Fake DHL SMS Phishing Campaign
Mass SMS campaigns impersonate DHL with fabricated shipment alerts, address-confirmation requests, and account security messages to harvest credentials and card details. Genuine DHL shipment notifications are tied to specific tracked parcels in your DHL account and never solicit passwords or payments through embedded links.
Part of: Fake Carrier SMS Phishing Scams
Last reviewed: 7 June 2026
DHL's legitimate SMS notification service keeps customers informed about shipment milestones — dispatch, out-for-delivery, delivered. Criminals mimic this format to send bulk messages to random phone numbers, banking on the probability that some recipients will be expecting a DHL delivery.
The messages are designed to appear routine. An address confirmation request looks like a normal step in a delivery process. An account security alert mimics a standard fraud-prevention measure. Only the destination link — pointing away from dhl.com — reveals the deception.
Because DHL operates globally, these campaigns are adapted for different countries and languages, often using local short-code style numbers and localised DHL branding. The underlying mechanics are identical: clicking the link and providing details hands data directly to scammers.
How this scam works on the DHL brand
Typical messages include: 'DHL: Confirm your delivery address to avoid return of parcel [#XXXXX]: [link]' or 'DHL Security: Unusual sign-in to your account detected. Verify: [link].' Both lead to phishing pages collecting personal and financial data.
DHL's real SMS notifications come from registered short codes and contain a tracking number directly verifiable at dhl.com. They never ask for your DHL account password or credit card number by text.
More sophisticated variants impersonate DHL Express business notifications, claiming a commercial invoice is incomplete and a small documentation fee is due, targeting small business owners who regularly ship internationally with DHL.
Common red flags
- Unsolicited DHL text you did not opt in to receive for a specific shipment
- Link leads to a domain other than dhl.com or a known DHL regional site
- Message asks for your DHL account password or financial details
- Tracking number in the message returns no result at dhl.com
- Business invoice or 'documentation fee' demanded via a link
- Generic text about a parcel with no specific tracking reference
- Sender number does not match DHL's known notification short code in your country
How to protect yourself
- Verify any DHL shipment by entering the tracking number directly at dhl.com
- Never click a link in an unsolicited DHL text; go to dhl.com or the DHL app directly
- Enable notifications only through the official DHL app to receive legitimate alerts
- Forward suspicious texts to 7726
- If credentials or card details were entered, change your DHL password and contact your bank
How to report it
- Report phishing to DHL at [email protected]
- Forward smishing texts to 7726
- Report to the FTC at reportfraud.ftc.gov or Action Fraud at actionfraud.police.uk
- Report phishing sites to your national cybersecurity centre
- If financial data was compromised, contact your bank immediately
Frequently asked questions
How do I sign up for legitimate DHL tracking texts?
You can enable SMS notifications through the DHL app or your DHL account by registering a specific tracking number. DHL does not send unsolicited tracking texts to arbitrary phone numbers.
What should I do if a DHL text seems suspicious?
Do not click any link. Go directly to dhl.com, enter the tracking number in the official tool, and check your DHL account for any real alerts. Forward the text to 7726.