A text message or email lands in your inbox: your parcel is being held, and a few euros in customs or shipping fees will release it. The link looks plausible, the amount is trivial, and if you happen to be waiting on an order, the doubt is enough to make you tap. That doubt is precisely what the scam is built on. The good news is that a handful of verification rules can separate a genuine customs notice from a credential-harvesting funnel — without ever touching the link.
- Correos never asks for money by SMS or email: Spain’s main parcel operator states plainly that it does not request personal, banking or payment data through either channel.
- DHL is the exception, with conditions: the only payments it requests by message are customs duties and taxes, always before delivery, always through its own platform, and always confirmed with a one-time password.
- The amount is bait, not the prize: campaigns have demanded as little as 4.80 euros, because the real target is full card details that enable far larger charges.
- If you already paid, call your bank first: that is the single step that saves the most money, followed by monitoring your account and reporting the fraud.
Anatomy of a two-step smishing funnel
Correos acknowledges on its phishing information page that its position as the country’s leading parcel provider has made it a habitual target of these campaigns. The most common hooks are a demand for payment or a request to complete a delivery address. The structure is consistent: the victim is first asked for personal details, then for card data, often with a fee of just a few euros as the lure.
Spain’s national cybersecurity institute, INCIBE, documented one such campaign in an advisory on fraud impersonating parcel companies. A message sent in the name of SEUR claimed a package was held at customs over unpaid fees. The link led to a site resembling the legitimate one, which collected personal information first and, after the victim pressed confirm, banking details that ended up in criminal hands.
The same advisory describes two variants using the DHL brand: an email about an alleged failed delivery, complete with a tracking code and a button leading to a fake payment page, and a message titled as a DHL shipment notification that carried a malware-laden attachment. INCIBE flags a fourth trap separately: if the link pushes you to download an application, do not install it, because apps distributed this way are typically infected.
The sums involved can look almost comically small. An analysis of a fake Correos email demanding 4.80 euros in customs fees makes the logic clear: the money is not the objective. What the operators want is complete card data, which supports much larger charges. A payment of a couple of euros raises no alarms and leaves many victims unwilling to even mention it.
How to check whether a shipment is genuine
Start with the question Correos itself suggests: are you expecting a delivery, or are you a customer with a contracted service? If not, delete the message. If you are, skip the link entirely and open the company’s official website or app yourself, then look up your tracking number there.
Beyond that, each carrier plays by different rules, and the differences matter.
Correos: no payments by message, ever
The operator’s position is categorical: it never requests personal or banking data, nor payments, by email or SMS. For email, it offers a verifier: legitimate shipping and parcel messages end with a unique alphanumeric code that can be checked on its website alongside your address. If the verifier returns OK, the message is genuine. A parcel email bearing the Correos name but no code is, by the company’s own account, not from Correos.
Real customs procedures
Purchases from outside the European Union go through a customs process that, as Correos explained, is handled solely by the Tax Agency, and VAT or duties may apply. In that process, payment for orders up to 150 euros is managed from the Correos app by entering the shipment number; above that threshold, or when documentation is requested, it moves to the ADT Postales website. If you owe customs fees through Correos, you will see it there — not in a text message.
DHL: a legitimate customs notice is possible
Here is the nuance most guides omit. According to DHL’s fraud awareness page, the only payments it requests by email or SMS are customs duties and taxes, always before delivery, with a link to its platform identified by the waybill. Before processing payment, it sends a one-time password to the recipient’s registered contact. Its communications originate from @dhl.com and its subdomains, never from free accounts such as Gmail, and never link to third-party sites. The company also warns that fake texts typically carry a shortened URL and a generic sender rather than a number. With DHL, then, a customs notice can be legitimate: verify it on the company’s website using the tracking number your retailer provided.
Sender names get harder to fake
From 15 September 2026, under the CNMC’s alias registry rules, operators must block SMS, MMS and RCS messages using brand-name aliases that are not registered, so recipients can trust that the displayed sender corresponds to the actual sender. It is a useful filter against a fake Correos message slipping into the same thread as genuine alerts, but it offers no protection against texts sent from an ordinary number — still the usual format for many of these scams.
If you have already paid or shared your details
Call your bank immediately to report what happened and try to cancel the charges. That is INCIBE’s first recommendation and the one that saves the most money. Then:
- Review your transactions over the following days. If an unrecognised charge appears, the law gives you deadlines to dispute it.
- Distrust what comes next. If you handed over a phone number or email address, INCIBE warns it can be reused for further fraud or to impersonate you. A call from your bank the next day asking for a code is the classic sequel.
- If you installed an app from the link, uninstall it and avoid entering banking credentials on that phone until it has been checked.
- File a report with the Policía Nacional or the Guardia Civil.
- Seek help from the 017 cybersecurity helpline run by INCIBE, which also answers on WhatsApp at 900 116 117.
Where the notice impersonates DHL, the company asks that you forward the message to phishing@dhl.com; for texts, include a screenshot showing the sender’s number.
The fake parcel notice is among the most profitable messaging scams precisely because it leans on a routine behaviour: buying online and waiting for a delivery. What can change is the reflex. A link in a text message is never the way to pay for anything, even when the payment itself is real. Carriers would do well to converge on the stricter approach and stop requesting payments by message altogether; until then, users are left to remember which company does what — a lot to ask of someone who is simply waiting for a pair of trainers.