Parcel on hold: the fake An Post text and other delivery scams

Parcel on hold: the fake An Post text and other delivery scams

"An Post: your parcel is being held because a customs fee of €1.68 is unpaid. Pay here to release it." Plus a link. This text, sent in the name of An Post, DPD, DHL, UPS or GLS depending on the wave, is a scam text that keeps doing the rounds in Ireland. It works because nearly everyone shops online and nearly everyone has a parcel on the way at some point: the message lands on fertile ground.

The amount is deliberately tiny. The aim was never to collect a euro or two: it's to get you to enter your full card details on a fake website that imitates the delivery company, and sometimes the security code your bank sends you next, so they can make much bigger payments.

Why it works even when you're not expecting a parcel

The scammers don't know whether you're waiting for an order. They don't need to:

• Volume. They send the same text to thousands of numbers. With so much online shopping, a high share of the people who get it really do have something on the way, or had something recently, so the message fits.
• A negligible amount. One or two euro doesn't set off any alarm bells. Nobody "checks" a €1.68 payment the way they'd check a €300 one.
• Urgency and zero friction. "Pay now and get it tomorrow" pushes you to sort it out there and then, on your phone, without stopping to look at the sender or the domain.
• Rotating disguises. When one brand gets burned (people start warning that "that An Post text is fake"), the campaign switches to another courier. The skeleton is always the same as fake toll or fine texts: well-known name + something pending + urgency + payment link.

How to spot the fake text

None of these signs is conclusive on its own, but together they make a fairly reliable diagnosis:

• It asks you to pay a fee through a link. That's exactly the shape of the scam. Even when a real customs charge exists, you can check it and pay it by going to the courier's official website or app yourself and entering your tracking number, never through a link in an unexpected text.
• The link isn't the official domain. Domains with extra hyphens or words ("anpost-redelivery", "dpd-parcel-fee", "dhl-customs-ie") or odd endings. On a phone screen, in a hurry, they slip past you; look at them calmly and they stand out a mile.
• There's no real tracking number. The fake text talks about "your parcel" in general terms because it doesn't know which one it is. A genuine notice includes the tracking number, and it matches the one the shop gave you.
• The sender varies. Sometimes it's just a random mobile number, sometimes a name imitating the company. A text sender can be faked: it proves nothing.
• Clumsy writing. Awkward translations, odd capital letters, exaggerated urgency ("final notice before your parcel is returned"). Real companies write better than that.

How to check a real delivery

The method is always the same, and it works for any company:

1. Don't tap the link in the text. Close it.
2. Open the official channel yourself: the app of the shop you bought from, the order confirmation email, or the courier's official website, typing the address in yourself (for An Post, anpost.com).
3. Enter your tracking number there. If there's a real issue (customs, incomplete address, missed delivery), it will show up in the official tracking. If nothing shows up, the text was fake.

This sequence (close the message, go to the official channel yourself) is the same one we recommend in our step-by-step guides for checking a call or text from your bank, or a message from Revenue or the Department of Social Protection. It's the habit that stops the most fraud at the root.

What to do if you've already entered your card

• Ring your bank now, explain what happened and ask them to block the card and issue a new one. That's the step that stops the problem dead.
• If you also entered a security code you received by text, or approved something in your banking app, tell the bank that too: there may be a payment already authorised.
• Watch your transactions over the following weeks and turn on payment notifications in your bank's app. Fraudulent charges don't always appear straight away.
• Report it to the Gardaí at your local Garda station with screenshots of the text and the link. You can also report the scam text to your mobile operator.
• Report the sender's number in the spam numbers directory.

Quick questions

What if I am expecting a parcel and the text matches? The coincidence proves nothing: with so many orders in circulation, guessing right by chance is easy. Always check through the official channel with your tracking number. It takes a minute and settles it completely.

Do delivery companies send real texts? Yes, some send delivery updates or missed-delivery notices. The difference is that you never need the link in the text to deal with them: anything a real notice tells you can be checked by typing the official address yourself and entering your tracking number. And a real notice doesn't threaten to send your parcel back within hours.

Does the same happen on WhatsApp or by email? Yes, the same bait circulates on WhatsApp, by email and even through QR codes on fake stickers. The channel changes; the defence doesn't: never pay from a link you've been sent; always check through the official channel yourself.

If you've received one of these texts, report it in NoCall's spam numbers directory: these campaigns reuse numbers for days, and your report is the warning the next person will see before typing in their card details.