DHL scam texts: how to spot the fake delivery message
Quick answer
A text that says a DHL package is held and asks you to click a link is probably a scam. Don't tap it. Check the shipment on the site or account where you ordered, forward the text to 7726, and report it at reportfraud.ftc.gov.
- Pretends to be
- DHL
- Last updated
How it works
The FTC says there's a good chance a text that claims to be from USPS, FedEx or DHL is really from a scammer. The link in it leads to a look-alike site that collects personal or financial information.
The message usually says a package can't be delivered, needs a fee, or needs an address update. You don't have to be waiting for a parcel for it to work, because the scammer sends it to huge numbers of people and relies on a few to be expecting one.
DHL is being impersonated here. The scammer is the sender of the text.
Red flags
- A text about a package you didn't order or don't recognize
- A link that asks for a fee, card details or login
- An urgent deadline or a threat to return the package
- A sender number or email address you don't recognize
- A page that asks for more personal details than a delivery needs
Example message
DHL: your parcel could not be delivered. Confirm your address and pay a small fee here: [link]
What to do
- 1
Don't tap the link
Don't reply either. Replying tells the scammer your number is active.
- 2
Check the parcel another way
Look at the order on the site or app where you bought the item, as the FTC advises, rather than through the message.
- 3
If you entered card details or a login
Call your bank or card issuer on the number on your card and ask about the charge. Change the password for any account you typed in.
- 4
Report and delete
Forward the text to 7726 and report it at reportfraud.ftc.gov, then delete it.
Report it
Check if your details are exposed with Serus
Scammers find your number and address on data brokers and people-search sites. Serus removes them.
Why you got it
Scammers need a way to reach you and a few details that make the message believable: your name, your phone number, your email, sometimes your address or the bank you use. They buy those details from people-search sites and data brokers, or pick them up from data breaches.
Serus finds the data brokers that list you and removes the listings, and it alerts you when your email or other data turns up in a breach, so fewer scammers can build a convincing message about you.
Frequently asked
Is a DHL text always a scam?
No, but the FTC says there's a good chance a delivery text is from a scammer. Check the order with the seller instead of using the link.
What is 7726?
The FTC suggests forwarding scam texts to 7726 so your mobile carrier can look into them.
I never ordered anything. Why did I get it?
Scammers send these texts widely. Your number may come from a data broker or an earlier breach.
I clicked the link. What now?
Don't enter anything. If you did, call your bank and change passwords. Then report it.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
