, report it in the NoCall spam number directory: your warning could stop the next person from paying.