Fake Delivery Texts in Australia
How smishing texts impersonating Australia Post, DHL, and Toll Group steal card details and personal information from Australians — with reporting routes through Scamwatch, ReportCyber, and the ACCC.
Part of: Fake Delivery Texts
Last reviewed: 1 June 2026
Fake delivery notification texts are among the most widely reported scam contacts in Australia, with the ACCC's Scamwatch and the Australian Cyber Security Centre (ACSC) both publishing regular warnings about smishing campaigns impersonating parcel carriers. Australia's high e-commerce penetration and its reliance on a small number of dominant carriers makes the country a productive target for delivery text fraud.
This guide covers the Australian carrier brands most commonly impersonated in smishing campaigns, the official domains you should use directly to track parcels, and the correct reporting routes — including both Scamwatch for the consumer fraud aspect and ReportCyber for the cybercrime component.
How this scam works on Australia
Fake delivery texts targeting Australians most commonly impersonate Australia Post — the dominant carrier for domestic parcels — as well as DHL, FedEx, and Toll Group. The texts claim a parcel could not be delivered, that a customs or redelivery fee of a few dollars is owed, or that the recipient needs to confirm their address before delivery can proceed.
The link in the text leads to a convincing fake page copying Australia Post's branding. On a mobile browser, the URL is partially obscured. The page asks for the recipient's name, address, and full card details for the 'redelivery fee.' Some variants also request the recipient's date of birth and driver's licence number for 'customs verification.'
Australia Post's official statement is that it does not send texts or emails requiring payment via a link for any standard delivery service. Its official domain is auspost.com.au. Any text directing Australians to a different domain is fraudulent.
The ACSC's ASD Cyber Hygiene Improvement Programs team and the ACCC's Scamwatch both track these campaigns. Forwarding the text to 7226 (the Australian equivalent of the 7726 SPAM service used in other countries) is recommended by some carriers — though the primary Australian route is Scamwatch and ReportCyber.
Common red flags
- Unexpected text claiming to be Australia Post, DHL, or Toll asking for payment or address confirmation via a link
- Link that does not go to auspost.com.au, dhl.com, or the carrier's known official domain
- Request for card details to pay a small redelivery or customs fee through a text link
- Request for a driver's licence number or date of birth for 'customs verification'
- Text arrives when you are not expecting a delivery or from a mobile number rather than an official short code
How to protect yourself
- Track any parcel directly at auspost.com.au using your tracking number — do not use links in unsolicited texts
- Australia Post's official domain is auspost.com.au — type it directly into your browser, never follow a text link
- Australia Post does not request card payment via SMS link for standard delivery services
- If you are expecting a parcel, use the tracking number from your original order confirmation, not from an unexpected text
- Forward suspicious texts to Scamwatch or report online at scamwatch.gov.au
How to report it
- Report to Scamwatch at scamwatch.gov.au — include a screenshot of the text message and the link URL
- Report to ReportCyber at cyber.gov.au/report-a-cybercrime for the cybercrime component of the scam
- If card details were entered, contact your card issuer immediately to cancel the card and dispute unauthorised charges
- Forward the suspicious text to Australia Post at [email protected] if it impersonates Australia Post
Frequently asked questions
Does Australia Post send texts asking for payment?
Australia Post sends delivery notification texts for tracked parcels, but these do not request card payment via a link. If a genuine customs or import duty applies, Australia Post will communicate this through their official app or via a notice — not by sending you to a payment page via SMS. Any text requesting card payment via a link claiming to be Australia Post is fraudulent.
What is the difference between reporting to Scamwatch and ReportCyber in Australia?
Scamwatch is run by the ACCC and focuses on consumer fraud — it collects reports that drive public warnings and enforcement. ReportCyber is run by the Australian Cyber Security Centre and handles cybercrime reports including phishing. For a fake delivery text, reporting to both is ideal: Scamwatch for the consumer fraud record, ReportCyber for the phishing/cybercrime component.