Alert · DHL
Fake “DHL” text or email: customs fee, surcharge, failed delivery
Criminals impersonate DHL in texts and emails. They write that a parcel is waiting for customs clearance, needs a small surcharge, or could not be delivered. The link leads to a fake form that steals payment-card details.
Last reviewed:
What a fake “DHL” message looks like
The most common themes:
- An email about customs clearance: before delivery continues the parcel must clear customs, which involves a small fee. The link leads to a fake form built to steal payment-card details (CERT Polska, December 2025 summary, in Polish).
- A text with a link to pay a parcel surcharge, even a tiny one. Polish police described a text asking for a “0.76 PLN surcharge” on a DHL parcel; the person who paid through the link lost nearly 1,500 zł (Police, 2019).
- A message about a failed delivery attempt and a redelivery fee, leading to stolen card details (CERT Polska).
- A text about delivery problems with a link to a data form (CERT Polska).
- On OLX: a “buyer” sends a WhatsApp link to a page that looks like OLX, InPost, DPD, DHL or Poczta Polska and carries a fake payment panel (CERT Polska). More: the “buy with OLX delivery” scam.
- From
- DHL (spoofed sender)
Your parcel is awaiting customs clearance. Pay 3.49 zl within 24h or it will be returned: dhl-customs-fee[.]xyz
- From
- DHL Express <noreply@dhl-parcels-pl[.]xyz>
- Subject
- Parcel on hold: customs fee required
Your parcel has been held at customs. To continue delivery, pay a fee of 4.80 zł.
Button: “Pay now”
The usual tricks
A spoofed sender
A courier’s name in the sender field of a text is no proof. Fraudsters can put anything in the sender field (CERT Polska).
Customs as a pretext
Customs clearance sounds official and credible, especially for orders from abroad. In the fake email the “fee” is small, but the form collects your full card details (CERT Polska).
A few złoty
The supposed surcharge is usually a few złoty (Police). CERT Polska advises checking, when you approve a payment, that the amount isn’t 20 or 200 zł (CERT Polska).
Time pressure
The messages suggest you must react at once or the parcel will be sent back (Police).
An address like the real one
Fake pages differ from real ones by a typo or a different domain ending, such as .com instead of .pl (Police). A made-up example: dhl-parcels-pl[.]xyz.
A malicious app
Some links in fake “courier” texts lead to pages that push you to install malicious apps (gov.pl, CSIRT NASK).
How to tell a real courier message
Warnings from courier companies and the authorities give the same rules (in Polish):
- DHL and DPD Polska, in a warning passed on by the police: they “NEVER send instant-payment links in emails”. The companies advised checking the site address (for DHL:
dhl.comanddhlexpress.pl) and contacting customer service if in doubt (Police, 2020). - Police: “Poczta Polska and courier companies don’t send texts with links for direct customs fees or surcharges!” (Police, 2026).
- CSIRT NASK: “InPost and other courier companies never ask for parcel surcharges this way” (gov.pl).
- CERT Polska: if a text is about a parcel surcharge, open the courier’s website or app yourself, not from the link (CERT Polska).
If you clicked the link or paid
What matters is what went into the fake page and whether anything was installed. If card details went in, act now.
Call your bank immediately
If card or login details went into the fake page, or a payment was approved, call your bank right away — on the number on the back of your card or on the bank’s official website — and ask them to block the card and access to the account. In Poland you can also block a card on (+48) 828 828 828 (ZBP, in Polish). Every minute counts.
Remove any app from the link
If the page talked you into installing an app, uninstall it. Don’t log in to your bank on that phone until you have spoken to the bank.
Change any password you typed in
If a username and password went into the fake page, change that password now, and anywhere else you used the same one. Turn on two-step verification where the service offers it.
Forward the text to 8080
In Poland, 8080 is CERT Polska’s free number for reporting suspicious texts. Use “Forward” and send the whole message as it is, link included. CERT Polska adds dangerous sites to its warning list, which many Polish operators use to block access to them.
Report the site or email to CERT Polska
Report a suspicious page through the form at incydent.cert.pl/phishing, or forward the email to
[email protected].Report the fraud to the police
If you lost money, report it at any police unit or prosecutor’s office (gov.pl: Report a crime, in Polish). Keep the texts, emails, screenshots and transfer confirmations.
More in our guides: what to do after clicking a phishing link, how to report phishing.
Check before you click
Got a suspicious email? Check it with AntiBait.
Paste the message source or upload an .eml or .msg file. AntiBait checks the sender, SPF, DKIM and DMARC, links and attachments, and explains its verdict. In Poland, forward a suspicious text message to 8080.
Sources
- CERT Polska / CSIRT NASK: December 2025 summary, PDF (PL)
- CERT Polska: Beware of failed-delivery messages, 16 Oct 2026 (PL)
- CERT Polska: The parcel scam is back, 3 Sep 2026 (PL)
- CERT Polska: Quick transfers (PL)
- gov.pl: CSIRT NASK pre-holiday fraud warning, 20 Dec 2021 (PL)
- Police (Sosnowiec): Fake emails and texts, DHL and DPD warning, 25 Jun 2020 (PL)
- Police (Piła): Fake DHL texts, 1 Jul 2019 (PL)
- Police (Podkarpackie): Warning about fake texts, 3 Jul 2026 (PL)
- Police (Środa Śląska): Text asking for a parcel surcharge, 22 Sep 2026 (PL)
- CERT Polska: lista ostrzeżeń przed niebezpiecznymi stronami
- gov.pl: Coraz więcej prób wyłudzenia przez fałszywe SMS-y (numer 8080)
Based on public notices from CERT Polska and from the institutions and companies that criminals impersonate. The companies and institutions named here do not send these messages: criminals impersonate them.