Alert · InPost
Fake “InPost” text: parcel surcharge, parcel on hold, confirm your details
Criminals send texts and emails posing as InPost notifications. They write about an underpayment, an oversized parcel or a need to confirm your details, and add a link. The page looks like InPost or a payment gateway, but it steals card details and bank logins. InPost stresses that it never sends texts or emails asking for a surcharge.
Last reviewed:
What a fake “InPost” message looks like
The schemes change, but the same themes keep coming back:
- A text about a parcel surcharge, usually a few złoty for an “underpayment” or an oversized parcel, with a payment link. InPost lists this as a typical warning sign: the message says a payment is missing or short and urges you to settle it through the link provided (InPost, in Polish).
- A text asking you to confirm the parcel details. The link leads to a fake site built to steal personal and payment-card details (CERT Polska).
- A message about a failed delivery and a redelivery fee, which CERT Polska warns about for courier companies in general (CERT Polska).
- An email with an attachment or a “waybill” (list przewozowy) to open. InPost: genuine notification emails never contain attachments, and InPost doesn’t use the term “list przewozowy” (InPost).
- On OLX and Vinted: a “buyer” sends a link to an InPost-branded page where you can supposedly withdraw your money. It carries a fake payment panel (CERT Polska, monthly summary 8/2026, InPost). More: the “buy with OLX delivery” scam.
- A request to send a premium-rate text to “get parcel information” (InPost).
- From
- InPost (spoofed sender)
Your parcel is on hold due to an underpayment of 1.99 zl. Pay within 24h or it will be returned to the sender: inpost-surcharge[.]xyz
- From
- InPost <notifications@inpost-parcels[.]xyz>
- Subject
- Waybill for your parcel
Please find the waybill attached. Open the file to confirm receipt of your parcel.
Attachment: waybill.zip
The usual tricks
A spoofed sender
“InPost” in the sender field proves nothing. CERT Polska: fraudsters can put anything in the sender field, such as a courier company’s name (CERT Polska).
Addresses with a typo
InPost warns about fake sender addresses such as @intops[.]pl, @impost[.]pl and @inpost-eu[.]pl (InPost). A typo or an extra word is enough to make an address look “almost” right.
A small amount, a big loss
The surcharge is 1–2 zł, so it’s hard to stay alert. CERT Polska advises checking that the payment you approve doesn’t say 20 or 200 zł (CERT Polska). Bank details typed into the fake gateway go straight to the criminals (CERT Polska).
The parcel will “go back”
The messages suggest you must react at once or the parcel will be sent back (Police). Haste takes the place of checking.
A fake payment gateway
The page imitates an online payment or InPost’s site and asks for card details or your bank login. InPost says it never directs users away from its standard payment methods (InPost).
A malicious app
Some links in these texts lead to pages that push you to install malicious apps (gov.pl, CSIRT NASK). InPost advises installing apps only from trusted sources (InPost).
What InPost never does
InPost has warned about this scam many times. From its notices (in Polish):
- “InPost NEVER sends texts or emails asking for a surcharge on a parcel!” (InPost, 7 Dec 2022).
- “We assure you that InPost does NOT send texts about extra costs and NEVER gives external links.” (InPost, 21 Jun 2022).
- “All billing information appears only in Manager Paczek or on the invoice.” (InPost).
- “Genuine notification emails from InPost never contain any attachments!” (InPost).
- “InPost never holds back parcel deliveries because of an underpayment!” (InPost, archived notice).
- InPost sends parcel notifications by email to the address given when the parcel was sent, as push notifications in the InPost Mobile app, or by text if you don’t use the app (InPost). Pay only through trusted methods, such as the InPost Mobile app (InPost).
If you clicked the link or paid
What matters is what went into the fake page and whether anything was installed. If card details or a bank login went in, act now.
Call your bank immediately
If card or login details went into the fake page, or a payment was approved, call your bank right away — on the number on the back of your card or on the bank’s official website — and ask them to block the card and access to the account. In Poland you can also block a card on (+48) 828 828 828 (ZBP, in Polish). Every minute counts.
Remove any app from the link
If the page talked you into installing an app (for example “to track the parcel”), uninstall it. Don’t log in to your bank on that phone until you have spoken to the bank.
Change any password you typed in
If a username and password went into the fake page, change that password now, and anywhere else you used the same one. Turn on two-step verification where the service offers it.
Forward the text to 8080
In Poland, 8080 is CERT Polska’s free number for reporting suspicious texts. Use “Forward” and send the whole message as it is, link included. CERT Polska adds dangerous sites to its warning list, which many Polish operators use to block access to them.
Report the message to InPost
InPost takes reports of suspicious messages through its phishing report form (in Polish).
Report the site or email to CERT Polska
Report a suspicious page through the form at incydent.cert.pl/phishing, or forward the email to
[email protected].Report the fraud to the police
If you lost money, report it at any police unit or prosecutor’s office (gov.pl: Report a crime, in Polish). Keep the texts, emails, screenshots and transfer confirmations.
More in our guides: what to do after clicking a phishing link, how to report phishing.
Check before you click
Got a suspicious email? Check it with AntiBait.
Paste the message source or upload an .eml or .msg file. AntiBait checks the sender, SPF, DKIM and DMARC, links and attachments, and explains its verdict. In Poland, forward a suspicious text message to 8080.
Sources
- InPost: Security with InPost (PL)
- InPost: Beware of fraudsters posing as InPost, 7 Dec 2022 (PL)
- InPost: Suspicious text asking for payment? 21 Jun 2022 (PL)
- InPost: Cyber threat warning, 1 Nov 2019 (PL)
- InPost: Parcel pick-up and sending updates, archived (PL)
- InPost: Cyber fraud on OLX, 1 Sep 2021 (PL)
- InPost: Text notifications (PL)
- CERT Polska: Message asking to confirm parcel details, 7 Jul 2026 (PL)
- CERT Polska: Beware of failed-delivery messages, 16 Oct 2026 (PL)
- CERT Polska: Monthly summary 8/2026, PDF (PL)
- CERT Polska: text campaign impersonating PGE, InPost and others, 12 Apr 2022 (PL)
- CERT Polska: Quick transfers (PL)
- gov.pl: CSIRT NASK pre-holiday fraud warning, 20 Dec 2021 (PL)
- Police (Podkarpackie): Warning about fake texts, 3 Jul 2026 (PL)
- CERT Polska: lista ostrzeżeń przed niebezpiecznymi stronami
- gov.pl: Coraz więcej prób wyłudzenia przez fałszywe SMS-y (numer 8080)
Based on public notices from CERT Polska and from the institutions and companies that criminals impersonate. The companies and institutions named here do not send these messages: criminals impersonate them.