Nine texts out of ten that land in our inbox claiming a parcel “couldn’t be delivered” are fake. We’d know, because like most Australians doing a lot of online shopping, we get them constantly, several a week some months, and we’ve started keeping half an eye on what separates the real ones from the convincing fakes. The short version: the fakes have gotten genuinely good, good enough that squinting at spelling mistakes won’t save you anymore. You need a different method, one that doesn’t rely on spotting the con at a glance.
This matters more in the run-up to Christmas, when parcel volumes spike and scammers know everyone is expecting at least one delivery text a week. Scamwatch, the Australian Competition and Consumer Commission’s scam reporting arm, has flagged parcel delivery scams as a persistent seasonal pattern for years now, and the pattern hasn’t changed, just the polish on the execution.
Why a fake parcel delivery text is so easy to fall for
The trick isn’t cleverness. It’s timing and plausibility. If you’ve ordered three things online this month, a text saying “your delivery has a problem” is going to land as plausible no matter who sends it, because the odds are genuinely in the scammer’s favour. They don’t need to know what you bought. They just need to know that most adults are expecting something in the post most weeks.
The second trick is the link itself. Scam parcel texts use a shortened or disguised web address, something like auspost-redeliver.com or a string of random letters, designed to look like it could belong to Australia Post, DHL or a courier, without actually being their domain. Once you tap it, you’re usually shown a very convincing fake tracking page that asks for a “redelivery fee” of a few dollars, just enough to get your card details without triggering alarm bells about the amount.
Here’s our mildly unpopular take: we don’t think the redelivery fee itself is the main danger anymore. Plenty of people are now switched on enough to baulk at paying $2.99 to a courier. The real damage happens because that card-details page often doubles as a phishing form that also asks for your name, date of birth and sometimes a “verification code” sent to your phone, the same kind of one-time code your bank uses. Hand that over and you’ve potentially opened a much bigger door than a few dollars.
The afternoon check that actually works
Forget trying to spot bad grammar. Do this instead, and it takes about ninety seconds.
- Open a fresh browser tab or the official app, not the link in the text, and manually type in the courier’s real address (auspost.com.au, dhl.com, etc.) or open the app you already have installed.
- Search your order confirmation emails for a tracking number, then paste that number into the courier’s own tracking tool.
- If there’s no tracking number anywhere in your inbox matching anything you’ve recently bought, the text is almost certainly fake, because real couriers link to a tracking number you can independently verify, not just a vague “parcel” with no reference.
That last point is the one that catches most scams out. A genuine delivery problem will always correspond to something you can find yourself, through the retailer, through your email confirmation, or through the courier’s own app. A fake one asks you to trust the text completely and skip the verification step, because the verification step is exactly where it falls apart.
What the real couriers actually send
Australia Post, for instance, publishes guidance on what its genuine delivery notifications look like and explicitly warns it will never ask for payment via text to release a parcel. That’s a useful rule of thumb across the board: legitimate Australian couriers essentially never ask for a small card payment by text message to “release” or “redeliver” an item that’s already been paid for through the retailer. If you ordered something and paid for shipping at checkout, there’s no reason a courier would need another payment to finish the job.
DHL, FedEx, Australia Post and most contracted delivery services use consistent sender IDs, and while scammers can and do spoof those sender names (so a fake text can appear in the same conversation thread as genuine past messages from “AusPost”), the content gives it away faster than the sender name does. A real missed-delivery notice tells you where the parcel is now, like a local post office or parcel locker, and how to collect it without entering card details on a webpage.
Checking the link without tapping it
On most phones you can press and hold a link, rather than tapping it, to preview the actual web address before you go anywhere. On iPhone this shows a pop-up preview with the real URL; on Android, a long press usually shows “copy link” so you can paste it somewhere safe and read it without visiting it. If the address doesn’t end in a courier’s actual domain, say auspost.com.au rather than something ending in .xyz, .top or a string of numbers, that’s your answer.
Scammers have also started buying domains that look right at a glance, things like “auspost.delivery-au.com”, which contains the word “auspost” but isn’t actually part of Australia Post’s domain at all. The part that matters is what comes immediately before the first single slash after “https://”, everything else is decoration designed to fool a quick glance. It’s a bit like how a letterbox with “Smith” painted on it doesn’t mean the actual Smith family lives there; the visible label isn’t the proof.
If you’ve already clicked
It happens, and there’s no use being precious about it. If you’ve tapped the link but didn’t enter any details, close the tab and don’t go back. If you entered card details, call your bank immediately using the number on the back of your card, not any number from the text, and ask them to block or reissue the card. If you entered a one-time code or password, change that password immediately on every account where you reuse it, which is exactly why password reuse habits matter well beyond public networks.
Worth reporting the scam text to Scamwatch and, if money was lost, to your bank and ReportCyber via the Australian Cyber Security Centre. Reporting doesn’t usually get your money back on its own, but it helps regulators track which numbers and domains are active, and telcos use that data to block numbers faster under the Australian Communications and Media Authority’s spam rules.
Why blocking the number barely slows them down
We get asked a lot whether blocking the sender actually helps. Honestly, not much, and we think this is worth saying plainly because a lot of advice implies otherwise. These texts are sent from constantly rotating numbers, often through compromised accounts or cheap overseas SMS gateways, so blocking one number does nothing to the next hundred. It’s not useless, since it tidies your own inbox, but don’t mistake it for protection. The protection is the habit of checking tracking numbers independently, every time, regardless of how legitimate the message looks.
This is also where we’d gently push back on the idea that these scams are only a problem for older or less tech-savvy Australians. We’ve seen plenty of switched-on, terminally online people get caught out precisely because they’re moving fast and multitasking, glancing at a text between meetings and tapping without thinking. The scam doesn’t rely on you being gullible. It relies on you being busy, which describes basically everyone during a parcel-heavy month.
Where this fits with other scam texts doing the rounds
Parcel scams are really just one flavour of a much bigger pattern that includes fake toll notices, fake ATO refunds and fake bank fraud alerts, all of which we’ve covered in our broader look at scam calls and robocalls in Australia. The common thread across all of them is urgency paired with a tiny, plausible dollar figure designed to feel too small to worry about. If you want the wider picture of what else is circulating this year, our rundown of the top cybersecurity threats facing Australians covers the same psychological tricks applied to email, phone calls and social media.
One thing we’d add, slightly contrarian again: we think the fixation on “spotting bad English” in scam-awareness campaigns has actively made people worse at catching these, not better, because it trains you to look for the wrong signal. Scammers run their messages through translation and spellcheck tools same as anyone else now. The grammar is often flawless. If your entire defence is “I’ll know it when I see a typo”, you’re defending against a threat from five years ago.
Our verdict: verify the number, not the message
The single habit that actually works is treating every delivery text as unverified until you’ve matched it against a tracking number you found yourself, through an app or a retailer email, not through the text. That one step defeats almost every version of this scam, regardless of how good the branding, spelling or sender name looks. It costs you ninety seconds and it works whether the text claims to be from Australia Post, DHL, Toll or a courier you’ve never heard of.
We’d also suggest treating your phone number a little more like your email address: worth being slightly stingy with who gets it, since every retailer checkout that asks for a mobile number is another place your details can end up in a breach notified under the Notifiable Data Breaches scheme run by the Office of the Australian Information Commissioner. None of this requires new software or a subscription. It just requires building the habit before the next parcel-heavy shopping season, not during it.
