Parcel on hold? The fake NZ Post text and other courier scams

Parcel on hold? The fake NZ Post text and other courier scams

"NZ Post: your parcel could not be delivered due to unpaid postage. Pay the $1.95 fee here." Plus a link. This text, sent in the name of NZ Post, CourierPost, NZ Couriers, Aramex or DHL depending on the wave, keeps coming back. It works because almost everyone shops online and almost everyone has a parcel on the way at some point: the message lands on fertile ground.

The amount is deliberately tiny. The goal was never to collect those two dollars: it's to get you to enter your full card details on a fake website imitating the courier company, and sometimes also the code you're sent next, so they can make much bigger charges.

Why it works even when you're not expecting a parcel

The scammers don't know whether you're expecting an order. They don't need to:

• Volume. They send the same text to thousands of numbers. With so much shopping done online, a large share of the people who get it really do have something on the way, or had one recently, so the message fits.
• A tiny amount. A dollar or two doesn't set off alarm bells. Nobody "checks" a $1.95 payment the way they'd check a $300 one.
• Urgency and zero friction. "Pay now and get it tomorrow" pushes you to sort it out on the spot, from your phone, without stopping to check the sender or the domain.
• A rotating disguise. When people catch on to one brand (they start warning that "that NZ Post text is fake"), the campaign switches to another courier. The skeleton is always the same as fake "unpaid fine" or "unpaid toll" texts: a well-known organisation + something pending + urgency + a payment link.

How to spot the fake text

None of these signs is conclusive on its own, but together they're a fairly reliable diagnosis:

• It asks you to pay fees through a link. No real courier needs you to pay through a link in a text you weren't expecting. If an import charge or other fee is genuinely due, it's tied to your shipment and tracking number, so you can check it through the courier's official app or website instead.
• The link isn't the official domain. Domains with extra hyphens ("nzpost-parcels", "nz-post-delivery", "courier-redelivery") or odd extensions. On a phone screen, in a hurry, they slip through; look calmly and they stand out. NZ Post says its real links go to nzpost.co.nz or its nzp.st short-link domain.
• There's no real tracking number. The fake text talks about "your parcel" in general terms because it doesn't know which one it is. A real notice includes the tracking number, and that number matches the one the shop gave you.
• The sender varies. Sometimes it's any old mobile number, sometimes a name imitating the company. A text sender can be spoofed, so it proves nothing. One clear sign, though: NZ Post says it never sends texts from a phone number outside New Zealand and never contacts customers on WhatsApp.
• Stylistic slips. Clumsy wording, odd capital letters, exaggerated urgency ("final notice before your parcel is returned"). Real companies write better than this.

How to check a real delivery

The method is always the same, and it works for any courier:

1. Don't tap the link in the text. Close it.
2. Open the official channel yourself: the app of the shop where you bought it, the order confirmation email, or the courier's official website, typing the address in yourself.
3. Enter your tracking number there. If there's a real issue (customs, an incomplete address, a missed delivery), it will show up in the official tracking. If nothing shows up, the text was fake.

This sequence (close the message, go to the official channel yourself) is the same one we recommend for checking a call or text from your bank and for checking a message from Inland Revenue or Work and Income, both in our situation guides. It's the habit that stops the most fraud at the root.

What to do if you've already entered your card

• Call your bank now, explain what happened and ask them to block the card and issue a new one. That's the step that stops the problem in its tracks.
• If you also entered a code you received by text, tell the bank that too: a transaction may already have been authorised.
• Watch your transactions over the following weeks and turn on transaction alerts in your bank's app. Fraudulent charges don't always arrive straight away.
• Report it to the National Cyber Security Centre (NCSC), or to NZ Police on 105 if you've lost money, with screenshots of the text and the link. Forward the text free to 7726, the scam-text reporting service run by the Department of Internal Affairs. For scam emails using NZ Post's name, NZ Post's scams and fraud page explains how to report them.
• Report the sender's number in the spam numbers directory.

Quick questions

What if I am expecting a parcel and the text matches? The coincidence proves nothing: with so many orders on the way, hitting the mark by chance is easy. Always check through the official channel with your tracking number. It takes a minute and clears up any doubt.

Do couriers send real texts? Yes, some send delivery notices or missed-delivery alerts. The difference is that a real notice doesn't ask you to pay through a link: it points you to the official app or website, mentions your tracking number and doesn't rush you with threats of an immediate return. NZ Post also says it will never ask for personal or financial information by email or text.

Does the same thing happen on WhatsApp or email? Yes, the same bait circulates on WhatsApp, by email and even through QR codes on fake stickers. Since NZ Post doesn't use WhatsApp to contact customers, an "NZ Post" WhatsApp message is fake. The channel changes; the defence doesn't: never pay from a link you've been sent, and always check through the official channel yourself.

If you've received one of these messages, report it in NoCall's spam numbers directory: these campaigns reuse numbers for days, and your report is the warning the next person will see before entering their card details.