A parcel could not be delivered, the address is incomplete, or customs require a small fee. Such messages arrive by text, messenger or email and almost always contain a link. Opening it leads to a copied parcel service page that asks for card details or offers an app to install. In the run-up to Christmas, when many people are expecting parcels, the message looks particularly credible.
How the messages are built
The German consumer advice centre describes the basic pattern: a short message about a supposed delivery problem and a link to an unfamiliar website. One example from its collection reads, in German without umlauts: “Your parcel will be returned to the sender today. Last chance to collect it.” Missing special characters and artificial time pressure are typical.
The intentions behind them vary. According to the consumer advice centre, some senders want to spread harmful apps that read data and send further texts. Others are after payment details. Watchlist Internet describes how small amounts are requested first for a supposed fee, followed some time later by larger debits.
- Delivery problem. The parcel is said to be at the depot, being returned or in need of a new delivery date.
- Confirm your address. The address is said to be incomplete and must be completed via the link.
- Fee or customs. A small amount is said to be missing for delivery, often called a customs or surcharge fee.
- Install an app. An app is to be downloaded for tracking. The German Federal Office for Information Security (BSI) shows a fake DHL page explaining how to install a fraudulent application.
What customs ask for
German Customs do not send tax notices or payment requests by text, email, messenger or social media. In a press release, customs write: “Customs never approach parcel recipients in this way, send links or ask them to pay.” According to customs, payments to them are made exclusively by bank transfer to a domestic account, never via a prepaid payment service.
When you order from a non-EU country, charges do apply. According to customs, you usually pay them on delivery to the carrier, meaning the parcel service that brings the shipment. A new rule has applied since 1 July 2026. The Federal Ministry of Finance writes that the previous customs exemption of 150 euros has been abolished. Instead, a flat customs charge of 3 euros is levied per product category in a shipment; import VAT remains.
This has a consequence for you: if you order from abroad, you will more often receive a genuine notice about charges. The fakes borrow from such amounts. So check every fee request through a channel you choose yourself. Whether charges are outstanding for your shipment can be found out from the parcel service via its website or customer service. Open both yourself, using the address from your order confirmation or by searching for the service’s name.
How to check a parcel message
- Do not tap the link.
Even a quick look can be enough to land on a page asking you to install an app.
- Open the parcel service’s website yourself.
The consumer advice centre recommends opening the parcel service’s website in your browser and entering the tracking number there. Use the number from your order confirmation.
- Ask the sender.
The shop you ordered from can tell you which service is carrying the parcel and under which number.
- Do not reply.
According to the consumer advice centre, any reply shows that the number is in active use. Delete the message. You can block the sender’s number, but the numbers change constantly.
If you want to know what is behind a domain, you can enter it in the shop check without opening the page yourself. The check is built for online shops. For a copied parcel page it shows you how old the domain is and whether it is on a warning list. More on the underlying scam is in the glossary under phishing.
Prevention: two settings on your phone
The consumer advice centre recommends a third-party billing block with your mobile provider. It prevents third parties from charging amounts to your phone bill. On Android devices you should also switch off the installation of apps from unknown sources. In the settings you can find the option by searching for “unknown”, usually under “Install unknown apps”.
On iPhones, according to the consumer advice centre, installations are only possible from the App Store and from other stores that offer pre-checked apps. This does not help against a page asking for card details. There, the only protection is not to enter the details.
Already clicked or entered details
If you opened a link or installed an app, the BSI recommends these steps:
- Switch on flight mode.
This stops further text messages from being sent and cuts off communication by any malware.
- Inform your mobile provider.
Have a third-party billing block set up there as well.
- Check your account.
Look for debits at your bank and payment services that you did not intend.
- File a police report.
The BSI advises taking the smartphone to the police station as evidence. Your state’s online police station is listed under Reporting offices.
- Reset the device.
Only after the report and after backing up your data. In its profile of the Android malware FluBot, the BSI writes that a factory reset may be necessary.
If you entered card details
Have the card blocked immediately, at your bank or via the German blocking hotline 116 116. If someone then debits money without your consent, it is an unauthorised payment. Under Section 675u of the German Civil Code, the bank must refund it without delay, at the latest by the end of the business day after your report.
For losses caused by a misused card, the bank can charge you up to 50 euros under Section 675v of the German Civil Code. If you acted with gross negligence, you are liable for the entire loss. Whether that applies depends on the individual case. Report any unknown debit as early as possible.Under Section 676b, your claims lapse if you do not inform the bank within 13 months of the debit at the latest. What else applies to credit cards is under Credit card: chargeback.
Reporting the message
You can report unwanted texts and messenger messages to the Federal Network Agency (Bundesnetzagentur) via its complaint form. In case of violations, the agency can have phone numbers disconnected. According to its own information, a fine against text spam is not possible. If you have suffered a loss, the case also belongs with the police. How to secure evidence for this is under Securing evidence.
Similar payment links also appear when selling on classifieds sites. The article Classifieds fraud shows how fake “secure payment” pages work there. If you order online before Christmas, the article Buying Christmas presents online lists the warning signs on the shop page.
